LibWeb: Avoid null dereference in ListItemBox specified content check

This commit is contained in:
Tim Ledbetter 2025-10-13 08:34:35 +01:00 committed by Sam Atkins
commit 0bdb831c68
Notes: github-actions[bot] 2025-10-14 10:21:20 +00:00
3 changed files with 85 additions and 3 deletions

View file

@ -809,14 +809,18 @@ void BlockFormattingContext::layout_block_level_box(Box const& box, BlockContain
// This monster basically means: "a ListItemBox that does not have specified content in the ::marker pseudo-element".
// This happens for ::marker with content 'normal'.
// FIXME: We currently so not support ListItemBox-es generated by pseudo-elements. We will need to, eventually.
ListItemBox const* li_box = as_if<ListItemBox>(box);
bool is_list_item_box_without_css_content = li_box && (!(box.dom_node() && box.dom_node()->is_element() && as_if<DOM::Element const>(box.dom_node())->computed_properties(CSS::PseudoElement::Marker)->property(CSS::PropertyID::Content).is_content()));
auto const* li_box = as_if<ListItemBox>(box);
auto is_list_item_box_without_css_content = li_box != nullptr;
if (auto const* dom_node = as_if<DOM::Element>(box.dom_node()); li_box && dom_node) {
if (auto const computed_properties = dom_node->computed_properties(CSS::PseudoElement::Marker))
is_list_item_box_without_css_content = !computed_properties->property(CSS::PropertyID::Content).is_content();
}
// Before we insert the children of a list item we need to know the location of the marker.
// If we do not do this then left-floating elements inside the list item will push the marker to the right,
// in some cases even causing it to overlap with the non-floating content of the list.
CSSPixels left_space_before_children_formatted;
if (is_list_item_box_without_css_content) {
if (is_list_item_box_without_css_content && li_box->marker()) {
// We need to ensure that our height and width are final before we calculate our left offset.
// Otherwise, the y at which we calculate the intrusion by floats might be incorrect.
ensure_sizes_correct_for_left_offset_calculation(*li_box);