mirrors/ladybird
0
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2025-09-23 09:48:56 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 9

LibWeb: Fix crashing in LengthOrAutoOrCalculated::without_auto()
Some checks are pending
CI / macOS, arm64, Sanitizer, Clang (push) Waiting to run
Details
CI / Linux, x86_64, Fuzzers, Clang (push) Waiting to run
Details
CI / Linux, x86_64, Sanitizer, GNU (push) Waiting to run
Details
CI / Linux, x86_64, Sanitizer, Clang (push) Waiting to run
Details
Package the js repl as a binary artifact / Linux, arm64 (push) Waiting to run
Details
Package the js repl as a binary artifact / macOS, arm64 (push) Waiting to run
Details
Package the js repl as a binary artifact / Linux, x86_64 (push) Waiting to run
Details
Run test262 and test-wasm / run_and_update_results (push) Waiting to run
Details
Lint Code / lint (push) Waiting to run
Details
Label PRs with merge conflicts / auto-labeler (push) Waiting to run
Details
Push notes / build (push) Waiting to run
Details

Browse source 
...when `LengthOrAutoOrCalculated` holds calculated value. We were
incorrectly assuming that if contained value is not auto, then it must
be a length.

Fixes crashing on https://hollowknightsilksong.com/
This commit is contained in:
Aliaksandr Kalenik 2025-09-08 17:50:49 +02:00 • committed by Tim Ledbetter
commit 18cf540bfb
Notes: github-actions[bot] 2025-09-08 18:36:52 +00:00
3 changed files with 16 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
Libraries/LibWeb/CSS/CalculatedOr.cpp
View file

@ -89,6 +89,8 @@ bool LengthOrAutoOrCalculated::is_auto() const
LengthOrCalculated LengthOrAutoOrCalculated::without_auto() const
{
VERIFY(!is_auto());
if (is_calculated())
return calculated();
return value().length();
}

13
Tests/LibWeb/Layout/expected/crash-tests/img-with-calc-inside-sizes-attr.txt Normal file
View file

@ -0,0 +1,13 @@
Viewport <#document> at [0,0] [0+0+0 800 0+0+0] [0+0+0 600 0+0+0] children: not-inline
BlockContainer <html> at [0,0] [0+0+0 800 0+0+0] [0+0+0 34 0+0+0] [BFC] children: not-inline
BlockContainer <body> at [8,8] [8+0+0 784 0+0+8] [8+0+0 18 0+0+8] children: inline
frag 0 from ImageBox start: 0, length: 0, rect: [8,21 0x0] baseline: 0
ImageBox <img> at [8,21] [0+0+0 0 0+0+0] [0+0+0 0 0+0+0] children: not-inline
ViewportPaintable (Viewport<#document>) [0,0 800x600]
PaintableWithLines (BlockContainer<HTML>) [0,0 800x34]
PaintableWithLines (BlockContainer<BODY>) [8,8 784x18]
ImagePaintable (ImageBox<IMG>) [8,21 0x0]
SC for Viewport<#document> [0,0 800x600] [children: 1] (z-index: auto)
SC for BlockContainer<HTML> [0,0 800x34] [children: 0] (z-index: auto)

1
Tests/LibWeb/Layout/input/crash-tests/img-with-calc-inside-sizes-attr.html Normal file
View file

@ -0,0 +1 @@
<!doctype html><img sizes="calc(90vw - 32px), 33vw">