LadybirdBrowser/ladybird
1
1
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2024-09-11 05:25:32 +03:00
Code Issues Packages Projects Releases Wiki Activity

LibWeb: Correct logic for removing end nodes from HTMLOptionsCollection

Browse Source 
This test case would previously crash.

Found with domato.
This commit is contained in:
Sam Atkins 2024-07-27 13:33:51 +01:00 committed by Tim Ledbetter
parent f61e54b10c
commit 0cec68ea99
Notes: github-actions[bot] 2024-07-27 19:24:14 +00:00 
Author: https://github.com/AtkinsSJ
Commit: https://github.com/LadybirdBrowser/ladybird/commit/0cec68ea996
Pull-request: https://github.com/LadybirdBrowser/ladybird/pull/865
Reviewed-by: https://github.com/tcl3 ✅
3 changed files with 17 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
Tests/LibWeb/Text/expected/DOM/HTMLSelectElement-length.txt Normal file
View File

@ -0,0 +1,3 @@
0
1
0

12
Tests/LibWeb/Text/input/DOM/HTMLSelectElement-length.html Normal file
View File

@ -0,0 +1,12 @@
<script src="../include.js"></script>
<script>
test(() => {
const select = document.createElement("select");
const option = document.createElement("option");
println(select.length);
select.add(option);
println(select.length);
select.length = 0;
println(select.length);
});
</script>

4
Userland/Libraries/LibWeb/HTML/HTMLOptionsCollection.cpp
View File

@ -66,8 +66,8 @@ WebIDL::ExceptionOr<void> HTMLOptionsCollection::set_length(WebIDL::UnsignedLong
auto n = current - value;
// 3.2. Remove the last n nodes in the collection from their parent nodes.
for (WebIDL::UnsignedLong i = current - 1; i >= current - n; i--)
this->item(i)->remove();
for (auto i = 0u; i < n; i++)
item(length() - 1)->remove();
}
return {};