LibWeb: Don't allow setting Range start/end to document being destroyed

2 files changed, 9 insertions, 0 deletions

diff --git a/Userland/Libraries/LibWeb/DOM/Document.h b/Userland/Libraries/LibWeb/DOM/Document.h
index 079d4e95aa..dc6211beed 100644
--- a/Userland/Libraries/LibWeb/DOM/Document.h
+++ b/Userland/Libraries/LibWeb/DOM/Document.h
@@ -338,6 +338,8 @@ public:
     bool needs_full_style_update() const { return m_needs_full_style_update; }
     void set_needs_full_style_update(bool b) { m_needs_full_style_update = b; }
 
+    bool in_removed_last_ref() const { return m_in_removed_last_ref; }
+
 private:
     explicit Document(const AK::URL&);
 
diff --git a/Userland/Libraries/LibWeb/DOM/Range.cpp b/Userland/Libraries/LibWeb/DOM/Range.cpp
index 6ed57abe02..127b0ef659 100644
--- a/Userland/Libraries/LibWeb/DOM/Range.cpp
+++ b/Userland/Libraries/LibWeb/DOM/Range.cpp
@@ -129,6 +129,13 @@ static RelativeBoundaryPointPosition position_of_boundary_point_relative_to_othe
 
 ExceptionOr<void> Range::set_start_or_end(Node& node, u32 offset, StartOrEnd start_or_end)
 {
+    // FIXME: If the incoming node is part of a document that's in the process of being destroyed,
+    //        we just ignore this. This prevents us from trying to re-ref a document during its
+    //        destruction process. This is a hack and should be replaced with some smarter form
+    //        of lifetime management.
+    if (node.document().in_removed_last_ref())
+        return {};
+
     // To set the start or end of a range to a boundary point (node, offset), run these steps:
 
     // 1. If node is a doctype, then throw an "InvalidNodeTypeError" DOMException.