9402a6e4e1
Problem: UBSan crash when computing layout for an element with a giant negative inset. Cause: CSSPixels::operator-() returned from_raw(-raw_value()), and negating the i32 minimum overflows int. Fix: Negate with saturating_sub(0, raw_value()) — matching the saturating arithmetic already used by the other CSSPixels operators. Fixes https://github.com/LadybirdBrowser/ladybird/issues/9997
19 lines
542 B
HTML
19 lines
542 B
HTML
<!DOCTYPE html>
|
|
<script src="include.js"></script>
|
|
<style>
|
|
/* A huge negative inset saturates the CSSPixels raw value to the i32 minimum. */
|
|
#target {
|
|
position: relative;
|
|
right: -999999999999999999999999999999999999px;
|
|
width: 1px;
|
|
height: 1px;
|
|
}
|
|
</style>
|
|
<div id="target"></div>
|
|
<script>
|
|
test(() => {
|
|
// Forces layout, which negates the inset while resolving relative positioning.
|
|
document.documentElement.offsetHeight;
|
|
println("PASS (didn't crash)");
|
|
});
|
|
</script>
|