OSSForks/ladybird
1
0
Fork 0
mirror of https://github.com/zebrajr/ladybird.git synced 2025-12-06 00:19:53 +01:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

LibWeb: Prevent creation of new UsedValues for nested inline nodes

Browse Source 
In LayoutState, used_values_per_layout_node should not be modified in
order to determine inline nodes' dimensions - all the required values
should already be in there. In 2585f2da0d
we did accidentally create new values, causing the code further down to
try and get a PaintableBox from an anonymous container and crashing.

Fixes #6015.
This commit is contained in:
Jelle Raaijmakers 2025-08-28 21:35:21 +02:00 committed by Andreas Kling
parent b23fd1f440
commit d87b3030a7
2 changed files with 8 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
Libraries/LibWeb/Layout/LayoutState.cpp
View File

@ -398,19 +398,16 @@ void LayoutState::commit(Box& root)
if (paintable.line_index() != line_index)
return TraversalDecision::Continue;
if (&paintable != paintable_with_lines) {
auto const& used_values = get(paintable.layout_node_with_style_and_box_metrics());
size.set_width(size.width() + used_values.margin_box_left() + used_values.margin_box_right());
}
auto used_values = used_values_per_layout_node.get(paintable.layout_node_with_style_and_box_metrics());
if (&paintable != paintable_with_lines && used_values.has_value())
size.set_width(size.width() + used_values.value()->margin_box_left() + used_values.value()->margin_box_right());
auto const& fragments = paintable.fragments();
if (!fragments.is_empty()) {
if (!offset.has_value() || (fragments.first().offset().x() < offset.value().x()))
if (!offset.has_value() || (fragments.first().offset().x() < offset->x()))
offset = fragments.first().offset();
if (&paintable == paintable_with_lines->first_child()) {
auto const& used_values = get(paintable.layout_node_with_style_and_box_metrics());
offset->translate_by(-used_values.margin_box_left(), 0);
}
if (&paintable == paintable_with_lines->first_child() && used_values.has_value())
offset->translate_by(-used_values.value()->margin_box_left(), 0);
}
for (auto const& fragment : fragments)
size.set_width(size.width() + fragment.width());

2
Tests/LibWeb/Crash/Layout/button-display-inline-with-nested-inlines.html Normal file
View File

@ -0,0 +1,2 @@
<!DOCTYPE html>
<button style="display: inline"><span><span>