RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-05-30 21:28:11 +00:00
Code Issues Activity Actions

LibWeb: Don't assume rect() contents are Tokens

Browse source 
This stops `clip: rect({});` from crashing.
This commit is contained in:
Sam Atkins 2023-11-21 11:39:06 +00:00 • committed by Andreas Kling
parent aba2946b1e
commit 5e54ff1858
3 changed files with 15 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

12
Tests/LibWeb/Layout/expected/css-values/rect-non-token-contents-crash.txt Normal file
View file

@ -0,0 +1,12 @@
Viewport <#document> at (0,0) content-size 800x600 children: not-inline
BlockContainer <html> at (0,0) content-size 800x600 [BFC] children: not-inline
BlockContainer <body> at (8,8) content-size 784x0 children: not-inline
BlockContainer <div> at (8,8) content-size 784x0 children: not-inline
BlockContainer <(anonymous)> at (8,16) content-size 784x0 children: inline
TextNode <#text>
ViewportPaintable (Viewport<#document>) [0,0 800x600]
PaintableWithLines (BlockContainer<HTML>) [0,0 800x600]
PaintableWithLines (BlockContainer<BODY>) [8,8 784x0] overflow: [8,16 784x0]
PaintableWithLines (BlockContainer<DIV>) [8,8 784x0]
PaintableWithLines (BlockContainer(anonymous)) [8,16 784x0]

1
Tests/LibWeb/Layout/input/css-values/rect-non-token-contents-crash.html Normal file
View file

@ -0,0 +1 @@
<div style="clip: rect({})"></div>

4
Userland/Libraries/LibWeb/CSS/Parser/Parser.cpp
View file

@ -2122,8 +2122,8 @@ RefPtr<StyleValue> Parser::parse_rect_value(ComponentValue const& component_valu
// <top>, <right>, <bottom>, and <left> may either have a <length> value or 'auto'. // <top>, <right>, <bottom>, and <left> may either have a <length> value or 'auto'.
// Negative lengths are permitted. // Negative lengths are permitted.
auto current_token = tokens.next_token().token(); auto& current_token = tokens.next_token();
if (current_token.is(Token::Type::Ident) && current_token.ident().equals_ignoring_ascii_case("auto"sv)) { if (current_token.is_ident("auto"sv)) {
params.append(Length::make_auto()); params.append(Length::make_auto());
} else { } else {
auto maybe_length = parse_length(current_token); auto maybe_length = parse_length(current_token);