mirrors/ladybird
0
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2025-08-02 06:09:08 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 9

LibWeb: Do not crash when inserting block elements into inline SVGBoxes

Browse source 
Fixes #3395.
This commit is contained in:
Jelle Raaijmakers 2025-02-19 11:04:15 +01:00 • committed by Andreas Kling
commit 5f5d18d719
Notes: github-actions[bot] 2025-02-19 12:50:19 +00:00
3 changed files with 10 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

4
Libraries/LibWeb/Layout/Node.cpp
View file

@ -1232,6 +1232,10 @@ bool NodeWithStyleAndBoxModelMetrics::should_create_inline_continuation() const
if (is<SVG::SVGForeignObjectElement>(parent()->dom_node())) if (is<SVG::SVGForeignObjectElement>(parent()->dom_node()))
return false; return false;
// SVGBoxes are appended directly to their layout parent without changing the parent's (non-)inline behavior.
if (is_svg_box())
return false;
return true; return true;
} }

4
Libraries/LibWeb/Layout/TreeBuilder.cpp
View file

@ -549,14 +549,12 @@ void TreeBuilder::update_layout_tree(DOM::Node& dom_node, TreeBuilder::Context&
&& old_layout_node != layout_node; && old_layout_node != layout_node;
if (may_replace_existing_layout_node) { if (may_replace_existing_layout_node) {
old_layout_node->parent()->replace_child(*layout_node, *old_layout_node); old_layout_node->parent()->replace_child(*layout_node, *old_layout_node);
} else { } else if (layout_node->is_svg_box()) {
if (layout_node->is_svg_box()) {
m_ancestor_stack.last()->append_child(*layout_node); m_ancestor_stack.last()->append_child(*layout_node);
} else { } else {
insert_node_into_inline_or_block_ancestor(*layout_node, display, AppendOrPrepend::Append); insert_node_into_inline_or_block_ancestor(*layout_node, display, AppendOrPrepend::Append);
} }
} }
}
auto shadow_root = is<DOM::Element>(dom_node) ? as<DOM::Element>(dom_node).shadow_root() : nullptr; auto shadow_root = is<DOM::Element>(dom_node) ? as<DOM::Element>(dom_node).shadow_root() : nullptr;

3
Tests/LibWeb/Crash/Layout/svg-box-no-inline-continuation.html Normal file
View file

@ -0,0 +1,3 @@
<!DOCTYPE html>
<!-- SVGBoxes should never be considered for inline continuation; caused a crash previously. -->
<svg>inline text before <g style="display: block"></g></svg>