From 01bfb5bc81b41c506294e9cff7e0eee8f16e952d Mon Sep 17 00:00:00 2001 From: Aliaksandr Kalenik Date: Sun, 7 Sep 2025 14:46:44 +0200 Subject: [PATCH] LibWeb: Capture y by value in position update callback [BFC] Callback registered by `register_block_container_y_position_update_callback()` is executed after `layout_block_level_box()` returned, so capturing stack variable `y` by reference is UB. --- Libraries/LibWeb/Layout/BlockFormattingContext.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Libraries/LibWeb/Layout/BlockFormattingContext.cpp b/Libraries/LibWeb/Layout/BlockFormattingContext.cpp index a8b3271f75a..1cb8301c9bd 100644 --- a/Libraries/LibWeb/Layout/BlockFormattingContext.cpp +++ b/Libraries/LibWeb/Layout/BlockFormattingContext.cpp @@ -836,7 +836,7 @@ void BlockFormattingContext::layout_block_level_box(Box const& box, BlockContain m_margin_state.reset(); } else if (!m_margin_state.has_block_container_waiting_for_final_y_position()) { // margin-top of block container can be updated during children layout hence it's final y position yet to be determined - m_margin_state.register_block_container_y_position_update_callback([&, introduce_clearance](CSSPixels margin_top) { + m_margin_state.register_block_container_y_position_update_callback([this, &box, y, introduce_clearance](CSSPixels margin_top) { if (introduce_clearance == DidIntroduceClearance::No) { place_block_level_element_in_normal_flow_vertically(box, margin_top + y); }