mirror of
https://github.com/LadybirdBrowser/ladybird
synced 2026-04-26 09:45:06 +02:00
6b3d3468a1
Previously, the column count was always incremented by 1. This led to a mismatch with `compute_outer_content_sizes()`, which did use the `span` attribute to advance the column index. This mismatch caused an out-of-bounds access when the column index was greater than the expected number of columns.
23 lines
1.4 KiB
Plaintext
23 lines
1.4 KiB
Plaintext
Viewport <#document> at [0,0] [0+0+0 800 0+0+0] [0+0+0 600 0+0+0] [BFC] children: not-inline
|
|
BlockContainer <html> at [0,0] [0+0+0 800 0+0+0] [0+0+0 36 0+0+0] [BFC] children: not-inline
|
|
BlockContainer <body> at [8,8] [8+0+0 784 0+0+8] [8+0+0 20 0+0+8] children: not-inline
|
|
TableWrapper <(anonymous)> at [8,8] [0+0+0 20 0+0+764] [0+0+0 2 0+0+0] [BFC] children: not-inline
|
|
Box <table> at [8,8] table-box [0+0+0 20 0+0+0] [0+0+0 2 0+0+0] [TFC] children: not-inline
|
|
BlockContainer <colgroup> (not painted) table-column-group children: not-inline
|
|
BlockContainer <col> (not painted) children: not-inline
|
|
BlockContainer <(anonymous)> at [8,10] [0+0+0 784 0+0+0] [0+0+0 18 0+0+0] children: inline
|
|
frag 0 from TextNode start: 1, length: 19, rect: [8,10 162.109375x18] baseline: 13.796875
|
|
"PASS (didn't crash)"
|
|
TextNode <#text> (not painted)
|
|
|
|
ViewportPaintable (Viewport<#document>) [0,0 800x600]
|
|
PaintableWithLines (BlockContainer<HTML>) [0,0 800x36]
|
|
PaintableWithLines (BlockContainer<BODY>) [8,8 784x20]
|
|
PaintableWithLines (TableWrapper(anonymous)) [8,8 20x2]
|
|
PaintableBox (Box<TABLE>) [8,8 20x2]
|
|
PaintableWithLines (BlockContainer(anonymous)) [8,10 784x18]
|
|
TextPaintable (TextNode<#text>)
|
|
|
|
SC for Viewport<#document> [0,0 800x600] [children: 1] (z-index: auto)
|
|
SC for BlockContainer<HTML> [0,0 800x36] [children: 0] (z-index: auto)
|