LibWeb: Crash when refreshing directly after hash change

[utf-4096]

Summary

Refreshing the web page using window.location.reload() right after changing the URL's hash causes a crash in LibWeb/HTML/TraversableNavigable.cpp.

Operating system

Linux

Steps to reproduce

1. Open the reduced test page
2. Click the button
3. See crash

Expected behavior

Page location hash changes to # then refreshes.

Actual behavior

WebContent process crashes.

URL for a reduced test case

N/A

HTML/SVG/etc. source for a reduced test case

<button onclick="window.location.href = '#'; window.location.reload()">click me!</button>

Log output and (if possible) backtrace

VERIFICATION FAILED: target_entry->step().get<int>() > displayed_entry->step().get<int>() at /opt/ladybird/Libraries/LibWeb/HTML/TraversableNavigable.cpp:556
/opt/ladybird/Build/release/lib64/liblagom-ak.so.0(ak_verification_failed+0x83) [0x7f697ee8cf63]
/opt/ladybird/Build/release/lib64/liblagom-web.so.0(+0xd9cf1a) [0x7f698059cf1a]
/opt/ladybird/Build/release/lib64/liblagom-web.so.0 Web::HTML::Task::execute() 0x49) [0x7f6980421d59]
/opt/ladybird/Build/release/lib64/liblagom-web.so.0(+0xc1f1ba) [0x7f698041f1ba]
/opt/ladybird/Build/release/lib64/liblagom-web.so.0(+0xee5fd2) [0x7f69806e5fd2]
/opt/ladybird/Build/release/lib64/liblagom-core.so.0 Core::EventLoop::spin_until(AK::Function<bool ()>) 0x97) [0x7f697efd73f7]
/opt/ladybird/Build/release/lib64/liblagom-web.so.0 Web::Platform::EventLoopPluginSerenity::spin_until(GC::Root<GC::Function<bool ()> >) 0x73) [0x7f69806e5ae3]
/opt/ladybird/Build/release/lib64/liblagom-web.so.0 Web::HTML::EventLoop::spin_processing_tasks_with_source_until(Web::HTML::Task::Source, GC::Ref<GC::Function<bool ()> >) 0x180) [0x7f69804214c0]
/opt/ladybird/Build/release/lib64/liblagom-web.so.0 Web::HTML::TraversableNavigable::apply_the_history_step(int, bool, AK::Optional<Web::HTML::SourceSnapshotParams>, GC::Ptr<Web::HTML::Navigable>, AK::Optional<Web::HTML::UserNavigationInvolvement>, AK::Optional<Web::Bindings::NavigationType>, Web::HTML::TraversableNavigable::SynchronousNavigation) 0xdfd) [0x7f69805a242d]
/opt/ladybird/Build/release/lib64/liblagom-web.so.0 Web::HTML::TraversableNavigable::apply_the_push_or_replace_history_step(int, Web::HTML::HistoryHandlingBehavior, Web::HTML::TraversableNavigable::SynchronousNavigation) 0x71) [0x7f69805a3241]
/opt/ladybird/Build/release/lib64/liblagom-web.so.0(+0xd6f9a2) [0x7f698056f9a2]
/opt/ladybird/Build/release/lib64/liblagom-core.so.0 Core::Timer::timer_event(Core::TimerEvent&) 0xb2) [0x7f697efed3e2]
/opt/ladybird/Build/release/lib64/liblagom-core.so.0 Core::EventReceiver::dispatch_event(Core::Event&, Core::EventReceiver*) 0x4d) [0x7f697efd81fd]
/opt/ladybird/Build/release/lib64/liblagom-webview.so.0(+0x174449) [0x7f69815c9449]
/usr/lib/libQt6Core.so.6(+0x1b61ce) [0x7f69817b61ce]
/usr/lib/libQt6Core.so.6 QTimer::timeout(QTimer::QPrivateSignal) 0x3a) [0x7f69817c300a]
/usr/lib/libQt6Core.so.6 QObject::event(QEvent*) 0x1df) [0x7f69817add3f]
/usr/lib/libQt6Core.so.6 QCoreApplication::notifyInternal2(QObject*, QEvent*) 0x12f) [0x7f69817626af]
/usr/lib/libQt6Core.so.6 QTimerInfoList::activateTimers() 0x43b) [0x7f69818cfa3b]
/usr/lib/libQt6Core.so.6(+0x3c11ac) [0x7f69819c11ac]
/usr/lib/libglib-2.0.so.0(+0x57fe4) [0x7f697e310fe4]
/usr/lib/libglib-2.0.so.0(+0x5b0e7) [0x7f697e3140e7]
/usr/lib/libglib-2.0.so.0(g_main_context_iteration+0x2c) [0x7f697e3147cc]
/usr/lib/libQt6Core.so.6 QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) 0x6c) [0x7f69819c133c]
/usr/lib/libQt6Core.so.6 QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) 0x133) [0x7f698176e173]
/opt/ladybird/Build/release/lib64/liblagom-core.so.0 Core::EventLoop::exec() 0x46) [0x7f697efd7586]
/opt/ladybird/Build/release/libexec/WebContent(+0x842ec) [0x555e5b8112ec]
/opt/ladybird/Build/release/libexec/WebContent(+0x169c82) [0x555e5b8f6c82]
/usr/lib/libc.so.6(+0x29c4c) [0x7f697e83fc4c]
/usr/lib/libc.so.6(__libc_start_main+0x85) [0x7f697e83fd05]
/opt/ladybird/Build/release/libexec/WebContent(+0x81c81) [0x555e5b80ec81]

Screenshots or screen recordings

No response

Build flags or config settings

No response

Contribute a patch?

• I’ll contribute a patch for this myself.

[utf-4096]

WPT tests that give the same stack trace:

• https://wpt.live/navigation-api/navigation-methods/reload-info.html
• https://wpt.live/navigation-api/navigation-methods/reload-no-args.html
• https://wpt.live/navigation-api/navigation-methods/reload-state-and-info.html
• https://wpt.live/navigation-api/navigation-methods/reload-state-undefined.html