From 10b2ce49dc654d15b85d8a03d1b67dca2f77cf5a Mon Sep 17 00:00:00 2001 From: Aliaksandr Kalenik Date: Fri, 8 Sep 2023 12:04:10 +0200 Subject: [PATCH] LibWeb: Invalidate style before running insertion steps This fixes issue reproducing with following steps: 1. Node::insert_before() adopts a node into another document. 2. Node::insert_before() runs insertion steps for adopted node (adopted node style is not invalidated yet). 3. Insertion steps execute spin_until() on event loop. 4. The next task on event loop does Document::update_style() which requires layout tree rebuild. 5. Layout tree rebuild fails because there is a node with invalidated style. --- Userland/Libraries/LibWeb/DOM/Node.cpp | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Userland/Libraries/LibWeb/DOM/Node.cpp b/Userland/Libraries/LibWeb/DOM/Node.cpp index d99a7a1a62..5ca21cd032 100644 --- a/Userland/Libraries/LibWeb/DOM/Node.cpp +++ b/Userland/Libraries/LibWeb/DOM/Node.cpp @@ -467,6 +467,8 @@ void Node::insert_before(JS::NonnullGCPtr node, JS::GCPtr child, boo // 6. Run assign slottables for a tree with node’s root. assign_slottables_for_a_tree(node->root()); + node_to_insert->invalidate_style(); + // 7. For each shadow-including inclusive descendant inclusiveDescendant of node, in shadow-including tree order: node_to_insert->for_each_shadow_including_inclusive_descendant([&](Node& inclusive_descendant) { // 1. Run the insertion steps with inclusiveDescendant.