0ct0pu5/ladybird
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

LibWeb: Don't crash from clipping grid spans

Browse source
This commit is contained in:
Gingeh 2024-11-10 13:11:41 +11:00 • committed by Alexander Kalenik
parent b4e5afa8d5
commit 6862d33e7c
Notes: github-actions[bot] 2024-11-10 23:58:03 +00:00
5 changed files with 46 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
Libraries/LibWeb/Layout/GridFormattingContext.cpp
View file

@ -1849,9 +1849,6 @@ CSSPixelRect GridFormattingContext::get_grid_area_rect(GridItem const& grid_item
auto resolved_span = grid_item.span(dimension) * 2;
auto gap_adjusted_position = grid_item.gap_adjusted_position(dimension);
if (gap_adjusted_position + resolved_span > tracks_and_gaps.size()) {
resolved_span = tracks_and_gaps.size() - gap_adjusted_position;
}
int start = gap_adjusted_position;
int end = start + resolved_span;

18
Tests/LibWeb/Layout/expected/grid/grid-row-overflow-crash.txt Normal file
View file

@ -0,0 +1,18 @@
Viewport <#document> at (0,0) content-size 800x600 children: not-inline
BlockContainer <html> at (0,0) content-size 800x600 [BFC] children: not-inline
BlockContainer <body> at (8,8) content-size 784x0 children: not-inline
Box <div> at (8,8) content-size 784x0 positioned [GFC] children: not-inline
BlockContainer <(anonymous)> (not painted) [BFC] children: inline
TextNode <#text>
BlockContainer <div> at (8,8) content-size 0x0 positioned [BFC] children: not-inline
BlockContainer <(anonymous)> (not painted) [BFC] children: inline
TextNode <#text>
BlockContainer <(anonymous)> at (8,8) content-size 784x0 children: inline
TextNode <#text>
ViewportPaintable (Viewport<#document>) [0,0 800x600]
PaintableWithLines (BlockContainer<HTML>) [0,0 800x600]
PaintableWithLines (BlockContainer<BODY>) [8,8 784x0]
PaintableBox (Box<DIV>) [8,8 784x0]
PaintableWithLines (BlockContainer<DIV>) [8,8 0x0]
PaintableWithLines (BlockContainer(anonymous)) [8,8 784x0]

22
Tests/LibWeb/Layout/expected/grid/row-gaps-with-overflowing-spans-crash.txt Normal file
View file

@ -0,0 +1,22 @@
Viewport <#document> at (0,0) content-size 800x600 children: not-inline
BlockContainer <html> at (0,0) content-size 800x600 [BFC] children: not-inline
BlockContainer <body> at (8,8) content-size 784x48 children: not-inline
Box <div> at (8,8) content-size 784x48 [GFC] children: not-inline
BlockContainer <(anonymous)> (not painted) [BFC] children: inline
TextNode <#text>
BlockContainer <div> at (8,24) content-size 784x32 [BFC] children: inline
frag 0 from TextNode start: 0, length: 1, rect: [8,24 6.34375x17] baseline: 13.296875
"1"
TextNode <#text>
BlockContainer <(anonymous)> (not painted) [BFC] children: inline
TextNode <#text>
BlockContainer <(anonymous)> at (8,56) content-size 784x0 children: inline
TextNode <#text>
ViewportPaintable (Viewport<#document>) [0,0 800x600]
PaintableWithLines (BlockContainer<HTML>) [0,0 800x600]
PaintableWithLines (BlockContainer<BODY>) [8,8 784x48]
PaintableBox (Box<DIV>) [8,8 784x48]
PaintableWithLines (BlockContainer<DIV>) [8,24 784x32]
TextPaintable (TextNode<#text>)
PaintableWithLines (BlockContainer(anonymous)) [8,56 784x0]

3
Tests/LibWeb/Layout/input/grid/grid-row-overflow-crash.html Normal file
View file

@ -0,0 +1,3 @@
<div style="display: grid; position: relative">
<div style="position: absolute; grid-row: 3"></div>
</div>

3
Tests/LibWeb/Layout/input/grid/row-gaps-with-overflowing-spans-crash.html Normal file
View file

@ -0,0 +1,3 @@
<div style="display: grid; grid-row-gap: 16px; grid-template-rows: 1fr 1fr">
<div style="grid-row: 2 / span 3">1</div>
</div>