diff --git a/Libraries/LibWeb/DOM/Element.cpp b/Libraries/LibWeb/DOM/Element.cpp index 11e9c9bc08..a3069538c8 100644 --- a/Libraries/LibWeb/DOM/Element.cpp +++ b/Libraries/LibWeb/DOM/Element.cpp @@ -13,6 +13,7 @@ #include #include #include +#include #include #include #include @@ -4208,7 +4209,7 @@ i32 Element::ordinal_value() // 1. Let i be 1. [Not necessary] // 2. If owner is an ol element, let numbering be owner's starting value. Otherwise, let numbering be 1. - AK::Checked numbering = 1; + i32 numbering = 1; auto reversed = false; if (auto* ol_element = as_if(owner.ptr())) { @@ -4233,13 +4234,13 @@ i32 Element::ordinal_value() } // 6. The ordinal value of item is numbering. - item->m_ordinal_value = numbering.value(); + item->m_ordinal_value = numbering; // 7. If owner is an ol element, and owner has a reversed attribute, decrement numbering by 1; otherwise, increment numbering by 1. if (reversed) { - numbering--; + numbering = AK::saturating_sub(numbering, 1); } else { - numbering++; + numbering = AK::saturating_add(numbering, 1); } // 8. Increment i by 1. [Not necessary] diff --git a/Tests/LibWeb/Text/expected/list-item-ordinal-value-overflow.txt b/Tests/LibWeb/Text/expected/list-item-ordinal-value-overflow.txt new file mode 100644 index 0000000000..aaecaf93c4 --- /dev/null +++ b/Tests/LibWeb/Text/expected/list-item-ordinal-value-overflow.txt @@ -0,0 +1 @@ +PASS (didn't crash) diff --git a/Tests/LibWeb/Text/input/list-item-ordinal-value-overflow.html b/Tests/LibWeb/Text/input/list-item-ordinal-value-overflow.html new file mode 100644 index 0000000000..906079fd51 --- /dev/null +++ b/Tests/LibWeb/Text/input/list-item-ordinal-value-overflow.html @@ -0,0 +1,13 @@ + + + +
  1. a
  2. b
+ +
  1. a
  2. b
+