Skip to content

Commit

Permalink
LibWeb: Create HeapFunction for after_document_populated callback
Browse files Browse the repository at this point in the history
Now the callback is visited by SafeFunction callback of
deferred_invoke().

Fixes use-after-free ASAN error that happens if you try to reload the
page.
  • Loading branch information
kalenikaliaksandr committed Apr 23, 2024
1 parent 751ddae commit 7423921
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions Userland/Libraries/LibWeb/HTML/TraversableNavigable.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -599,10 +599,10 @@ TraversableNavigable::HistoryStepResult TraversableNavigable::apply_the_history_
// 7. In parallel, attempt to populate the history entry's document for targetEntry, given navigable, potentiallyTargetSpecificSourceSnapshotParams,
// targetSnapshotParams, with allowPOST set to allowPOST and completionSteps set to queue a global task on the navigation and traversal task source given
// navigable's active window to run afterDocumentPopulated.
Platform::EventLoopPlugin::the().deferred_invoke([populated_target_entry, potentially_target_specific_source_snapshot_params, target_snapshot_params, this, allow_POST, navigable, after_document_populated] {
Platform::EventLoopPlugin::the().deferred_invoke([populated_target_entry, potentially_target_specific_source_snapshot_params, target_snapshot_params, this, allow_POST, navigable, after_document_populated = JS::create_heap_function(this->heap(), move(after_document_populated))] {
navigable->populate_session_history_entry_document(populated_target_entry, *potentially_target_specific_source_snapshot_params, target_snapshot_params, {}, Empty {}, CSPNavigationType::Other, allow_POST, [this, after_document_populated, populated_target_entry]() mutable {
queue_global_task(Task::Source::NavigationAndTraversal, *active_window(), JS::create_heap_function(this->heap(), [after_document_populated, populated_target_entry]() mutable {
after_document_populated(true, populated_target_entry);
after_document_populated->function()(true, populated_target_entry);
}));
})
.release_value_but_fixme_should_propagate_errors();
Expand Down

0 comments on commit 7423921

Please sign in to comment.