fergalmoran/ladybird
1
0
Fork 0
mirror of https://github.com/fergalmoran/ladybird.git synced 2026-01-04 15:45:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

LibWeb: Do not crash when inserting block elements into inline SVGBoxes

Browse Source 
Fixes #3395.
This commit is contained in:
Jelle Raaijmakers
2025-02-19 11:04:15 +01:00
committed by Andreas Kling
parent 0c58dad7a6
commit 5f5d18d719
3 changed files with 10 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
Libraries/LibWeb/Layout/Node.cpp
View File

@@ -1232,6 +1232,10 @@ bool NodeWithStyleAndBoxModelMetrics::should_create_inline_continuation() const
if (is<SVG::SVGForeignObjectElement>(parent()->dom_node())) if (is<SVG::SVGForeignObjectElement>(parent()->dom_node()))
return false; return false;
// SVGBoxes are appended directly to their layout parent without changing the parent's (non-)inline behavior.
if (is_svg_box())
return false;
return true; return true;
} }

8
Libraries/LibWeb/Layout/TreeBuilder.cpp
View File

@@ -549,12 +549,10 @@ void TreeBuilder::update_layout_tree(DOM::Node& dom_node, TreeBuilder::Context&
&& old_layout_node != layout_node; && old_layout_node != layout_node;
if (may_replace_existing_layout_node) { if (may_replace_existing_layout_node) {
old_layout_node->parent()->replace_child(*layout_node, *old_layout_node); old_layout_node->parent()->replace_child(*layout_node, *old_layout_node);
} else if (layout_node->is_svg_box()) {
m_ancestor_stack.last()->append_child(*layout_node);
} else { } else {
if (layout_node->is_svg_box()) { insert_node_into_inline_or_block_ancestor(*layout_node, display, AppendOrPrepend::Append);
m_ancestor_stack.last()->append_child(*layout_node);
} else {
insert_node_into_inline_or_block_ancestor(*layout_node, display, AppendOrPrepend::Append);
}
} }
} }

3
Tests/LibWeb/Crash/Layout/svg-box-no-inline-continuation.html Normal file
View File

@@ -0,0 +1,3 @@
<!DOCTYPE html>
<!-- SVGBoxes should never be considered for inline continuation; caused a crash previously. -->
<svg>inline text before <g style="display: block"></g></svg>