From 4e47e6a3d6cc448536cafe4459cdf6887ec93af1 Mon Sep 17 00:00:00 2001
From: Sam Atkins <atkinssj@serenityos.org>
Date: Tue, 23 May 2023 13:52:58 +0100
Subject: [PATCH] LibWeb: Reject invalid tokens in `calc()` expressions

If we finish parsing a calculation tree and it still contains
UnparsedCalculationNodes, then it's not valid, and we shouldn't create
a StyleValue from it.
---
 Userland/Libraries/LibWeb/CSS/Parser/Parser.cpp | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/Userland/Libraries/LibWeb/CSS/Parser/Parser.cpp b/Userland/Libraries/LibWeb/CSS/Parser/Parser.cpp
index 8e7becf3b7..719d5512aa 100644
--- a/Userland/Libraries/LibWeb/CSS/Parser/Parser.cpp
+++ b/Userland/Libraries/LibWeb/CSS/Parser/Parser.cpp
@@ -7591,6 +7591,7 @@ ErrorOr<OwnPtr<CalculationNode>> Parser::parse_a_calculation(Vector<ComponentVal
                 return {};
             }
             node = leaf_calculation.release_nonnull();
+            return {};
         }
 
         // 2. If leaf is a math function, replace leaf with the internal representation of that math function.
@@ -7604,6 +7605,7 @@ ErrorOr<OwnPtr<CalculationNode>> Parser::parse_a_calculation(Vector<ComponentVal
                     return {};
                 }
                 node = leaf_calculation.release_nonnull();
+                return {};
             } else {
                 // FIXME: Parse more math functions once we have them.
                 parsing_failed_for_child_node = true;
@@ -7611,6 +7613,10 @@ ErrorOr<OwnPtr<CalculationNode>> Parser::parse_a_calculation(Vector<ComponentVal
             }
         }
 
+        // NOTE: If we get here, then we have an UnparsedCalculationNode that didn't get replaced with something else.
+        //       So, the calc() is invalid.
+        dbgln_if(CSS_PARSER_DEBUG, "Leftover UnparsedCalculationNode in calc tree! That probably means the syntax is invalid, but maybe we just didn't implement `{}` yet.", component_value.to_debug_string());
+        parsing_failed_for_child_node = true;
         return {};
     }));