From 5ca8e2a751e3317bd1f0512d7b2bab40072e611e Mon Sep 17 00:00:00 2001
From: stelar7 <dudedbz@gmail.com>
Date: Sat, 7 May 2022 23:46:19 +0200
Subject: [PATCH] LibWeb: Dont try to fetch another token in an+b parsing

When parsing <ndash-dimension> <signless-integer>, we tried to parse
a new token from the stream instead of using the value we had already
extracted. This caused pages that used the syntax to crash.
---
 Userland/Libraries/LibWeb/CSS/Parser/Parser.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Userland/Libraries/LibWeb/CSS/Parser/Parser.cpp b/Userland/Libraries/LibWeb/CSS/Parser/Parser.cpp
index 90e704e7a0..ab89e724cb 100644
--- a/Userland/Libraries/LibWeb/CSS/Parser/Parser.cpp
+++ b/Userland/Libraries/LibWeb/CSS/Parser/Parser.cpp
@@ -5327,7 +5327,7 @@ Optional<Selector::SimpleSelector::ANPlusBPattern> Parser::parse_a_n_plus_b_patt
         auto& second_value = values.next_token();
         if (is_signless_integer(second_value)) {
             int a = first_value.token().dimension_value_int();
-            int b = -values.next_token().token().to_integer();
+            int b = -second_value.token().to_integer();
             transaction.commit();
             return Selector::SimpleSelector::ANPlusBPattern { a, b };
         }