DOM: Check for navigable destruction in declarative refresh timer

If the Document's navigable has been destroyed since we started this
timer, or it's no longer the active document of its navigable, we
shouldn't navigate to it.
This commit is contained in:
Andrew Kaster 2024-06-05 16:22:49 -06:00 committed by Andreas Kling
parent b040e5c12b
commit 7b67fa706f
Notes: sideshowbarker 2024-07-17 07:43:44 +09:00

View File

@ -4062,8 +4062,11 @@ void Document::shared_declarative_refresh_steps(StringView input, JS::GCPtr<HTML
if (has_meta_element && has_flag(active_sandboxing_flag_set(), HTML::SandboxingFlagSet::SandboxedAutomaticFeatures))
return;
VERIFY(navigable());
MUST(navigable()->navigate({ .url = url_record, .source_document = *this }));
auto navigable = this->navigable();
if (!navigable || navigable->has_been_destroyed())
return;
MUST(navigable->navigate({ .url = url_record, .source_document = *this, .history_handling = Bindings::NavigationHistoryBehavior::Replace }));
});
// For the purposes of the previous paragraph, a refresh is said to have come due as soon as the later of the