Skip to content

Crash: HTMLLinkElement assert when toggling stylesheet href #6273

@shlyakpavel

Description

@shlyakpavel

Summary

Crash in HTMLLinkElement when rapidly toggling stylesheet href; assertion in process_stylesheet_resource.

Operating system

macOS

Steps to reproduce

  1. Open the minimal repro page in Ladybird
  2. Observe

Expected behavior

It doesn't crash

Actual behavior

It crashes

URL for a reduced test case

N/A

HTML/SVG/etc. source for a reduced test case

<!doctype html>
<link id="l" rel="stylesheet" href="a.css">
<script>
  const l = document.getElementById('l');
  // Trigger overlapping stylesheet fetch lifecycles:
  l.removeAttribute('href');
  l.setAttribute('href', '  page.html  ');
  l.setAttribute('href', 'ht!tp://example.com');
</script>

Log output and (if possible) backtrace

Ladybird PID file '/Users/pavel/Library/Application Support/Ladybird.pid' exists with PID 47374, but process cannot be found
2025-09-23 01:39:06.234 Ladybird[47941:6692075] WARNING <NSToolbarItem: 0x974d115e0> -> view was automatically measured but had an ambiguous height or width and the view's frame size had a zero height or width. Did you forget to add constraints on your view or its subview(s)? Try adding constraints or give the view an intrinsicContentSize
2025-09-23 01:39:06.234 Ladybird[47941:6692075] WARNING <NSToolbarItem: 0x974d115e0> -> view was automatically measured but had an ambiguous height or width and the view's frame size had a zero height or width. Did you forget to add constraints on your view or its subview(s)? Try adding constraints or give the view an intrinsicContentSize
2025-09-23 01:39:06.294 Ladybird[47941:6692075] WARNING <NSToolbarItem: 0x974d115e0> -> view was automatically measured but had an ambiguous height or width and the view's frame size had a zero height or width. Did you forget to add constraints on your view or its subview(s)? Try adding constraints or give the view an intrinsicContentSize
2025-09-23 01:39:06.294 Ladybird[47941:6692075] WARNING <NSToolbarItem: 0x974d115e0> -> view was automatically measured but had an ambiguous height or width and the view's frame size had a zero height or width. Did you forget to add constraints on your view or its subview(s)? Try adding constraints or give the view an intrinsicContentSize
531037.441 WebContent(47950): ResourceLoader: Failed load of: "file:///Users/pavel/Develop/ladybird/a.css", Error: No such file or directory (errno=2), Duration: 4ms
531037.444 WebContent(47950): ResourceLoader: Failed load of: "file:///Users/pavel/Develop/ladybird/ht!tp://example.com", Error: No such file or directory (errno=2), Duration: 1ms
531037.444 WebContent(47950): ResourceLoader: Failed load of: "file:///Users/pavel/Develop/ladybird/page.html", Error: No such file or directory (errno=2), Duration: 1ms
531037.444 WebContent(47950): ResourceLoader: Failed load of: "file:///Users/pavel/Develop/ladybird/ht!tp://example.com", Error: No such file or directory (errno=2), Duration: 1ms
531037.445 WebContent(47950): ResourceLoader: Failed load of: "file:///Users/pavel/Develop/ladybird/page.html", Error: No such file or directory (errno=2), Duration: 1ms
VERIFICATION FAILED: document().script_blocking_style_sheet_set().contains(*this) at /Users/pavel/Develop/ladybird/Libraries/LibWeb/HTML/HTMLLinkElement.cpp:519
0   liblagom-ak.0.0.0.dylib             0x0000000103c8d6a0 dump_backtrace + 72
1   liblagom-ak.0.0.0.dylib             0x0000000103c8d958 ak_trap + 12
2   liblagom-ak.0.0.0.dylib             0x0000000103c8da04 ak_assertion_failed + 0
3   liblagom-web.0.0.0.dylib            0x0000000107eea3f4 Web::HTML::HTMLMapElement::initialize(JS::Realm&) (.cold.1) + 0
4   liblagom-web.0.0.0.dylib            0x00000001071e43bc Web::HTML::HTMLLinkElement::process_stylesheet_resource(bool, Web::Fetch::Infrastructure::Response const&, AK::Variant<AK::Empty, Web::Fetch::Infrastructure::FetchAlgorithms::ConsumeBodyFailureTag, AK::Detail::ByteBuffer<32ul>>) + 2244
5   liblagom-web.0.0.0.dylib            0x00000001071e6930 AK::Function<void (GC::Ref<Web::Fetch::Infrastructure::Response>, AK::Variant<AK::Empty, Web::Fetch::Infrastructure::FetchAlgorithms::ConsumeBodyFailureTag, AK::Detail::ByteBuffer<32ul>>)>::CallableWrapper<Web::HTML::HTMLLinkElement::default_fetch_and_process_linked_resource()::$_0>::call(GC::Ref<Web::Fetch::Infrastructure::Response>, AK::Variant<AK::Empty, Web::Fetch::Infrastructure::FetchAlgorithms::ConsumeBodyFailureTag, AK::Detail::ByteBuffer<32ul>>) + 320
6   liblagom-web.0.0.0.dylib            0x0000000107102f88 AK::Function<void (GC::Ref<Web::Fetch::Infrastructure::Response>, AK::Variant<AK::Empty, Web::Fetch::Infrastructure::FetchAlgorithms::ConsumeBodyFailureTag, AK::Detail::ByteBuffer<32ul>>)>::operator()(GC::Ref<Web::Fetch::Infrastructure::Response>, AK::Variant<AK::Empty, Web::Fetch::Infrastructure::FetchAlgorithms::ConsumeBodyFailureTag, AK::Detail::ByteBuffer<32ul>>) const + 228
7   liblagom-web.0.0.0.dylib            0x0000000107102e14 AK::Function<void (AK::Detail::ByteBuffer<32ul>)>::CallableWrapper<Web::Fetch::Fetching::fetch_response_handover(JS::Realm&, Web::Fetch::Infrastructure::FetchParams const&, Web::Fetch::Infrastructure::Response&)::$_4>::call(AK::Detail::ByteBuffer<32ul>) + 172
8   liblagom-web.0.0.0.dylib            0x00000001070ed7ac AK::Function<void (AK::Detail::ByteBuffer<32ul>)>::operator()(AK::Detail::ByteBuffer<32ul>) const + 192
9   liblagom-web.0.0.0.dylib            0x0000000107103134 AK::Function<void ()>::CallableWrapper<Web::Fetch::Fetching::fetch_response_handover(JS::Realm&, Web::Fetch::Infrastructure::FetchParams const&, Web::Fetch::Infrastructure::Response&)::$_6>::call() + 64
10  liblagom-web.0.0.0.dylib            0x000000010712178c AK::Function<void ()>::CallableWrapper<Web::Fetch::Infrastructure::queue_fetch_task(GC::Ref<Web::Fetch::Infrastructure::FetchController>, AK::Variant<AK::Empty, GC::Ref<JS::Object>, AK::NonnullRefPtr<Web::HTML::ParallelQueue>>, GC::Ref<GC::Function<void ()>>)::$_0>::call() + 108
11  liblagom-web.0.0.0.dylib            0x000000010717e030 Web::HTML::Task::execute() + 92
12  liblagom-web.0.0.0.dylib            0x000000010717b714 Web::HTML::EventLoop::process() + 84
13  liblagom-web.0.0.0.dylib            0x00000001073ec384 AK::Function<void ()>::CallableWrapper<Web::Platform::TimerSerenity::TimerSerenity()::$_0>::call() + 100
14  liblagom-core.0.0.0.dylib           0x000000010354a3cc Core::Timer::timer_event(Core::TimerEvent&) + 208
15  liblagom-core.0.0.0.dylib           0x000000010354938c Core::ThreadEventQueue::process() + 424
16  liblagom-core.0.0.0.dylib           0x000000010354de2c Core::EventLoopImplementationUnix::exec() + 44
17  liblagom-core.0.0.0.dylib           0x000000010353b778 Core::EventLoop::exec() + 68
18  WebContent                          0x0000000103004f5c ladybird_main(Main::Arguments) + 4284
19  WebContent                          0x00000001030a88e8 main + 184
20  dyld                                0x00000001866e5d54 start + 7184
531037.487 Ladybird(47941): WebContent process crashed! Last page loaded: file:///Users/pavel/Develop/ladybird/repro-link-minimal-crash.html
531037.487 Ladybird(47941): Consider raising an issue at https://github.com/LadybirdBrowser/ladybird/issues/new/choose
531037.489 WebContent(47960): FIXME: Handle null navigation_request in navigation response Content Security Policy check.

Screenshots or screen recordings

No response

Build flags or config settings

No response

Contribute a patch?

  • I’ll contribute a patch for this myself.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions