Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: e5d3b562ec6fc7d6d4e75ce47c6b7a6979251ca5
https://github.com/WebKit/WebKit/commit/e5d3b562ec6fc7d6d4e75ce47c6b7a6979251ca5
Author: Kristian Monsen <[email protected]>
Date: 2026-07-28 (Tue, 28 Jul 2026)
Changed paths:
A
LayoutTests/navigation-api/navigation-api-remove-document-element-in-navigate-handler-crash-expected.txt
A
LayoutTests/navigation-api/navigation-api-remove-document-element-in-navigate-handler-crash.html
A
LayoutTests/navigation-api/resources/navigation-api-remove-document-element-in-navigate-handler-crash-inner.html
M Source/WebCore/page/NavigateEvent.cpp
Log Message:
-----------
Crash in NavigateEvent::finish when document element is removed inside
navigate handler
https://bugs.webkit.org/show_bug.cgi?id=320242
rdar://182122186
Reviewed by Chris Dumez.
When a navigate handler removes document.documentElement, NavigateEvent::finish
called findAutofocusDelegate() on the null return value of documentElement(),
dereferencing a null
pointer. The fix guards that call so focus reset is simply skipped when there
is no document element.
Test:
navigation-api/navigation-api-remove-document-element-in-navigate-handler-crash.html
*
LayoutTests/navigation-api/navigation-api-remove-document-element-in-navigate-handler-crash-expected.txt:
Added.
*
LayoutTests/navigation-api/navigation-api-remove-document-element-in-navigate-handler-crash.html:
Added.
*
LayoutTests/navigation-api/resources/navigation-api-remove-document-element-in-navigate-handler-crash-inner.html:
Added.
* Source/WebCore/page/NavigateEvent.cpp:
(WebCore::NavigateEvent::finish):
Canonical link: https://commits.webkit.org/318041@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
