dmaax/ladybird
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

LibWeb: Ignore invalid body background hints

Browse source 
The body background attribute can fail to produce an image style
value. Applying presentational hints should ignore the attribute in
that case instead of asserting.

Add reduced crash coverage for updating style after an invalid body
background hint is adopted into the active document.
This commit is contained in:
Andreas Kling 2026-06-06 23:35:48 +02:00 committed by Andreas Kling
parent 485ca67164
commit 57bf4bec64
2 changed files with 15 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
Libraries/LibWeb/HTML/HTMLBodyElement.cpp
View file

@ -75,8 +75,8 @@ void HTMLBodyElement::apply_presentational_hints(Vector<CSS::StyleProperty>& pro
if (color.has_value())
properties.append({ .property_id = CSS::PropertyID::Color, .value = CSS::ColorStyleValue::create_from_color(color.value(), CSS::ColorSyntax::Legacy) });
} else if (name == HTML::AttributeNames::background) {
VERIFY(m_background_style_value);
properties.append({ .property_id = CSS::PropertyID::BackgroundImage, .value = CSS::StyleValueList::create({ *m_background_style_value }, CSS::StyleValueList::Separator::Comma) });
if (m_background_style_value)
properties.append({ .property_id = CSS::PropertyID::BackgroundImage, .value = CSS::StyleValueList::create({ *m_background_style_value }, CSS::StyleValueList::Separator::Comma) });
}
});
@ -134,6 +134,7 @@ void HTMLBodyElement::attribute_changed(FlyString const& name, Optional<String>
document().set_visited_link_color(color.value());
} else if (name == HTML::AttributeNames::background) {
// https://html.spec.whatwg.org/multipage/rendering.html#the-page:attr-background
m_background_style_value = nullptr;
if (auto maybe_background_url = document().encoding_parse_url(value.value_or(String {})); maybe_background_url.has_value()) {
m_background_style_value = CSS::ImageStyleValue::create(maybe_background_url.value());
m_background_style_value->on_animate = [this] {

12
Tests/LibWeb/Crash/HTML/body-invalid-background-after-adoption.html Normal file
View file

@ -0,0 +1,12 @@
<!doctype html>
<body onload="runTest()">
<script>
function runTest()
{
const documentWithBody = document.implementation.createHTMLDocument("x");
const body = documentWithBody.createElement("body");
body.setAttribute("background", "http://[");
document.documentElement.appendChild(body);
body.scrollIntoView();
}
</script>