From d8ea16d94eeeb1c591b8024bfc5ac925e6540c23 Mon Sep 17 00:00:00 2001
From: Andreas Kling <andreas@ladybird.org>
Date: Fri, 25 Apr 2025 15:00:02 +0200
Subject: [PATCH] LibWeb: Don't assume calc() simplification worked on invalid
 tree

Fixes #4469
---
 .../CSS/StyleValues/CalculatedStyleValue.cpp  |  5 +-
 .../css/css-values/minmax-length-invalid.txt  | 54 +++++++++++++++
 .../css/css-values/minmax-length-invalid.html | 66 +++++++++++++++++++
 3 files changed, 123 insertions(+), 2 deletions(-)
 create mode 100644 Tests/LibWeb/Text/expected/wpt-import/css/css-values/minmax-length-invalid.txt
 create mode 100644 Tests/LibWeb/Text/input/wpt-import/css/css-values/minmax-length-invalid.html

diff --git a/Libraries/LibWeb/CSS/StyleValues/CalculatedStyleValue.cpp b/Libraries/LibWeb/CSS/StyleValues/CalculatedStyleValue.cpp
index e71e69636f3..f7f87535265 100644
--- a/Libraries/LibWeb/CSS/StyleValues/CalculatedStyleValue.cpp
+++ b/Libraries/LibWeb/CSS/StyleValues/CalculatedStyleValue.cpp
@@ -2926,8 +2926,9 @@ NonnullRefPtr<CalculationNode const> simplify_a_calculation_tree(CalculationNode
     //    running root’s operation using its children, expressed in the result’s canonical unit.
     if (root->is_math_function_node()) {
         if (auto maybe_simplified = root->run_operation_if_possible(context, resolution_context); maybe_simplified.has_value()) {
-            // NOTE: If this returns nullptr, that's a logic error in the code, so it's fine to assert that it's nonnull.
-            return make_calculation_node(maybe_simplified.release_value(), context).release_nonnull();
+            if (auto node = make_calculation_node(maybe_simplified.release_value(), context))
+                return node.release_nonnull();
+            return root;
         }
     }
 
diff --git a/Tests/LibWeb/Text/expected/wpt-import/css/css-values/minmax-length-invalid.txt b/Tests/LibWeb/Text/expected/wpt-import/css/css-values/minmax-length-invalid.txt
new file mode 100644
index 00000000000..5ecbf93ca27
--- /dev/null
+++ b/Tests/LibWeb/Text/expected/wpt-import/css/css-values/minmax-length-invalid.txt
@@ -0,0 +1,54 @@
+Harness status: OK
+
+Found 48 tests
+
+46 Pass
+2 Fail
+Pass	e.style['border-left-width'] = "min()" should not set the property value
+Pass	e.style['border-left-width'] = "min( )" should not set the property value
+Pass	e.style['border-left-width'] = "min(,)" should not set the property value
+Pass	e.style['border-left-width'] = "min(1py)" should not set the property value
+Pass	e.style['border-left-width'] = "min(1px, )" should not set the property value
+Pass	e.style['border-left-width'] = "min(, 1px)" should not set the property value
+Pass	e.style['border-left-width'] = "min(1px + )" should not set the property value
+Pass	e.style['border-left-width'] = "min(1px - )" should not set the property value
+Pass	e.style['border-left-width'] = "min(1px * )" should not set the property value
+Pass	e.style['border-left-width'] = "min(1px / )" should not set the property value
+Fail	e.style['border-left-width'] = "min(1px 2px)" should not set the property value
+Pass	e.style['border-left-width'] = "min(1px, , 2px)" should not set the property value
+Pass	e.style['border-left-width'] = "max()" should not set the property value
+Pass	e.style['border-left-width'] = "max( )" should not set the property value
+Pass	e.style['border-left-width'] = "max(,)" should not set the property value
+Pass	e.style['border-left-width'] = "max(1py)" should not set the property value
+Pass	e.style['border-left-width'] = "max(1px, )" should not set the property value
+Pass	e.style['border-left-width'] = "max(, 1px)" should not set the property value
+Pass	e.style['border-left-width'] = "max(1px + )" should not set the property value
+Pass	e.style['border-left-width'] = "max(1px - )" should not set the property value
+Pass	e.style['border-left-width'] = "max(1px * )" should not set the property value
+Pass	e.style['border-left-width'] = "max(1px / )" should not set the property value
+Fail	e.style['border-left-width'] = "max(1px 2px)" should not set the property value
+Pass	e.style['border-left-width'] = "max(1px, , 2px)" should not set the property value
+Pass	e.style['border-left-width'] = "min(0)" should not set the property value
+Pass	e.style['border-left-width'] = "min(0%)" should not set the property value
+Pass	e.style['border-left-width'] = "min(0s)" should not set the property value
+Pass	e.style['border-left-width'] = "min(0Hz)" should not set the property value
+Pass	e.style['border-left-width'] = "min(0dpi)" should not set the property value
+Pass	e.style['border-left-width'] = "min(0fr)" should not set the property value
+Pass	e.style['border-left-width'] = "min(1px, 0)" should not set the property value
+Pass	e.style['border-left-width'] = "min(1px, 0%)" should not set the property value
+Pass	e.style['border-left-width'] = "min(1px, 0s)" should not set the property value
+Pass	e.style['border-left-width'] = "min(1px, 0Hz)" should not set the property value
+Pass	e.style['border-left-width'] = "min(1px, 0dpi)" should not set the property value
+Pass	e.style['border-left-width'] = "min(1px, 0fr)" should not set the property value
+Pass	e.style['border-left-width'] = "max(0)" should not set the property value
+Pass	e.style['border-left-width'] = "max(0%)" should not set the property value
+Pass	e.style['border-left-width'] = "max(0s)" should not set the property value
+Pass	e.style['border-left-width'] = "max(0Hz)" should not set the property value
+Pass	e.style['border-left-width'] = "max(0dpi)" should not set the property value
+Pass	e.style['border-left-width'] = "max(0fr)" should not set the property value
+Pass	e.style['border-left-width'] = "max(1px, 0)" should not set the property value
+Pass	e.style['border-left-width'] = "max(1px, 0%)" should not set the property value
+Pass	e.style['border-left-width'] = "max(1px, 0s)" should not set the property value
+Pass	e.style['border-left-width'] = "max(1px, 0Hz)" should not set the property value
+Pass	e.style['border-left-width'] = "max(1px, 0dpi)" should not set the property value
+Pass	e.style['border-left-width'] = "max(1px, 0fr)" should not set the property value
\ No newline at end of file
diff --git a/Tests/LibWeb/Text/input/wpt-import/css/css-values/minmax-length-invalid.html b/Tests/LibWeb/Text/input/wpt-import/css/css-values/minmax-length-invalid.html
new file mode 100644
index 00000000000..d71d43a2b39
--- /dev/null
+++ b/Tests/LibWeb/Text/input/wpt-import/css/css-values/minmax-length-invalid.html
@@ -0,0 +1,66 @@
+<!DOCTYPE html>
+<link rel="help" href="https://drafts.csswg.org/css-values-4/#comp-func">
+<link rel="help" href="https://drafts.csswg.org/css-values-4/#lengths">
+<link rel="help" href="https://drafts.csswg.org/css-values-4/#calc-type-checking">
+<link rel="author" title="Xiaocheng Hu" href="mailto:xiaochengh@chromium.org">
+<script src="../../resources/testharness.js"></script>
+<script src="../../resources/testharnessreport.js"></script>
+<script src="../support/parsing-testcommon.js"></script>
+<script>
+function test_invalid_length(value) {
+  // 'border-width' accepts <length> only, not <percentage> or any mixes.
+  test_invalid_value('border-left-width', value);
+}
+
+// Syntax checking
+test_invalid_length('min()');
+test_invalid_length('min( )');
+test_invalid_length('min(,)');
+test_invalid_length('min(1py)');
+test_invalid_length('min(1px, )');
+test_invalid_length('min(, 1px)');
+test_invalid_length('min(1px + )');
+test_invalid_length('min(1px - )');
+test_invalid_length('min(1px * )');
+test_invalid_length('min(1px / )');
+test_invalid_length('min(1px 2px)');
+test_invalid_length('min(1px, , 2px)');
+test_invalid_length('max()');
+test_invalid_length('max( )');
+test_invalid_length('max(,)');
+test_invalid_length('max(1py)');
+test_invalid_length('max(1px, )');
+test_invalid_length('max(, 1px)');
+test_invalid_length('max(1px + )');
+test_invalid_length('max(1px - )');
+test_invalid_length('max(1px * )');
+test_invalid_length('max(1px / )');
+test_invalid_length('max(1px 2px)');
+test_invalid_length('max(1px, , 2px)');
+
+// Type checking
+test_invalid_length('min(0)');
+test_invalid_length('min(0%)');
+test_invalid_length('min(0s)');
+test_invalid_length('min(0Hz)');
+test_invalid_length('min(0dpi)');
+test_invalid_length('min(0fr)');
+test_invalid_length('min(1px, 0)');
+test_invalid_length('min(1px, 0%)');
+test_invalid_length('min(1px, 0s)');
+test_invalid_length('min(1px, 0Hz)');
+test_invalid_length('min(1px, 0dpi)');
+test_invalid_length('min(1px, 0fr)');
+test_invalid_length('max(0)');
+test_invalid_length('max(0%)');
+test_invalid_length('max(0s)');
+test_invalid_length('max(0Hz)');
+test_invalid_length('max(0dpi)');
+test_invalid_length('max(0fr)');
+test_invalid_length('max(1px, 0)');
+test_invalid_length('max(1px, 0%)');
+test_invalid_length('max(1px, 0s)');
+test_invalid_length('max(1px, 0Hz)');
+test_invalid_length('max(1px, 0dpi)');
+test_invalid_length('max(1px, 0fr)');
+</script>