LibWeb: Skip fragments of removed boxes when mapping text offsets

[tcl3]

Removing an in-flow atomic inline from an inline run detaches its layout subtree immediately. The containing block keeps its fragment list until its next layout, leaving the removed box's fragment with no layout node. Selection updates iterate these fragments before layout runs and crashed on the dead reference. Skip fragments without a layout node. They cannot match any live text node.

Fixes a regression introduced at 351d601 (#11126).

Found with domato, where this crash was present in 19 / 1000 cases.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 7049abdd-6984-4b33-8247-60941d898332

📥 Commits

Reviewing files that changed from the base of the PR and between cdfe5f8 and 66a5d47.

📒 Files selected for processing (2)

• Libraries/LibWeb/Layout/TextOffsetMapping.h
• Tests/LibWeb/Crash/Selection/set-base-and-extent-after-inline-block-sibling-removed.html

---

📝 Walkthrough

Walkthrough

TextOffsetMapping now skips paintable fragments without an associated layout node in both const and non-const traversal paths. A regression test forces layout, removes an inline-block sibling, and sets a selection range in the remaining text node.

Possibly related PRs

• LadybirdBrowser/ladybird#10753: Relates to TextOffsetMapping traversal and selection behavior after inline-block removal.
• LadybirdBrowser/ladybird#10952: Relates to handling paintable fragments without associated layout nodes.

Merge Risk: ⚪ Minimal · up to 66a5d

This localized change skips detached layout fragments during text-offset mapping and adds a focused regression test; no actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description directly explains the fragment-handling change, the crash scenario, the regression, and the added regression test.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}