RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-10-31 17:52:45 +00:00
Code Issues Activity Actions

LibWeb: Fix bogus insertion logic in HTMLTableSectionElement.insertRow()

Browse source 
Found by Domato :^)
This commit is contained in:
Andreas Kling 2024-03-12 10:22:19 +01:00
parent 7625d8a155
commit c11f710628
3 changed files with 16 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
Tests/LibWeb/Text/expected/HTML/tbody-insert-row.txt Normal file
View file

@ -0,0 +1,4 @@
2
[object HTMLTableRowElement]
[object HTMLTableRowElement]
PASS (didn't crash)

11
Tests/LibWeb/Text/input/HTML/tbody-insert-row.html Normal file
View file

@ -0,0 +1,11 @@
<table><tbody id="tbody"><tr></tr></tbody></table>
<script src="../include.js"></script>
<script>
test(() => {
tbody.insertRow(0);
println(tbody.rows.length)
println(tbody.rows[0])
println(tbody.rows[1])
println("PASS (didn't crash)");
});
</script>

2
Userland/Libraries/LibWeb/HTML/HTMLTableSectionElement.cpp
View file

@ -66,7 +66,7 @@ WebIDL::ExceptionOr<JS::NonnullGCPtr<HTMLTableRowElement>> HTMLTableSectionEleme
TRY(append_child(table_row));
// 4. Otherwise, insert table row as a child of this element, immediately before the index-th tr element in the rows collection.
else
table_row.insert_before(*this, rows_collection->item(index));
insert_before(table_row, rows_collection->item(index));
// 5. Return table row.
return JS::NonnullGCPtr(table_row);