Просмотр исходного кода

LibWeb: Don't crash when SVG viewbox has a width of 0

Previously, `SVGSVGBox` would have a natural aspect ratio of 0 if it
had a viewbox with zero width. This led to a division by zero, causing
a crash.

Found by Domato.
Tim Ledbetter 1 год назад
Родитель
Сommit
4cdafea363

+ 10 - 0
Tests/LibWeb/Layout/expected/svg/svg-viewbox-zero-width.txt

@@ -0,0 +1,10 @@
+Viewport <#document> at (0,0) content-size 800x600 children: not-inline
+  BlockContainer <html> at (0,0) content-size 800x166 [BFC] children: not-inline
+    BlockContainer <body> at (8,8) content-size 784x150 children: inline
+      frag 0 from SVGSVGBox start: 0, length: 0, rect: [8,8 300x150] baseline: 150
+      SVGSVGBox <svg> at (8,8) content-size 300x150 [SVG] children: not-inline
+
+ViewportPaintable (Viewport<#document>) [0,0 800x600]
+  PaintableWithLines (BlockContainer<HTML>) [0,0 800x166]
+    PaintableWithLines (BlockContainer<BODY>) [8,8 784x150]
+      SVGSVGPaintable (SVGSVGBox<svg>) [8,8 300x150]

+ 1 - 0
Tests/LibWeb/Layout/input/svg/svg-viewbox-zero-width.html

@@ -0,0 +1 @@
+<!DOCTYPE html><html><body><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 0 10"></svg>

+ 3 - 2
Userland/Libraries/LibWeb/Layout/SVGSVGBox.cpp

@@ -75,9 +75,10 @@ Optional<CSSPixelFraction> SVGSVGBox::calculate_intrinsic_aspect_ratio() const
         auto const& viewbox = dom_node().view_box().value();
 
         // 2. return viewbox.width / viewbox.height
+        auto viewbox_width = CSSPixels::nearest_value_for(viewbox.width);
         auto viewbox_height = CSSPixels::nearest_value_for(viewbox.height);
-        if (viewbox_height != 0)
-            return CSSPixels::nearest_value_for(viewbox.width) / viewbox_height;
+        if (viewbox_width != 0 && viewbox_height != 0)
+            return viewbox_width / viewbox_height;
 
         return {};
     }