diff --git a/Libraries/LibWeb/HTML/HTMLInputElement.cpp b/Libraries/LibWeb/HTML/HTMLInputElement.cpp
index 1d62320c1b98c..cb65d1ca3cc98 100644
--- a/Libraries/LibWeb/HTML/HTMLInputElement.cpp
+++ b/Libraries/LibWeb/HTML/HTMLInputElement.cpp
@@ -1684,10 +1684,8 @@ void HTMLInputElement::form_associated_element_attribute_changed(Utf16FlyString
} else if (name == HTML::AttributeNames::size) {
// size feeds the element's default preferred width, which reaches layout only
// through the replaced-content facts; nothing else schedules a relayout.
- if (old_value != value) {
- if (auto* layout_node = this->layout_node())
- layout_node->set_needs_layout_update(DOM::SetNeedsLayoutReason::DefaultPreferredSizeAttributeChange);
- }
+ if (old_value != value)
+ set_needs_layout_update(DOM::SetNeedsLayoutReason::DefaultPreferredSizeAttributeChange);
}
// AD-HOC: A change to any of these attributes can change whether the element satisfies its constraints, and
diff --git a/Libraries/LibWeb/HTML/HTMLTextAreaElement.cpp b/Libraries/LibWeb/HTML/HTMLTextAreaElement.cpp
index c5fa99a8d774d..834bc0f30bcc8 100644
--- a/Libraries/LibWeb/HTML/HTMLTextAreaElement.cpp
+++ b/Libraries/LibWeb/HTML/HTMLTextAreaElement.cpp
@@ -463,10 +463,8 @@ void HTMLTextAreaElement::form_associated_element_attribute_changed(Utf16FlyStri
} else if (first_is_one_of(name, HTML::AttributeNames::rows, HTML::AttributeNames::cols)) {
// rows and cols feed the element's default preferred size, which reaches layout
// only through the replaced-content facts; nothing else schedules a relayout.
- if (old_value != value) {
- if (auto* layout_node = this->layout_node())
- layout_node->set_needs_layout_update(DOM::SetNeedsLayoutReason::DefaultPreferredSizeAttributeChange);
- }
+ if (old_value != value)
+ set_needs_layout_update(DOM::SetNeedsLayoutReason::DefaultPreferredSizeAttributeChange);
}
// AD-HOC: A change to any of these attributes can change whether the element satisfies its constraints, and
diff --git a/Tests/LibWeb/Crash/Layout/input-size-attribute-with-stale-layout.html b/Tests/LibWeb/Crash/Layout/input-size-attribute-with-stale-layout.html
new file mode 100644
index 0000000000000..334d923673be3
--- /dev/null
+++ b/Tests/LibWeb/Crash/Layout/input-size-attribute-with-stale-layout.html
@@ -0,0 +1,7 @@
+
+
+
diff --git a/Tests/LibWeb/Crash/Layout/textarea-cols-attribute-with-stale-layout.html b/Tests/LibWeb/Crash/Layout/textarea-cols-attribute-with-stale-layout.html
new file mode 100644
index 0000000000000..25667135d7f7a
--- /dev/null
+++ b/Tests/LibWeb/Crash/Layout/textarea-cols-attribute-with-stale-layout.html
@@ -0,0 +1,7 @@
+
+
+