dmaax/ladybird
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
ladybird/Libraries/LibWeb
History
sideshowbarker efa9388adc LibWeb: Fix use-after-free in live-collection filter captures 
Problem: Holding form.elements while the form is detached + dropped hit
a use-after-free: the form is GC’ed while the collection’s still live.

Cause: HTMLCollection (and LiveNodeList too) was storing its filter as
an AK::Function — which the garbage collector doesn’t visit. When a
filter lambda captures a GC object (e.g. the form in form.elements) that
object has no GC edge keeping it alive. So it can be collected while the
collection using it’s still reachable — leaving a dangling pointer.

Fix: HTMLCollection and LiveNodeList are GC cells with their own
visit_edges. So, visit the filter’s (and sort’s) capture range there:
conservatively mark any GC object a captured lambda holds — to ensure
it’s kept alive as long as the collection’s reachable.

Fixes https://github.com/LadybirdBrowser/ladybird/issues/9948
2026-06-07 22:16:33 +02:00
..
Animations LibWeb: Make computed style data refcounted 2026-06-06 23:29:48 +02:00
ARIA Meta: Enable exit-time destructor warnings for libraries 2026-06-04 19:20:49 +02:00
Bindings Meta: Enable exit-time destructor warnings for libraries 2026-06-04 19:20:49 +02:00
Clipboard LibWeb: Unify WebIDL C++ type generation 2026-05-23 18:26:12 +02:00
Compositor Compositor+LibWeb+WebContent: Add visual context tree update IPC 2026-06-03 02:12:39 +01:00
Compression LibWeb+LibIDL: Remove support for #import directives during parsing 2026-04-24 20:08:29 +02:00
ContentBlocker/Rust LibWeb: Route content blocker Rust allocations through mimalloc 2026-06-03 06:48:08 -04:00
ContentSecurityPolicy Meta: Enable exit-time destructor warnings for libraries 2026-06-04 19:20:49 +02:00
CookieStore LibWeb/Bindings: Generate struct definitions from IDL dictionaries 2026-05-09 10:49:49 +02:00
CredentialManagement LibWeb/Bindings: Generate struct definitions from IDL dictionaries 2026-05-09 10:49:49 +02:00
Crypto Meta: Enable exit-time destructor warnings for libraries 2026-06-04 19:20:49 +02:00
CSS LibWeb: Make layout nodes refcounted 2026-06-07 20:52:49 +02:00
DOM LibWeb: Fix use-after-free in live-collection filter captures 2026-06-07 22:16:33 +02:00
DOMURL LibWeb: Unify WebIDL C++ type generation 2026-05-23 18:26:12 +02:00
Editing Meta: Enable exit-time destructor warnings for libraries 2026-06-04 19:20:49 +02:00
Encoding LibWeb/Bindings: Generate buffer typedefs as variants 2026-05-30 11:22:08 +02:00
EncryptedMediaExtensions LibWeb/Bindings: Generate struct definitions from IDL dictionaries 2026-05-09 10:49:49 +02:00
EntriesAPI LibWeb/Bindings: Emit one bindings header and cpp per IDL 2026-04-21 07:36:13 +02:00
EventTiming LibWeb/Bindings: Generate struct definitions from IDL dictionaries 2026-05-09 10:49:49 +02:00
Fetch LibWeb/Fetch: Implement CORS-preflight cache 2026-06-06 13:48:43 +02:00
FileAPI Meta: Enable exit-time destructor warnings for libraries 2026-06-04 19:20:49 +02:00
Fullscreen LibWeb+LibIDL: Remove support for #import directives during parsing 2026-04-24 20:08:29 +02:00
Gamepad Meta: Enable exit-time destructor warnings for libraries 2026-06-04 19:20:49 +02:00
Geolocation LibWeb: Support Geolocation permission 2026-05-11 21:01:01 +02:00
Geometry LibWeb: Remove various case of unneeded use of GC::Root 2026-05-29 17:21:17 +02:00
GPC
HighResolutionTime LibWeb/Bindings: Generate struct definitions from IDL dictionaries 2026-05-09 10:49:49 +02:00
HTML LibWeb: Make layout nodes refcounted 2026-06-07 20:52:49 +02:00
IndexedDB Meta: Enable exit-time destructor warnings for libraries 2026-06-04 19:20:49 +02:00
Infra
Internals LibWeb: Allow Option-generated text insertion 2026-06-03 13:51:32 +02:00
IntersectionObserver LibWeb: Make layout nodes refcounted 2026-06-07 20:52:49 +02:00
Layout LibWeb: Make layout nodes refcounted 2026-06-07 20:52:49 +02:00
Loader Meta: Enable exit-time destructor warnings for libraries 2026-06-04 19:20:49 +02:00
MathML Meta: Enable exit-time destructor warnings for libraries 2026-06-04 19:20:49 +02:00
MediaCapabilitiesAPI LibWeb/Bindings: Generate struct definitions from IDL dictionaries 2026-05-09 10:49:49 +02:00
MediaCapture Meta: Enable exit-time destructor warnings for libraries 2026-06-04 19:20:49 +02:00
MediaSourceExtensions Meta: Enable exit-time destructor warnings for libraries 2026-06-04 19:20:49 +02:00
MimeSniff
MixedContent LibWeb: Reduce recompilation impact of DOM/Document.h 2026-02-11 20:02:28 +01:00
NavigationTiming Meta: Enable exit-time destructor warnings for libraries 2026-06-04 19:20:49 +02:00
NotificationsAPI LibWeb/Bindings: Generate struct definitions from IDL dictionaries 2026-05-09 10:49:49 +02:00
Page LibWeb: Make layout nodes refcounted 2026-06-07 20:52:49 +02:00
Painting LibWeb: Make layout nodes refcounted 2026-06-07 20:52:49 +02:00
PerformanceTimeline Meta: Enable exit-time destructor warnings for libraries 2026-06-04 19:20:49 +02:00
PermissionsAPI Meta: Enable exit-time destructor warnings for libraries 2026-06-04 19:20:49 +02:00
PermissionsPolicy Meta: Enable exit-time destructor warnings for libraries 2026-06-04 19:20:49 +02:00
Platform LibWeb: Keep active platform timers alive during GC 2026-05-10 10:58:11 +02:00
ReferrerPolicy
RequestIdleCallback LibWeb/Bindings: Generate struct definitions from IDL dictionaries 2026-05-09 10:49:49 +02:00
ResizeObserver LibGC: Default-construct RootVector from the global heap 2026-05-20 20:37:55 +02:00
ResourceTiming LibWeb/Bindings: Generate struct definitions from IDL dictionaries 2026-05-09 10:49:49 +02:00
Rust Rust: Set import granularity to Item 2026-05-28 06:52:18 +02:00
SecureContexts LibWeb/SecureContexts: Correct the 127.0.0.0/8 trustworthiness check 2026-05-31 21:56:18 +02:00
Selection LibWeb: Avoid a crash in Selection.containsNode() with a detached range 2026-05-22 16:39:25 +02:00
Serial LibWeb/Bindings: Generate struct definitions from IDL dictionaries 2026-05-09 10:49:49 +02:00
ServiceWorker Meta: Enable exit-time destructor warnings for libraries 2026-06-04 19:20:49 +02:00
Speech LibWeb/Bindings: Generate struct definitions from IDL dictionaries 2026-05-09 10:49:49 +02:00
SRI
StorageAPI LibWeb: Implement legacy-clone of session storage shed on window.open 2026-05-18 16:38:15 +02:00
Streams LibWeb/Bindings: Generate buffer typedefs as variants 2026-05-30 11:22:08 +02:00
SVG LibWeb: Make layout nodes refcounted 2026-06-07 20:52:49 +02:00
TrustedTypes Meta: Enable exit-time destructor warnings for libraries 2026-06-04 19:20:49 +02:00
UIEvents Meta: Enable exit-time destructor warnings for libraries 2026-06-04 19:20:49 +02:00
URLPattern LibURL: Implement URLPattern in Rust 2026-05-28 09:27:41 +02:00
UserTiming LibWeb/Bindings: Generate struct definitions from IDL dictionaries 2026-05-09 10:49:49 +02:00
ViewTransition LibWeb: Skip non-rendered elements before querying view transition name 2026-05-28 10:39:26 +02:00
WebAssembly LibWeb/WebAssembly: Add missing WebIDL/Types.h include 2026-06-06 19:16:52 +02:00
WebAudio LibWeb: Remove various case of unneeded use of GC::Root 2026-05-29 17:21:17 +02:00
WebDriver Meta: Enable exit-time destructor warnings for libraries 2026-06-04 19:20:49 +02:00
WebGL Meta: Enable exit-time destructor warnings for libraries 2026-06-04 19:20:49 +02:00
WebIDL Meta: Enable exit-time destructor warnings for libraries 2026-06-04 19:20:49 +02:00
WebSockets LibWeb/Bindings: Generate buffer typedefs as variants 2026-05-30 11:22:08 +02:00
WebVTT LibWeb+LibIDL: Remove support for #import directives during parsing 2026-04-24 20:08:29 +02:00
WebXR LibWeb: Unify WebIDL C++ type generation 2026-05-23 18:26:12 +02:00
Worker LibWeb+LibHTTP+LibWebView: Implement HSTS 2026-05-29 22:23:33 +02:00
XHR LibWeb: Use FormDataEntryValue for FormData.get() 2026-06-06 16:59:12 +02:00
XLink
XML LibGC: Default-construct RootVector from the global heap 2026-05-20 20:37:55 +02:00
XPath LibWeb+LibIDL: Remove support for #import directives during parsing 2026-04-24 20:08:29 +02:00
CMakeLists.txt LibWeb/Fetch: Implement CORS-preflight cache 2026-06-06 13:48:43 +02:00
Dump.cpp LibWeb: Rename use_pseudo_element 2026-05-21 14:26:22 +01:00
Dump.h LibWeb: Rename show_cascaded_properties flag in dump_tree() 2026-05-05 16:02:23 +02:00
Forward.h LibWeb: Expose document caretPositionFromPoint 2026-05-30 13:50:48 +02:00
GraphemeEdgeTracker.cpp LibWeb: Use the ASCII line segmenter for eligible text 2026-05-05 18:59:07 +02:00
GraphemeEdgeTracker.h LibWeb: Expose GraphemeEdgeTracker's find_line_start/find_line_end 2026-02-06 14:18:10 +00:00
idl_files.cmake LibWeb: Expose document caretPositionFromPoint 2026-05-30 13:50:48 +02:00
InvalidateDisplayList.h
Namespace.cpp Meta: Enable exit-time destructor warnings for libraries 2026-06-04 19:20:49 +02:00
Namespace.h Meta: Enable exit-time destructor warnings for libraries 2026-06-04 19:20:49 +02:00
PixelUnits.cpp LibIPC: Support DistinctNumeric serialization 2026-05-21 11:45:06 +01:00
PixelUnits.h LibIPC: Support DistinctNumeric serialization 2026-05-21 11:45:06 +01:00
RefCountedTreeNode.h LibWeb: Make layout nodes refcounted 2026-06-07 20:52:49 +02:00
TraversalDecision.h
TraversalOrder.h
TreeNode.h LibWeb: Make Paintable tree ref-counted 2026-05-07 15:03:44 +02:00