diff --git a/Tests/LibWeb/Layout/expected/dont-crash-on-relayout-that-rewraps-text.txt b/Tests/LibWeb/Layout/expected/dont-crash-on-relayout-that-rewraps-text.txt new file mode 100644 index 0000000000..22c47be1f4 --- /dev/null +++ b/Tests/LibWeb/Layout/expected/dont-crash-on-relayout-that-rewraps-text.txt @@ -0,0 +1,27 @@ +Viewport <#document> at (0,0) content-size 800x600 children: not-inline + BlockContainer at (1,1) content-size 798x56.9375 [BFC] children: not-inline + BlockContainer at (10,10) content-size 200x38.9375 children: inline + line 0 width: 196.0625, height: 19.46875, bottom: 19.46875, baseline: 14.53125 + frag 0 from BlockContainer start: 0, length: 0, rect: [11,11 194.0625x17.46875] + line 1 width: 138.265625, height: 19.46875, bottom: 38.9375, baseline: 14.53125 + frag 0 from BlockContainer start: 0, length: 0, rect: [11,30 136.265625x17.46875] + BlockContainer
at (11,11) content-size 194.0625x17.46875 inline-block [BFC] children: inline + line 0 width: 194.0625, height: 17.46875, bottom: 17.46875, baseline: 13.53125 + frag 0 from TextNode start: 0, length: 20, rect: [11,11 194.0625x17.46875] + "xxxxxxxxxxxxxxxxxxxx" + TextNode <#text> + TextNode <#text> + BlockContainer
at (11,30) content-size 136.265625x17.46875 inline-block [BFC] children: inline + line 0 width: 136.265625, height: 17.46875, bottom: 17.46875, baseline: 13.53125 + frag 0 from TextNode start: 0, length: 19, rect: [11,30 136.265625x17.46875] + "yyyyyyyyyyyyyyyyyyy" + TextNode <#text> + TextNode <#text> + +ViewportPaintable (Viewport<#document>) [0,0 800x600] + PaintableWithLines (BlockContainer) [0,0 800x58.9375] + PaintableWithLines (BlockContainer) [9,9 202x40.9375] + PaintableWithLines (BlockContainer
) [10,10 196.0625x19.46875] + TextPaintable (TextNode<#text>) + PaintableWithLines (BlockContainer
) [10,29 138.265625x19.46875] + TextPaintable (TextNode<#text>) diff --git a/Tests/LibWeb/Layout/input/dont-crash-on-relayout-that-rewraps-text.html b/Tests/LibWeb/Layout/input/dont-crash-on-relayout-that-rewraps-text.html new file mode 100644 index 0000000000..10181b091f --- /dev/null +++ b/Tests/LibWeb/Layout/input/dont-crash-on-relayout-that-rewraps-text.html @@ -0,0 +1,13 @@ +
xxxxxxxxxxxxxxxxxxxx
yyyyyyyyyyyyyyyyyyy
+ \ No newline at end of file diff --git a/Userland/Libraries/LibWeb/Layout/LayoutState.cpp b/Userland/Libraries/LibWeb/Layout/LayoutState.cpp index 0ecfaac251..775ba4929b 100644 --- a/Userland/Libraries/LibWeb/Layout/LayoutState.cpp +++ b/Userland/Libraries/LibWeb/Layout/LayoutState.cpp @@ -218,6 +218,14 @@ void LayoutState::commit(Box& root) // Only the top-level LayoutState should ever be committed. VERIFY(!m_parent); + // NOTE: In case this is a relayout of an existing tree, we start by detaching the old paint tree + // from the layout tree. This is done to ensure that we don't end up with any old-tree pointers + // when text paintables shift around in the tree. + root.for_each_in_inclusive_subtree_of_type([&](Layout::TextNode& text_node) { + text_node.set_paintable(nullptr); + return IterationDecision::Continue; + }); + HashTable text_nodes; Vector paintables_with_lines;