LibWeb: Do not crash when inserting block elements into inline SVGBoxes

Fixes LadybirdBrowser#3395.
gmta · Feb 19, 2025 · b8e4886 · b8e4886
1 parent 1d941b1
commit b8e4886
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 5 deletions.
diff --git a/Libraries/LibWeb/Layout/Node.cpp b/Libraries/LibWeb/Layout/Node.cpp
@@ -1232,6 +1232,10 @@ bool NodeWithStyleAndBoxModelMetrics::should_create_inline_continuation() const
     if (is<SVG::SVGForeignObjectElement>(parent()->dom_node()))
         return false;
 
+    // SVGBoxes are appended directly to their layout parent without changing the parent's (non-)inline behavior.
+    if (is_svg_box())
+        return false;
+
     return true;
 }
 

diff --git a/Libraries/LibWeb/Layout/TreeBuilder.cpp b/Libraries/LibWeb/Layout/TreeBuilder.cpp
@@ -549,12 +549,10 @@ void TreeBuilder::update_layout_tree(DOM::Node& dom_node, TreeBuilder::Context&
             && old_layout_node != layout_node;
         if (may_replace_existing_layout_node) {
             old_layout_node->parent()->replace_child(*layout_node, *old_layout_node);
+        } else if (layout_node->is_svg_box()) {
+            m_ancestor_stack.last()->append_child(*layout_node);
         } else {
-            if (layout_node->is_svg_box()) {
-                m_ancestor_stack.last()->append_child(*layout_node);
-            } else {
-                insert_node_into_inline_or_block_ancestor(*layout_node, display, AppendOrPrepend::Append);
-            }
+            insert_node_into_inline_or_block_ancestor(*layout_node, display, AppendOrPrepend::Append);
         }
     }
 

diff --git a/Tests/LibWeb/Crash/Layout/svg-box-no-inline-continuation.html b/Tests/LibWeb/Crash/Layout/svg-box-no-inline-continuation.html
@@ -0,0 +1,3 @@
+<!DOCTYPE html>
+<!-- SVGBoxes should never be considered for inline continuation; caused a crash previously. -->
+<svg>inline text before <g style="display: block"></g></svg>