ladybird/Libraries/LibWeb/HTML/BarProp.cpp
Andreas Kling 7afc862bc0 LibWeb: Handle BarProp without a top-level context
BarProp.visible first handles a null browsing context, but the
top-level browsing context lookup can also return null when the
relevant document is no longer fully active. Return true in that
case instead of dereferencing the null result.

Add a reduced Crash/HTML test from the domato fuzz-00063 sanitizer
finding that reads menubar.visible through an inactive frame window.
2026-06-08 01:04:08 +02:00

53 lines
1.4 KiB
C++

/*
* Copyright (c) 2025, the Ladybird developers.
*
* SPDX-License-Identifier: BSD-2-Clause
*/
#include <LibJS/Runtime/Realm.h>
#include <LibWeb/Bindings/BarProp.h>
#include <LibWeb/DOM/Document.h>
#include <LibWeb/HTML/BarProp.h>
#include <LibWeb/HTML/BrowsingContext.h>
#include <LibWeb/HTML/Window.h>
namespace Web::HTML {
GC_DEFINE_ALLOCATOR(BarProp);
GC::Ref<BarProp> BarProp::create(JS::Realm& realm)
{
return realm.create<BarProp>(realm);
}
BarProp::BarProp(JS::Realm& realm)
: Bindings::PlatformObject(realm)
{
}
// https://html.spec.whatwg.org/multipage/nav-history-apis.html#dom-barprop-visible
bool BarProp::visible() const
{
// 1. Let browsingContext be this's relevant global object's browsing context.
auto& global_object = HTML::relevant_global_object(*this);
auto browsing_context = as<HTML::Window>(global_object).associated_document().browsing_context();
// 2. If browsingContext is null, then return true.
if (!browsing_context) {
return true;
}
// 3. Return the negation of browsingContext's top-level browsing context's is popup.
auto top_level_browsing_context = browsing_context->top_level_browsing_context();
if (!top_level_browsing_context)
return true;
return top_level_browsing_context->is_popup() != TokenizedFeature::Popup::Yes;
}
void BarProp::initialize(JS::Realm& realm)
{
WEB_SET_PROTOTYPE_FOR_INTERFACE(BarProp);
Base::initialize(realm);
}
}