From 9183c2a0292ff43ba3df23a7af6ccb3253dedaff Mon Sep 17 00:00:00 2001 From: Callum Law Date: Sun, 21 Jun 2026 12:44:29 +1200 Subject: [PATCH] LibWeb: Bail on unresolved percentages in `resolve_value` Previously we assumed that if the calculation had been simplified to a single `NumericCalculationNode` that we could resolve it - this isn't the case if we have a percentage that should be resolved to a different type. Fixes #10209 --- .../LibWeb/CSS/StyleValues/CalculatedStyleValue.cpp | 2 +- ...unresolved-percentage-isnt-considered-resolvable.html | 9 +++++++++ 2 files changed, 10 insertions(+), 1 deletion(-) create mode 100644 Tests/LibWeb/Crash/CSS/unresolved-percentage-isnt-considered-resolvable.html diff --git a/Libraries/LibWeb/CSS/StyleValues/CalculatedStyleValue.cpp b/Libraries/LibWeb/CSS/StyleValues/CalculatedStyleValue.cpp index 0327f7e37b..de7f542fb3 100644 --- a/Libraries/LibWeb/CSS/StyleValues/CalculatedStyleValue.cpp +++ b/Libraries/LibWeb/CSS/StyleValues/CalculatedStyleValue.cpp @@ -3162,7 +3162,7 @@ Optional CalculatedStyleValue::resolve_valu // NOTE: Any nodes which rely on dynamic state should have been simplified away in absolutized so we can pass a nullptr here auto simplified_tree = simplify_a_calculation_tree(m_calculation, m_context, resolution_context); - if (!is(*simplified_tree)) + if (!is(*simplified_tree) || (simplified_tree->contains_percentage() && m_context.percentages_resolve_as.has_value())) return {}; auto value = try_get_value_with_canonical_unit(simplified_tree, m_context, resolution_context); diff --git a/Tests/LibWeb/Crash/CSS/unresolved-percentage-isnt-considered-resolvable.html b/Tests/LibWeb/Crash/CSS/unresolved-percentage-isnt-considered-resolvable.html new file mode 100644 index 0000000000..1ee74cf025 --- /dev/null +++ b/Tests/LibWeb/Crash/CSS/unresolved-percentage-isnt-considered-resolvable.html @@ -0,0 +1,9 @@ + + +