diff --git a/Tests/LibWeb/Text/expected/HTML/HTMLFrameElement-add-remove.txt b/Tests/LibWeb/Text/expected/HTML/HTMLFrameElement-add-remove.txt new file mode 100644 index 00000000000..50586a4cbfb --- /dev/null +++ b/Tests/LibWeb/Text/expected/HTML/HTMLFrameElement-add-remove.txt @@ -0,0 +1 @@ +PASS! (Didn't crash) diff --git a/Tests/LibWeb/Text/input/HTML/HTMLFrameElement-add-remove.html b/Tests/LibWeb/Text/input/HTML/HTMLFrameElement-add-remove.html new file mode 100644 index 00000000000..0abd829cec0 --- /dev/null +++ b/Tests/LibWeb/Text/input/HTML/HTMLFrameElement-add-remove.html @@ -0,0 +1,20 @@ + + + + + diff --git a/Userland/Libraries/LibWeb/HTML/NavigableContainer.cpp b/Userland/Libraries/LibWeb/HTML/NavigableContainer.cpp index b67a2890a6b..0bbfaaa09f6 100644 --- a/Userland/Libraries/LibWeb/HTML/NavigableContainer.cpp +++ b/Userland/Libraries/LibWeb/HTML/NavigableContainer.cpp @@ -194,6 +194,11 @@ HTML::WindowProxy* NavigableContainer::content_window() // https://html.spec.whatwg.org/multipage/iframe-embed-object.html#shared-attribute-processing-steps-for-iframe-and-frame-elements Optional NavigableContainer::shared_attribute_processing_steps_for_iframe_and_frame(bool initial_insertion) { + // AD-HOC: If the element was added and immediately removed, the content navigable will be null. Don't process the + // src attribute any further. + if (!m_content_navigable) + return {}; + // 1. Let url be the URL record about:blank. auto url = URL::URL("about:blank"); @@ -209,12 +214,10 @@ Optional NavigableContainer::shared_attribute_processing_steps_for_ifr // 3. If the inclusive ancestor navigables of element's node navigable contains a navigable // whose active document's URL equals url with exclude fragments set to true, then return null. - if (m_content_navigable) { - for (auto const& navigable : document().inclusive_ancestor_navigables()) { - VERIFY(navigable->active_document()); - if (navigable->active_document()->url().equals(url, URL::ExcludeFragment::Yes)) - return {}; - } + for (auto const& navigable : document().inclusive_ancestor_navigables()) { + VERIFY(navigable->active_document()); + if (navigable->active_document()->url().equals(url, URL::ExcludeFragment::Yes)) + return {}; } // 4. If url matches about:blank and initialInsertion is true, then perform the URL and history update steps given element's content navigable's active document and url.