1 年之前 · 5e54ff1858
--- a/Tests/LibWeb/Layout/expected/css-values/rect-non-token-contents-crash.txt
+++ b/Tests/LibWeb/Layout/expected/css-values/rect-non-token-contents-crash.txt
@@ -0,0 +1,12 @@
 
															+Viewport <#document> at (0,0) content-size 800x600 children: not-inline
														
 
															+  BlockContainer <html> at (0,0) content-size 800x600 [BFC] children: not-inline
														
 
															+    BlockContainer <body> at (8,8) content-size 784x0 children: not-inline
														
 
															+      BlockContainer <div> at (8,8) content-size 784x0 children: not-inline
														
 
															+      BlockContainer <(anonymous)> at (8,16) content-size 784x0 children: inline
														
 
															+        TextNode <#text>
														
 
															+
														
 
															+ViewportPaintable (Viewport<#document>) [0,0 800x600]
														
 
															+  PaintableWithLines (BlockContainer<HTML>) [0,0 800x600]
														
 
															+    PaintableWithLines (BlockContainer<BODY>) [8,8 784x0] overflow: [8,16 784x0]
														
 
															+      PaintableWithLines (BlockContainer<DIV>) [8,8 784x0]
														
 
															+      PaintableWithLines (BlockContainer(anonymous)) [8,16 784x0]
														
--- a/Tests/LibWeb/Layout/input/css-values/rect-non-token-contents-crash.html
+++ b/Tests/LibWeb/Layout/input/css-values/rect-non-token-contents-crash.html
@@ -0,0 +1 @@
 
															+<div style="clip: rect({})"></div>
														
--- a/Userland/Libraries/LibWeb/CSS/Parser/Parser.cpp
+++ b/Userland/Libraries/LibWeb/CSS/Parser/Parser.cpp
@@ -2122,8 +2122,8 @@ RefPtr<StyleValue> Parser::parse_rect_value(ComponentValue const& component_valu
 
															         // <top>, <right>, <bottom>, and <left> may either have a <length> value or 'auto'.
														
 
															         // Negative lengths are permitted.
														
 
															-        auto current_token = tokens.next_token().token();
														
 
															-        if (current_token.is(Token::Type::Ident) && current_token.ident().equals_ignoring_ascii_case("auto"sv)) {
														
 
															+        auto& current_token = tokens.next_token();
														
 
															+        if (current_token.is_ident("auto"sv)) {
														
 
															             params.append(Length::make_auto());
														
 
															         } else {
														
 
															             auto maybe_length = parse_length(current_token);