mirrors/ladybird
0
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2025-09-22 01:08:56 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

LibWeb: Prevent creation of new UsedValues for nested inline nodes
Some checks are pending
CI / macOS, arm64, Sanitizer, Clang (push) Waiting to run
Details
CI / Linux, x86_64, Fuzzers, Clang (push) Waiting to run
Details
CI / Linux, x86_64, Sanitizer, GNU (push) Waiting to run
Details
CI / Linux, x86_64, Sanitizer, Clang (push) Waiting to run
Details
Package the js repl as a binary artifact / Linux, arm64 (push) Waiting to run
Details
Package the js repl as a binary artifact / macOS, arm64 (push) Waiting to run
Details
Package the js repl as a binary artifact / Linux, x86_64 (push) Waiting to run
Details
Run test262 and test-wasm / run_and_update_results (push) Waiting to run
Details
Lint Code / lint (push) Waiting to run
Details
Label PRs with merge conflicts / auto-labeler (push) Waiting to run
Details
Push notes / build (push) Waiting to run
Details

Browse source 
In LayoutState, used_values_per_layout_node should not be modified in
order to determine inline nodes' dimensions - all the required values
should already be in there. In 2585f2da0d
we did accidentally create new values, causing the code further down to
try and get a PaintableBox from an anonymous container and crashing.

Fixes #6015.
This commit is contained in:
Jelle Raaijmakers 2025-08-28 21:35:21 +02:00 • committed by Andreas Kling
commit d87b3030a7
Notes: github-actions[bot] 2025-08-28 20:39:15 +00:00
2 changed files with 8 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

15
Libraries/LibWeb/Layout/LayoutState.cpp
View file

@ -398,19 +398,16 @@ void LayoutState::commit(Box& root)
if (paintable.line_index() != line_index) if (paintable.line_index() != line_index)
return TraversalDecision::Continue; return TraversalDecision::Continue;
if (&paintable != paintable_with_lines) { auto used_values = used_values_per_layout_node.get(paintable.layout_node_with_style_and_box_metrics());
auto const& used_values = get(paintable.layout_node_with_style_and_box_metrics()); if (&paintable != paintable_with_lines && used_values.has_value())
size.set_width(size.width() + used_values.margin_box_left() + used_values.margin_box_right()); size.set_width(size.width() + used_values.value()->margin_box_left() + used_values.value()->margin_box_right());
}
auto const& fragments = paintable.fragments(); auto const& fragments = paintable.fragments();
if (!fragments.is_empty()) { if (!fragments.is_empty()) {
if (!offset.has_value() || (fragments.first().offset().x() < offset.value().x())) if (!offset.has_value() || (fragments.first().offset().x() < offset->x()))
offset = fragments.first().offset(); offset = fragments.first().offset();
if (&paintable == paintable_with_lines->first_child()) { if (&paintable == paintable_with_lines->first_child() && used_values.has_value())
auto const& used_values = get(paintable.layout_node_with_style_and_box_metrics()); offset->translate_by(-used_values.value()->margin_box_left(), 0);
offset->translate_by(-used_values.margin_box_left(), 0);
}
} }
for (auto const& fragment : fragments) for (auto const& fragment : fragments)
size.set_width(size.width() + fragment.width()); size.set_width(size.width() + fragment.width());

2
Tests/LibWeb/Crash/Layout/button-display-inline-with-nested-inlines.html Normal file
View file

@ -0,0 +1,2 @@
<!DOCTYPE html>
<button style="display: inline"><span><span>