mirrors/ladybird
1
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2025-04-20 19:45:12 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 9

LibWeb: Do not crash when inserting block elements into inline SVGBoxes

Browse source 
Fixes #3395.
This commit is contained in:
Jelle Raaijmakers 2025-02-19 11:04:15 +01:00 • committed by Andreas Kling
parent 0c58dad7a6
commit 5f5d18d719
Notes: github-actions[bot] 2025-02-19 12:50:19 +00:00
3 changed files with 10 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
Libraries/LibWeb/Layout/Node.cpp
View file

@ -1232,6 +1232,10 @@ bool NodeWithStyleAndBoxModelMetrics::should_create_inline_continuation() const
if (is<SVG::SVGForeignObjectElement>(parent()->dom_node()))
return false;
// SVGBoxes are appended directly to their layout parent without changing the parent's (non-)inline behavior.
if (is_svg_box())
return false;
return true;
}

8
Libraries/LibWeb/Layout/TreeBuilder.cpp
View file

@ -549,12 +549,10 @@ void TreeBuilder::update_layout_tree(DOM::Node& dom_node, TreeBuilder::Context&
&& old_layout_node != layout_node;
if (may_replace_existing_layout_node) {
old_layout_node->parent()->replace_child(*layout_node, *old_layout_node);
} else if (layout_node->is_svg_box()) {
m_ancestor_stack.last()->append_child(*layout_node);
} else {
if (layout_node->is_svg_box()) {
m_ancestor_stack.last()->append_child(*layout_node);
} else {
insert_node_into_inline_or_block_ancestor(*layout_node, display, AppendOrPrepend::Append);
}
insert_node_into_inline_or_block_ancestor(*layout_node, display, AppendOrPrepend::Append);
}
}

3
Tests/LibWeb/Crash/Layout/svg-box-no-inline-continuation.html Normal file
View file

@ -0,0 +1,3 @@
<!DOCTYPE html>
<!-- SVGBoxes should never be considered for inline continuation; caused a crash previously. -->
<svg>inline text before <g style="display: block"></g></svg>