Luke Wilde 48e11a1f12 LibWeb: Empty CE reaction queue instead of destroying it on exception ... If an exception occurs in a custom element constructor, we clear the reaction queue by destroying it, instead of emptying the Vector. 3da6916383/Userland/Libraries/LibWeb/DOM/Element.cpp (L2033) This causes a UAF here, as async upgrades (i.e. custom elements not created by document.createElement) are performed in this loop: 3da6916383/Userland/Libraries/LibWeb/Bindings/MainThreadVM.cpp (L657) Fixes crash when loading https://github.com/SerenityOS/serenity		2024-02-29 21:58:01 -05:00
..
data	Tests/LibWeb: Move LibWeb test frames to their own directory	2024-02-19 22:11:59 -05:00
expected	LibWeb: Empty CE reaction queue instead of destroying it on exception	2024-02-29 21:58:01 -05:00
input	LibWeb: Empty CE reaction queue instead of destroying it on exception	2024-02-29 21:58:01 -05:00