For example, on https://xboygeniusx.bandcamp.com/album/the-record: ``` #0 ak_verification_failed () at AK/Assertions.cpp:96 #1 0x00007ffff69b7d67 in AK::Vector, 0ul>::at () at AK/Vector.h:148 #2 AK::Vector, 0ul>::operator[] () at AK/Vector.h:156 #3 AK::SimpleIterator, 0ul>, JS::NonnullGCPtr >::operator* () at AK/Iterator.h:56 #4 AK::find_if, 0ul>, JS::NonnullGCPtr >, AK::SimpleIterator, 0ul>, JS::NonnullGCPtr >, AK::find, 0ul>, JS::NonnullGCPtr >, AK::SimpleIterator, 0ul>, JS::NonnullGCPtr >, JS::NonnullGCPtr >(AK::SimpleIterator, 0ul>, JS::NonnullGCPtr >, AK::SimpleIterator, 0ul>, JS::NonnullGCPtr >, JS::NonnullGCPtr const&)::{lambda(auto:1 const&)#1}>(AK::SimpleIterator, 0ul>, JS::NonnullGCPtr >, AK::SimpleIterator, 0ul>, JS::NonnullGCPtr >, AK::find, 0ul>, JS::NonnullGCPtr >, AK::SimpleIterator, 0ul>, JS::NonnullGCPtr >, JS::NonnullGCPtr >(AK::SimpleIterator, 0ul>, JS::NonnullGCPtr >, AK::SimpleIterator, 0ul>, JS::NonnullGCPtr >, JS::NonnullGCPtr const&)::{lambda(auto:1 const&)#1}&&) () at AK/Find.h:19 #5 AK::find, 0ul>, JS::NonnullGCPtr >, AK::SimpleIterator, 0ul>, JS::NonnullGCPtr >, JS::NonnullGCPtr > () at AK/Find.h:29 #6 AK::Vector, 0ul>::find () at AK/Vector.h:787 #7 Web::HTML::finalize_a_same_document_navigation () at Userland/Libraries/LibWeb/HTML/TraversableNavigable.cpp:637 #8 0x00007ffff68d7d39 in JS::SafeFunction::operator()() const () at Userland/Libraries/LibJS/SafeFunction.h:85 #9 Web::HTML::SessionHistoryTraversalQueue::SessionHistoryTraversalQueue()::{lambda()#1}::operator()() const () at Userland/Libraries/LibWeb/HTML/SessionHistoryTraversalQueue.h:21 ``` In `finalize_a_same_document_navigation`, when we replace the entry: ```c++ // 1. Replace entryToReplace with targetEntry in targetEntries. *(target_entries.find(*entry_to_replace)) = target_entry; ``` `target_entries` has one entry with a URL `https://xboygeniusx.bandcamp.com/album/the-record`. And `entry_to_replace` has the same URL, but a different address. So the lookup fails, and we try to dereference a past-the-end iterator. ## Funding - We're currently trying [Polar.sh](https://polar.sh/SerenityOS) where you can help fund the work on this issue. - Contributor(s) receive the funding once the issue is completed & confirmed.

SerenityOS

Donate