RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-10-31 21:22:46 +00:00
Code Issues Activity Actions

LibWeb: Invalidate style before running insertion steps

Browse source 
This fixes issue reproducing with following steps:
1. Node::insert_before() adopts a node into another document.
2. Node::insert_before() runs insertion steps for adopted node (adopted
   node style is not invalidated yet).
3. Insertion steps execute spin_until() on event loop.
4. The next task on event loop does Document::update_style() which
   requires layout tree rebuild.
5. Layout tree rebuild fails because there is a node with invalidated
   style.
This commit is contained in:
Aliaksandr Kalenik 2023-09-08 12:04:10 +02:00 • committed by Andreas Kling
parent 6736a76915
commit 10b2ce49dc
1 changed files with 2 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
Userland/Libraries/LibWeb/DOM/Node.cpp
View file

@ -467,6 +467,8 @@ void Node::insert_before(JS::NonnullGCPtr<Node> node, JS::GCPtr<Node> child, boo
// 6. Run assign slottables for a tree with node’s root. // 6. Run assign slottables for a tree with node’s root.
assign_slottables_for_a_tree(node->root()); assign_slottables_for_a_tree(node->root());
node_to_insert->invalidate_style();
// 7. For each shadow-including inclusive descendant inclusiveDescendant of node, in shadow-including tree order: // 7. For each shadow-including inclusive descendant inclusiveDescendant of node, in shadow-including tree order:
node_to_insert->for_each_shadow_including_inclusive_descendant([&](Node& inclusive_descendant) { node_to_insert->for_each_shadow_including_inclusive_descendant([&](Node& inclusive_descendant) {
// 1. Run the insertion steps with inclusiveDescendant. // 1. Run the insertion steps with inclusiveDescendant.