Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Crash on any Wordpress website that uses wpDiscuz comments plugin #2761

Open
1 task
Jg99 opened this issue Dec 4, 2024 · 1 comment
Open
1 task

Crash on any Wordpress website that uses wpDiscuz comments plugin #2761

Jg99 opened this issue Dec 4, 2024 · 1 comment

Comments

@Jg99
Copy link

Jg99 commented Dec 4, 2024

Summary

If i visit a Wordpress website that uses this plugin, such as wpdiscuz.com/demo/ the webpage crashes.

Operating system

macOS

Steps to reproduce

  1. Open Ladybird
  2. Navigate to https://wpdiscuz.com/demo/ or any wordpress website using this plugin
  3. Wait about 5 seconds

Expected behavior

Page should not crash ladybird.

Actual behavior

Webpage crashes Ladybird

URL for a reduced test case

https://wpdiscuz.com/demo/

HTML/SVG/etc. source for a reduced test case

N/A

Log output and (if possible) backtrace

67587.132 WebContent(52198): Label <label.wmu-add> (not painted) [0+0+0 0 0+0+0] [0+0+0 0 0+0+0] children: inline
  BlockContainer <i.far.fa-image> (not painted) inline-block [0+0+0 0 0+0+0] [0+0+0 0 0+0+0] [BFC] children: inline
    InlineNode <(anonymous)>
      TextNode <#text>

67587.132 WebContent(52198): FIXME: InlineFormattingContext::dimension_box_on_line got unexpected box in inline context:
67587.132 WebContent(52198): Label <label.wmu-add> (not painted) [0+0+0 0 0+0+0] [0+0+0 0 0+0+0] children: inline
  BlockContainer <i.far.fa-image> (not painted) inline-block [0+0+0 0 0+0+0] [0+0+0 0 0+0+0] [BFC] children: inline
    InlineNode <(anonymous)>
      TextNode <#text>

67587.133 WebContent(52198): FIXME: InlineFormattingContext::dimension_box_on_line got unexpected box in inline context:
67587.133 WebContent(52198): Label <label.wmu-add> (not painted) [0+0+0 0 0+0+0] [0+0+0 0 0+0+0] children: inline
  BlockContainer <i.far.fa-image> (not painted) inline-block [0+0+0 0 0+0+0] [0+0+0 0 0+0+0] [BFC] children: inline
    InlineNode <(anonymous)>
      TextNode <#text>

67587.133 WebContent(52198): FIXME: InlineFormattingContext::dimension_box_on_line got unexpected box in inline context:
67587.133 WebContent(52198): Label <label.wmu-add> (not painted) [0+0+0 0 0+0+0] [0+0+0 0 0+0+0] children: inline
  BlockContainer <i.far.fa-image> (not painted) inline-block [0+0+0 0 0+0+0] [0+0+0 0 0+0+0] [BFC] children: inline
    InlineNode <(anonymous)>
      TextNode <#text>

67587.133 WebContent(52198): FIXME: InlineFormattingContext::dimension_box_on_line got unexpected box in inline context:
67587.133 WebContent(52198): Label <label.wmu-add> (not painted) [0+0+0 0 0+0+0] [0+0+0 0 0+0+0] children: inline
  BlockContainer <i.far.fa-image> (not painted) inline-block [0+0+0 0 0+0+0] [0+0+0 0 0+0+0] [BFC] children: inline
    InlineNode <(anonymous)>
      TextNode <#text>

67587.133 WebContent(52198): FIXME: InlineFormattingContext::dimension_box_on_line got unexpected box in inline context:
67587.133 WebContent(52198): Label <label.wmu-add> (not painted) [0+0+0 0 0+0+0] [0+0+0 0 0+0+0] children: inline
  BlockContainer <i.far.fa-image> (not painted) inline-block [0+0+0 0 0+0+0] [0+0+0 0 0+0+0] [BFC] children: inline
    InlineNode <(anonymous)>
      TextNode <#text>

67587.133 WebContent(52198): FIXME: InlineFormattingContext::dimension_box_on_line got unexpected box in inline context:
67587.133 WebContent(52198): Label <label.wmu-add> (not painted) [0+0+0 0 0+0+0] [0+0+0 0 0+0+0] children: inline
  BlockContainer <i.far.fa-image> (not painted) inline-block [0+0+0 0 0+0+0] [0+0+0 0 0+0+0] [BFC] children: inline
    InlineNode <(anonymous)>
      TextNode <#text>

VERIFICATION FAILED: i < m_size at /Users/james/ladybird/AK/Vector.h:139
0   liblagom-ak.0.0.0.dylib             0x0000000104f1b9b0 ak_trap + 56
1   liblagom-ak.0.0.0.dylib             0x0000000104f1bcc4 ak_assertion_failed + 0
2   liblagom-web.0.0.0.dylib            0x000000010691e1cc Web::Layout::LayoutState::commit(Web::Layout::Box&) + 4644
3   liblagom-web.0.0.0.dylib            0x000000010667da88 Web::DOM::Document::update_layout() + 528
4   liblagom-web.0.0.0.dylib            0x000000010660ad84 Web::CSS::ResolvedCSSStyleDeclaration::property(Web::CSS::PropertyID) const + 132
5   liblagom-web.0.0.0.dylib            0x000000010656cec8 Web::CSS::CSSStyleDeclaration::get_property_value(AK::StringView) const + 868
6   liblagom-web.0.0.0.dylib            0x0000000106ca48e0 Web::Bindings::CSSStyleDeclarationPrototype::get_property_value(JS::VM&) + 244
7   liblagom-js.0.0.0.dylib             0x0000000105094ebc AK::Function<JS::ThrowCompletionOr<void> (JS::Declaration const&)>::operator()(JS::Declaration const&) const + 80
8   liblagom-js.0.0.0.dylib             0x000000010525a7e4 JS::NativeFunction::internal_call(JS::Value, AK::Span<JS::Value const>) + 388
9   liblagom-js.0.0.0.dylib             0x00000001050ddb80 JS::Bytecode::Interpreter::run_bytecode(unsigned long) + 8820
10  liblagom-js.0.0.0.dylib             0x00000001050db634 JS::Bytecode::Interpreter::run_executable(JS::Bytecode::Executable&, AK::Optional<unsigned long>, JS::Value) + 408
11  liblagom-js.0.0.0.dylib             0x00000001051d8c1c JS::ECMAScriptFunctionObject::ordinary_call_evaluate_body() + 420
12  liblagom-js.0.0.0.dylib             0x00000001051d8360 JS::ECMAScriptFunctionObject::internal_call(JS::Value, AK::Span<JS::Value const>) + 328
13  liblagom-js.0.0.0.dylib             0x00000001050ddb80 JS::Bytecode::Interpreter::run_bytecode(unsigned long) + 8820
14  liblagom-js.0.0.0.dylib             0x00000001050db634 JS::Bytecode::Interpreter::run_executable(JS::Bytecode::Executable&, AK::Optional<unsigned long>, JS::Value) + 408
15  liblagom-js.0.0.0.dylib             0x00000001051d8c1c JS::ECMAScriptFunctionObject::ordinary_call_evaluate_body() + 420
16  liblagom-js.0.0.0.dylib             0x00000001051d8360 JS::ECMAScriptFunctionObject::internal_call(JS::Value, AK::Span<JS::Value const>) + 328
17  liblagom-js.0.0.0.dylib             0x00000001050ddb80 JS::Bytecode::Interpreter::run_bytecode(unsigned long) + 8820
18  liblagom-js.0.0.0.dylib             0x00000001050db634 JS::Bytecode::Interpreter::run_executable(JS::Bytecode::Executable&, AK::Optional<unsigned long>, JS::Value) + 408
19  liblagom-js.0.0.0.dylib             0x00000001051d8c1c JS::ECMAScriptFunctionObject::ordinary_call_evaluate_body() + 420
20  liblagom-js.0.0.0.dylib             0x00000001051d8360 JS::ECMAScriptFunctionObject::internal_call(JS::Value, AK::Span<JS::Value const>) + 328
21  liblagom-js.0.0.0.dylib             0x00000001050ddb80 JS::Bytecode::Interpreter::run_bytecode(unsigned long) + 8820
22  liblagom-js.0.0.0.dylib             0x00000001050db634 JS::Bytecode::Interpreter::run_executable(JS::Bytecode::Executable&, AK::Optional<unsigned long>, JS::Value) + 408
23  liblagom-js.0.0.0.dylib             0x00000001051d8c1c JS::ECMAScriptFunctionObject::ordinary_call_evaluate_body() + 420
24  liblagom-js.0.0.0.dylib             0x00000001051d8360 JS::ECMAScriptFunctionObject::internal_call(JS::Value, AK::Span<JS::Value const>) + 328
25  liblagom-js.0.0.0.dylib             0x00000001050ddb80 JS::Bytecode::Interpreter::run_bytecode(unsigned long) + 8820
26  liblagom-js.0.0.0.dylib             0x00000001050db634 JS::Bytecode::Interpreter::run_executable(JS::Bytecode::Executable&, AK::Optional<unsigned long>, JS::Value) + 408
27  liblagom-js.0.0.0.dylib             0x00000001051d8c1c JS::ECMAScriptFunctionObject::ordinary_call_evaluate_body() + 420
28  liblagom-js.0.0.0.dylib             0x00000001051d8360 JS::ECMAScriptFunctionObject::internal_call(JS::Value, AK::Span<JS::Value const>) + 328
29  liblagom-js.0.0.0.dylib             0x00000001050ddb80 JS::Bytecode::Interpreter::run_bytecode(unsigned long) + 8820
30  liblagom-js.0.0.0.dylib             0x00000001050db634 JS::Bytecode::Interpreter::run_executable(JS::Bytecode::Executable&, AK::Optional<unsigned long>, JS::Value) + 408
31  liblagom-js.0.0.0.dylib             0x00000001051d8c1c JS::ECMAScriptFunctionObject::ordinary_call_evaluate_body() + 420
32  liblagom-js.0.0.0.dylib             0x00000001051d8360 JS::ECMAScriptFunctionObject::internal_call(JS::Value, AK::Span<JS::Value const>) + 328
33  liblagom-js.0.0.0.dylib             0x00000001050ddb80 JS::Bytecode::Interpreter::run_bytecode(unsigned long) + 8820
34  liblagom-js.0.0.0.dylib             0x00000001050db634 JS::Bytecode::Interpreter::run_executable(JS::Bytecode::Executable&, AK::Optional<unsigned long>, JS::Value) + 408
35  liblagom-js.0.0.0.dylib             0x00000001051d8c1c JS::ECMAScriptFunctionObject::ordinary_call_evaluate_body() + 420
36  liblagom-js.0.0.0.dylib             0x00000001051d8360 JS::ECMAScriptFunctionObject::internal_call(JS::Value, AK::Span<JS::Value const>) + 328
37  liblagom-js.0.0.0.dylib             0x00000001050ddb80 JS::Bytecode::Interpreter::run_bytecode(unsigned long) + 8820
38  liblagom-js.0.0.0.dylib             0x00000001050db634 JS::Bytecode::Interpreter::run_executable(JS::Bytecode::Executable&, AK::Optional<unsigned long>, JS::Value) + 408
39  liblagom-js.0.0.0.dylib             0x00000001051d8c1c JS::ECMAScriptFunctionObject::ordinary_call_evaluate_body() + 420
40  liblagom-js.0.0.0.dylib             0x00000001051d8360 JS::ECMAScriptFunctionObject::internal_call(JS::Value, AK::Span<JS::Value const>) + 328
41  liblagom-js.0.0.0.dylib             0x00000001051ec498 JS::FunctionPrototype::apply(JS::VM&) + 600
42  liblagom-js.0.0.0.dylib             0x0000000105094ebc AK::Function<JS::ThrowCompletionOr<void> (JS::Declaration const&)>::operator()(JS::Declaration const&) const + 80
43  liblagom-js.0.0.0.dylib             0x000000010525a7e4 JS::NativeFunction::internal_call(JS::Value, AK::Span<JS::Value const>) + 388
44  liblagom-js.0.0.0.dylib             0x00000001050ddb80 JS::Bytecode::Interpreter::run_bytecode(unsigned long) + 8820
45  liblagom-js.0.0.0.dylib             0x00000001050db634 JS::Bytecode::Interpreter::run_executable(JS::Bytecode::Executable&, AK::Optional<unsigned long>, JS::Value) + 408
46  liblagom-js.0.0.0.dylib             0x00000001051d8c1c JS::ECMAScriptFunctionObject::ordinary_call_evaluate_body() + 420
47  liblagom-js.0.0.0.dylib             0x00000001051d8360 JS::ECMAScriptFunctionObject::internal_call(JS::Value, AK::Span<JS::Value const>) + 328
48  liblagom-js.0.0.0.dylib             0x00000001050ddb80 JS::Bytecode::Interpreter::run_bytecode(unsigned long) + 8820
49  liblagom-js.0.0.0.dylib             0x00000001050db634 JS::Bytecode::Interpreter::run_executable(JS::Bytecode::Executable&, AK::Optional<unsigned long>, JS::Value) + 408
50  liblagom-js.0.0.0.dylib             0x00000001051d8c1c JS::ECMAScriptFunctionObject::ordinary_call_evaluate_body() + 420
51  liblagom-js.0.0.0.dylib             0x00000001051d8360 JS::ECMAScriptFunctionObject::internal_call(JS::Value, AK::Span<JS::Value const>) + 328
52  liblagom-web.0.0.0.dylib            0x0000000106a505b4 Web::WebIDL::invoke_callback(Web::WebIDL::CallbackType&, AK::Optional<JS::Value>, GC::MarkedVector<JS::Value, 0ul>) + 212
53  liblagom-web.0.0.0.dylib            0x00000001068c17dc AK::Function<void ()>::CallableWrapper<Web::HTML::WindowOrWorkerGlobalScopeMixin::run_timer_initialization_steps(AK::Variant<GC::Ref<Web::WebIDL::CallbackType>, AK::String>, int, GC::MarkedVector<JS::Value, 0ul>, Web::HTML::WindowOrWorkerGlobalScopeMixin::Repeat, AK::Optional<int>)::$_0>::call() + 856
54  liblagom-web.0.0.0.dylib            0x00000001064b58c4 AK::Function<void (AK::Span<unsigned char>)>::operator()(AK::Span<unsigned char>) const + 76
55  liblagom-web.0.0.0.dylib            0x00000001068c1dd4 AK::Function<void ()>::CallableWrapper<Web::HTML::WindowOrWorkerGlobalScopeMixin::run_timer_initialization_steps(AK::Variant<GC::Ref<Web::WebIDL::CallbackType>, AK::String>, int, GC::MarkedVector<JS::Value, 0ul>, Web::HTML::WindowOrWorkerGlobalScopeMixin::Repeat, AK::Optional<int>)::$_1::operator()()::'lambda'()>::call() + 84
56  liblagom-web.0.0.0.dylib            0x00000001064b58c4 AK::Function<void (AK::Span<unsigned char>)>::operator()(AK::Span<unsigned char>) const + 76
57  liblagom-web.0.0.0.dylib            0x000000010678e7f4 Web::HTML::EventLoop::process() + 84
58  liblagom-web.0.0.0.dylib            0x00000001064b58c4 AK::Function<void (AK::Span<unsigned char>)>::operator()(AK::Span<unsigned char>) const + 76
59  liblagom-core.0.0.0.dylib           0x0000000104bfc450 AK::Function<void (AK::Error&)>::operator()(AK::Error&) const + 76
60  liblagom-core.0.0.0.dylib           0x0000000104bfb990 Core::EventReceiver::dispatch_event(Core::Event&, Core::EventReceiver*) + 112
61  liblagom-core.0.0.0.dylib           0x0000000104c0df1c Core::ThreadEventQueue::process() + 400
62  liblagom-core.0.0.0.dylib           0x0000000104bf9668 Core::EventLoop::spin_until(AK::Function<bool ()>) + 116
63  liblagom-web.0.0.0.dylib            0x00000001069a9f70 Web::Platform::EventLoopPluginSerenity::spin_until(GC::Root<GC::Function<bool ()>>) + 116
64  liblagom-web.0.0.0.dylib            0x000000010678e3b4 Web::HTML::EventLoop::spin_until(GC::Ref<GC::Function<bool ()>>) + 348
65  liblagom-web.0.0.0.dylib            0x00000001068a6e84 Web::HTML::TraversableNavigable::check_if_unloading_is_canceled(AK::Vector<GC::Root<Web::HTML::Navigable>, 0ul>, GC::Ptr<Web::HTML::TraversableNavigable>, AK::Optional<int>, AK::Optional<Web::HTML::UserNavigationInvolvement>) + 2128
66  liblagom-web.0.0.0.dylib            0x00000001068a7bc8 Web::HTML::TraversableNavigable::check_if_unloading_is_canceled(AK::Vector<GC::Root<Web::HTML::Navigable>, 0ul>) + 112
67  liblagom-web.0.0.0.dylib            0x000000010682fe0c AK::Function<void ()>::CallableWrapper<Web::HTML::Navigable::navigate(Web::HTML::Navigable::NavigateParams)::$_2>::call() + 168
68  liblagom-web.0.0.0.dylib            0x00000001064b58c4 AK::Function<void (AK::Span<unsigned char>)>::operator()(AK::Span<unsigned char>) const + 76
69  liblagom-core.0.0.0.dylib           0x0000000104bfc450 AK::Function<void (AK::Error&)>::operator()(AK::Error&) const + 76
70  liblagom-core.0.0.0.dylib           0x0000000104c0ded4 Core::ThreadEventQueue::process() + 328
71  liblagom-core.0.0.0.dylib           0x0000000104c101b4 Core::EventLoopImplementationUnix::exec() + 44
72  liblagom-core.0.0.0.dylib           0x0000000104bf9508 Core::EventLoop::exec() + 72
73  WebContent                          0x00000001046673e8 serenity_main(Main::Arguments) + 4064
74  WebContent                          0x00000001047035e4 main + 196
75  dyld                                0x000000018944c274 start + 2840
67587.154 Ladybird(52185): WebContent process crashed! Last page loaded: https://wpdiscuz.com/demo/

Screenshots or screen recordings

No response

Build flags or config settings

No response

Contribute a patch?

  • I’ll contribute a patch for this myself.
@Gingeh
Copy link
Contributor

Gingeh commented Dec 20, 2024

Reduction:

<style>
label {
  display: inline;
}
span {
  display: inline-block;
}
</style>

<label><span></span></label>

(the label can also be a legend, the span can be any element)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants