ladybird/Tests/LibWeb/Text/input/HTML/custom-elements-throw-in-constructor.html

<!DOCTYPE html>
<test-element></test-element>
<script src="../include.js"></script>
<script>
    test(() => {
        removeTestErrorHandler()
        window.addEventListener("error", (event) => { println(`${event.message}`); })
        class TestElement extends HTMLElement {
            constructor() {
                super();
                println("Entered TestElement constructor, throwing.");
                throw "test";
            }

            connectedCallback() {
                println("connectedCallback");
            }
        }

        customElements.define("test-element", TestElement);
        println("PASS! (Didn't crash)");
    });
</script>
Meta: Add DOCTYPEs to most text tests 2025-03-18 19:28:35 +01:00			`<!DOCTYPE html>`
LibWeb: Empty CE reaction queue instead of destroying it on exception If an exception occurs in a custom element constructor, we clear the reaction queue by destroying it, instead of emptying the Vector. https://github.com/SerenityOS/serenity/blob/3da6916383afc1c8a8b59dae38c4bc02680b50ba/Userland/Libraries/LibWeb/DOM/Element.cpp#L2033 This causes a UAF here, as async upgrades (i.e. custom elements not created by document.createElement) are performed in this loop: https://github.com/SerenityOS/serenity/blob/3da6916383afc1c8a8b59dae38c4bc02680b50ba/Userland/Libraries/LibWeb/Bindings/MainThreadVM.cpp#L657 Fixes crash when loading https://github.com/SerenityOS/serenity 2024-03-01 00:58:51 +00:00			`<test-element></test-element>`
			`<script src="../include.js"></script>`
			`<script>`
			`test(() => {`
LibWeb: Report exceptions from custom element upgrades to global object 2024-11-23 15:42:01 -07:00			`removeTestErrorHandler()`
			window.addEventListener("error", (event) => { println(`${event.message}`); })
LibWeb: Empty CE reaction queue instead of destroying it on exception If an exception occurs in a custom element constructor, we clear the reaction queue by destroying it, instead of emptying the Vector. https://github.com/SerenityOS/serenity/blob/3da6916383afc1c8a8b59dae38c4bc02680b50ba/Userland/Libraries/LibWeb/DOM/Element.cpp#L2033 This causes a UAF here, as async upgrades (i.e. custom elements not created by document.createElement) are performed in this loop: https://github.com/SerenityOS/serenity/blob/3da6916383afc1c8a8b59dae38c4bc02680b50ba/Userland/Libraries/LibWeb/Bindings/MainThreadVM.cpp#L657 Fixes crash when loading https://github.com/SerenityOS/serenity 2024-03-01 00:58:51 +00:00			`class TestElement extends HTMLElement {`
			`constructor() {`
			`super();`
			`println("Entered TestElement constructor, throwing.");`
			`throw "test";`
			`}`

			`connectedCallback() {`
			`println("connectedCallback");`
			`}`
			`}`

			`customElements.define("test-element", TestElement);`
			`println("PASS! (Didn't crash)");`
			`});`
			`</script>`