From 613a04e4df97ff38e1fddd091a9bd96fdbc434fe Mon Sep 17 00:00:00 2001 From: Andreas Kling Date: Sat, 6 Jun 2026 23:49:15 +0200 Subject: [PATCH] LibWeb: Skip styleless nodes for rendered text Rendered text collection needs computed style only for nodes that are being rendered. A stale layout node can remain without style or a styled parent, so treat that as not rendered instead of asserting while reading innerText or outerText. Add reduced crash coverage for reading outerText from a style element after disabling and adopting it into another document. --- Libraries/LibWeb/HTML/HTMLElement.cpp | 2 ++ .../Crash/HTML/style-outer-text-after-adoption.html | 8 ++++++++ 2 files changed, 10 insertions(+) create mode 100644 Tests/LibWeb/Crash/HTML/style-outer-text-after-adoption.html diff --git a/Libraries/LibWeb/HTML/HTMLElement.cpp b/Libraries/LibWeb/HTML/HTMLElement.cpp index afdc504184..1a9df555ed 100644 --- a/Libraries/LibWeb/HTML/HTMLElement.cpp +++ b/Libraries/LibWeb/HTML/HTMLElement.cpp @@ -314,6 +314,8 @@ static Vector> rendered_text_collec auto* layout_node = node.layout_node(); if (!layout_node) return items; + if (!layout_node->has_style_or_parent_with_style()) + return items; auto const& computed_values = layout_node->computed_values(); diff --git a/Tests/LibWeb/Crash/HTML/style-outer-text-after-adoption.html b/Tests/LibWeb/Crash/HTML/style-outer-text-after-adoption.html new file mode 100644 index 0000000000..e0a711fc84 --- /dev/null +++ b/Tests/LibWeb/Crash/HTML/style-outer-text-after-adoption.html @@ -0,0 +1,8 @@ + + +