mirror of
https://github.com/LadybirdBrowser/ladybird
synced 2026-04-25 17:25:08 +02:00
7b0d818f8e
perform_a_scroll_of_the_viewport() accesses paintable_box() without ensuring layout is up to date. This can lead to a null dereference if the paintable tree was torn down (e.g. by adding a dialog to the top layer via showModal()) between the last layout update and the scroll. One concrete path: Window::scroll() has an optimization that skips update_layout when scrolling to (0, 0), but still calls perform_a_scroll_of_the_viewport if the viewport is at a non-zero position. Fix by adding an update_layout call at the top of perform_a_scroll_of_the_viewport.
2 lines
20 B
Plaintext
2 lines
20 B
Plaintext
PASS (didn't crash)
|