beenull/ladybird
1
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2024-11-21 23:20:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 6

LibWeb: Reserve enough space for span>1 columns in BorderConflictFinder

Browse source 
This code previously only allocated enough space in
m_col_elements_by_index for 1 slot per column, meaning that columns
with a span > 1 would write off the end of it.
This commit is contained in:
Sam Atkins 2024-07-27 14:17:57 +01:00 committed by Tim Ledbetter
parent 0cec68ea99
commit 9e32c9329a
Notes: github-actions[bot] 2024-07-27 19:24:08 +00:00 
Author: https://github.com/AtkinsSJ
Commit: https://github.com/LadybirdBrowser/ladybird/commit/9e32c9329ac
Pull-request: https://github.com/LadybirdBrowser/ladybird/pull/865
Reviewed-by: https://github.com/tcl3 ✅
3 changed files with 22 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
Tests/LibWeb/Layout/expected/table/col-span-crash.txt Normal file
View file

@ -0,0 +1,19 @@
Viewport <#document> at (0,0) content-size 800x600 children: not-inline
BlockContainer <html> at (0,0) content-size 800x600 [BFC] children: not-inline
BlockContainer <body> at (8,8) content-size 784x19 children: not-inline
TableWrapper <(anonymous)> at (8,8) content-size 4x2 [BFC] children: not-inline
Box <table> at (8,8) content-size 4x2 table-box [TFC] children: not-inline
BlockContainer <colgroup> (not painted) table-column-group children: not-inline
BlockContainer <col> (not painted) children: not-inline
BlockContainer <(anonymous)> at (8,10) content-size 784x17 children: inline
frag 0 from TextNode start: 1, length: 19, rect: [8,10 162.109375x17] baseline: 13.296875
"PASS (didn't crash)"
TextNode <#text>
ViewportPaintable (Viewport<#document>) [0,0 800x600]
PaintableWithLines (BlockContainer<HTML>) [0,0 800x600]
PaintableWithLines (BlockContainer<BODY>) [8,8 784x19]
PaintableWithLines (TableWrapper(anonymous)) [8,8 4x2]
PaintableBox (Box<TABLE>) [8,8 4x2]
PaintableWithLines (BlockContainer(anonymous)) [8,10 784x17]
TextPaintable (TextNode<#text>)

2
Tests/LibWeb/Layout/input/table/col-span-crash.html Normal file
View file

@ -0,0 +1,2 @@
<table><col span="9"></col></table>
PASS (didn't crash)

1
Userland/Libraries/LibWeb/Layout/TableFormattingContext.cpp
View file

@ -1386,6 +1386,7 @@ void TableFormattingContext::BorderConflictFinder::collect_conflicting_col_eleme
VERIFY(child_of_column_group->display().is_table_column());
auto const& col_node = static_cast<HTML::HTMLTableColElement const&>(*child_of_column_group->dom_node());
unsigned span = col_node.get_attribute_value(HTML::AttributeNames::span).to_number<unsigned>().value_or(1);
m_col_elements_by_index.resize(column_index + span);
for (size_t i = column_index; i < column_index + span; ++i) {
m_col_elements_by_index[i] = child_of_column_group;
}