From fe66aeb225cb533a3abb3b494d3ee53a0d2952a2 Mon Sep 17 00:00:00 2001
From: Tim Ledbetter <timledbetter@gmail.com>
Date: Sat, 17 Feb 2024 08:09:53 +0000
Subject: [PATCH] LibWeb: Validate arguments when creating DOMPoint from matrix
 transform

Previously, it was possible to create a DOMPoint from a matrix
transform with inconsistent arguments. A TypeError is now thrown in
this case.
---
 Tests/LibWeb/Text/expected/geometry/dompoint.txt    |  1 +
 Tests/LibWeb/Text/input/geometry/dompoint.html      | 13 ++++++++++++-
 .../Libraries/LibWeb/Geometry/DOMPointReadOnly.cpp  |  2 +-
 3 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/Tests/LibWeb/Text/expected/geometry/dompoint.txt b/Tests/LibWeb/Text/expected/geometry/dompoint.txt
index 8b6543873d..6f90900017 100644
--- a/Tests/LibWeb/Text/expected/geometry/dompoint.txt
+++ b/Tests/LibWeb/Text/expected/geometry/dompoint.txt
@@ -4,3 +4,4 @@
 4. {"x":750,"y":1060,"z":0,"w":1}
 5. {"x":750,"y":1060,"z":0,"w":1}
 6. {"x":750,"y":1060,"z":0,"w":1}
+7. Exception: TypeError
diff --git a/Tests/LibWeb/Text/input/geometry/dompoint.html b/Tests/LibWeb/Text/input/geometry/dompoint.html
index 38ec20ba17..9412a12e2d 100644
--- a/Tests/LibWeb/Text/input/geometry/dompoint.html
+++ b/Tests/LibWeb/Text/input/geometry/dompoint.html
@@ -3,7 +3,12 @@
     test(() => {
         let testCounter = 1;
         function testPart(part) {
-            println(`${testCounter++}. ${JSON.stringify(part())}`);
+            try {
+                println(`${testCounter}. ${JSON.stringify(part())}`);
+            } catch (e) {
+                println(`${testCounter}. Exception: ${e.name}`);
+            }
+            testCounter++;
         }
 
         // 1. Creating a DOMPoint
@@ -33,5 +38,11 @@
             const matrix = new DOMMatrix([10, 20, 30, 40, 50, 60]);
             return matrix.transformPoint({x: 10, y: 20});
         });
+        
+        // 7. Transforming a point using a matrixTransform with an invalid DOMMatrixInit
+        testPart(function () {
+            const point = new DOMPoint(10, 20);
+            return point.matrixTransform({ is2D: true, m33: 1.0000001 });
+        });
     });
 </script>
diff --git a/Userland/Libraries/LibWeb/Geometry/DOMPointReadOnly.cpp b/Userland/Libraries/LibWeb/Geometry/DOMPointReadOnly.cpp
index c31c8809bc..b6db2e5cc6 100644
--- a/Userland/Libraries/LibWeb/Geometry/DOMPointReadOnly.cpp
+++ b/Userland/Libraries/LibWeb/Geometry/DOMPointReadOnly.cpp
@@ -41,7 +41,7 @@ DOMPointReadOnly::~DOMPointReadOnly() = default;
 WebIDL::ExceptionOr<JS::NonnullGCPtr<DOMPoint>> DOMPointReadOnly::matrix_transform(DOMMatrixInit& matrix) const
 {
     // 1. Let matrixObject be the result of invoking create a DOMMatrix from the dictionary matrix.
-    auto matrix_object = TRY(DOMMatrix::create_from_dom_matrix_2d_init(realm(), matrix));
+    auto matrix_object = TRY(DOMMatrix::create_from_dom_matrix_init(realm(), matrix));
 
     // 2. Return the result of invoking transform a point with a matrix, given the current point and matrixObject. The current point does not get modified.
     return matrix_object->transform_point(*this);