RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-27 12:57:35 +00:00
Code Issues Activity Actions

LibWeb: Use .to_px_or_zero() in tentative_height_for_replaced_element()

Browse source 
If just .to_px() is used the height can end up as the float `inf` or
`nan`. This caused an OOM when loading Polygon as this `inf` would
become a `nan` and propagate to the SVG painting, which then attempts
to draw a path with nan control points, which would make the
Gfx::Painter infinitely split the path till it OOM'd.
This commit is contained in:
MacDue 2023-05-11 22:14:31 +01:00 • committed by Andreas Kling
parent eb76329ad8
commit 1012947a30
1 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
Userland/Libraries/LibWeb/Layout/FormattingContext.cpp
View file

@ -495,7 +495,8 @@ CSSPixels FormattingContext::tentative_height_for_replaced_element(LayoutState c
if (computed_height.is_auto())
return 150;
return computed_height.to_px(box, available_space.height.to_px());
// FIXME: Handle cases when available_space is not definite.
return computed_height.to_px(box, available_space.height.to_px_or_zero());
}
CSSPixels FormattingContext::compute_height_for_replaced_element(LayoutState const& state, ReplacedBox const& box, AvailableSpace const& available_space)