Skip to content

Commit a9a3994

Browse files
committed
Do not allow focusing into an unloaded document
This could result in a dangling pointer to the document in the document focus history. This would further lead to a crash under certain circumstances, when the destroyed document was accessed from the focus history, see #730.
1 parent b3efa49 commit a9a3994

File tree

1 file changed

+7
-0
lines changed

1 file changed

+7
-0
lines changed

Source/Core/Context.cpp

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -993,6 +993,13 @@ bool Context::OnFocusChange(Element* new_focus, bool focus_visible)
993993
if (old_document && old_document->IsModal() && (!new_document || !(new_document->IsModal() || new_document->IsFocusableFromModal())))
994994
return false;
995995

996+
// If the document of the new focus has been closed, deny the request.
997+
if (std::find_if(unloaded_documents.begin(), unloaded_documents.end(),
998+
[&](const auto& unloaded_document) { return unloaded_document.get() == new_document; }) != unloaded_documents.end())
999+
{
1000+
return false;
1001+
}
1002+
9961003
// Build the old chains
9971004
Element* element = old_focus;
9981005
while (element)

0 commit comments

Comments
 (0)