RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-26 02:17:34 +00:00
Code Issues Activity Actions

LibWeb: Fix null pointer dereference in DOM::Node::remove()

Browse source 
Instead of blindly dereferencing m_registered_observer_list, just use
the add_registered_observer() helper.

Fixes #22005
This commit is contained in:
Andreas Kling 2023-11-20 20:03:43 +01:00
parent 7320fdc1f5
commit cc9de38ea4
3 changed files with 15 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

1
Tests/LibWeb/Text/expected/MutationObserver/removing-a-node.txt Normal file
View file

@ -0,0 +1 @@
PASS! (Didn't crash)

13
Tests/LibWeb/Text/input/MutationObserver/removing-a-node.html Normal file
View file

@ -0,0 +1,13 @@
<body>
<script src="../include.js"></script>
<script>
test(() => {
let observer = new MutationObserver(function() {});
observer.observe(document.body, { attributes: true, childList: true, subtree: true });
let div = document.createElement("div");
document.body.appendChild(div);
div.remove();
println("PASS! (Didn't crash)");
});
</script>

2
Userland/Libraries/LibWeb/DOM/Node.cpp
View file

@ -693,7 +693,7 @@ void Node::remove(bool suppress_observers)
for (auto& registered : *inclusive_ancestor->m_registered_observer_list) { for (auto& registered : *inclusive_ancestor->m_registered_observer_list) {
if (registered->options().subtree) { if (registered->options().subtree) {
auto transient_observer = TransientRegisteredObserver::create(registered->observer(), registered->options(), registered); auto transient_observer = TransientRegisteredObserver::create(registered->observer(), registered->options(), registered);
m_registered_observer_list->append(move(transient_observer)); add_registered_observer(move(transient_observer));
} }
} }
} }