Commit Graph

1 Commits

Author SHA1 Message Date
Andreas Kling
7b0d818f8e LibWeb: Update layout before accessing paintables in viewport scroll
perform_a_scroll_of_the_viewport() accesses paintable_box() without
ensuring layout is up to date. This can lead to a null dereference
if the paintable tree was torn down (e.g. by adding a dialog to the top
layer via showModal()) between the last layout update and the scroll.

One concrete path: Window::scroll() has an optimization that skips
update_layout when scrolling to (0, 0), but still calls
perform_a_scroll_of_the_viewport if the viewport is at a non-zero
position.

Fix by adding an update_layout call at the top of
perform_a_scroll_of_the_viewport.
2026-02-25 10:18:08 +01:00