Files
ladybird/Userland/Libraries/LibWeb/DOM
Luke Wilde 48e11a1f12 LibWeb: Empty CE reaction queue instead of destroying it on exception
If an exception occurs in a custom element constructor, we clear the
reaction queue by destroying it, instead of emptying the Vector.
3da6916383/Userland/Libraries/LibWeb/DOM/Element.cpp (L2033)

This causes a UAF here, as async upgrades (i.e. custom elements not
created by document.createElement) are performed in this loop:
3da6916383/Userland/Libraries/LibWeb/Bindings/MainThreadVM.cpp (L657)

Fixes crash when loading https://github.com/SerenityOS/serenity
2024-02-29 21:58:01 -05:00
..
2023-11-11 08:51:51 +01:00
2023-11-11 08:51:51 +01:00
2023-11-11 08:51:51 +01:00
2024-02-25 08:54:31 +01:00
2023-11-11 08:51:51 +01:00
2024-01-20 08:56:52 +01:00
2023-11-11 08:51:51 +01:00