From 5c5f34989af3f3764f6c8f56412659b1b22f383a Mon Sep 17 00:00:00 2001 From: Glenn Skrzypczak Date: Wed, 26 Mar 2025 19:14:14 +0100 Subject: [PATCH] LibWeb/Layout: Properly remove layout nodes This properly remove the old layout node subtree when no new layout node is created during layout update. --- Libraries/LibWeb/Layout/TreeBuilder.cpp | 4 ++++ .../aria-owns-fallback-content.html | 19 +++++++++++++++++++ 2 files changed, 23 insertions(+) create mode 100644 Tests/LibWeb/Crash/wpt-import/accessibility/crashtests/aria-owns-fallback-content.html diff --git a/Libraries/LibWeb/Layout/TreeBuilder.cpp b/Libraries/LibWeb/Layout/TreeBuilder.cpp index 5a78538f36c..9a1d220fd4d 100644 --- a/Libraries/LibWeb/Layout/TreeBuilder.cpp +++ b/Libraries/LibWeb/Layout/TreeBuilder.cpp @@ -448,6 +448,10 @@ void TreeBuilder::update_layout_tree(DOM::Node& dom_node, TreeBuilder::Context& dom_node.for_each_in_inclusive_subtree([&](auto& node) { node.set_needs_layout_tree_update(false); node.set_child_needs_layout_tree_update(false); + auto layout_node = node.layout_node(); + if (layout_node && layout_node->parent()) { + layout_node->remove(); + } node.detach_layout_node({}); node.clear_paintable(); if (is(node)) diff --git a/Tests/LibWeb/Crash/wpt-import/accessibility/crashtests/aria-owns-fallback-content.html b/Tests/LibWeb/Crash/wpt-import/accessibility/crashtests/aria-owns-fallback-content.html new file mode 100644 index 00000000000..8a7c9ab6d0b --- /dev/null +++ b/Tests/LibWeb/Crash/wpt-import/accessibility/crashtests/aria-owns-fallback-content.html @@ -0,0 +1,19 @@ + + +
+ + +