system/serenity
system/serenity
1
0
Fork 0
mirror of https://github.com/SerenityOS/serenity synced 2024-11-05 17:46:52 +00:00
Code Issues Projects Releases Packages Wiki Activity

LibWeb: Invalidate style before running insertion steps

Browse source 
This fixes issue reproducing with following steps:
1. Node::insert_before() adopts a node into another document.
2. Node::insert_before() runs insertion steps for adopted node (adopted
   node style is not invalidated yet).
3. Insertion steps execute spin_until() on event loop.
4. The next task on event loop does Document::update_style() which
   requires layout tree rebuild.
5. Layout tree rebuild fails because there is a node with invalidated
   style.
This commit is contained in:
Aliaksandr Kalenik 2023-09-08 12:04:10 +02:00 committed by Andreas Kling
parent 6736a76915
commit 10b2ce49dc
1 changed files with 2 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
Userland/Libraries/LibWeb/DOM/Node.cpp
View file

@ -467,6 +467,8 @@ void Node::insert_before(JS::NonnullGCPtr<Node> node, JS::GCPtr<Node> child, boo
// 6. Run assign slottables for a tree with node’s root.
assign_slottables_for_a_tree(node->root());
node_to_insert->invalidate_style();
// 7. For each shadow-including inclusive descendant inclusiveDescendant of node, in shadow-including tree order:
node_to_insert->for_each_shadow_including_inclusive_descendant([&](Node& inclusive_descendant) {
// 1. Run the insertion steps with inclusiveDescendant.