Browser Crashes when visiting supabase

[neil-ptr]

Description

The Ladybird browser crashes consistently when attempting to open the Supabase website. The crash occurs during layout tree creation, specifically in the CSS style properties handling code.

Steps to Reproduce:

1. Open Ladybird browser.
2. https://supabase.com/dashboard/projects
3. The browser crashes

Backtrace (lldb):

* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BREAKPOINT (code=1, subcode=0x10520af00)
  * frame #0: 0x000000010520af00 liblagom-ak.0.0.0.dylib`ak_verification_failed(message="false at /Users/neilviloria/personal/ladybird/master/Userland/Libraries/LibWeb/CSS/StyleProperties.cpp:151") at Assertions.cpp:102:5
    frame #1: 0x00000001085e6f7c liblagom-web.0.0.0.dylib`Web::CSS::StyleProperties::size_value(this=<unavailable>, id=<unavailable>) const at StyleProperties.cpp:151:13
    frame #2: 0x00000001088f1990 liblagom-web.0.0.0.dylib`Web::Layout::NodeWithStyle::apply_style(this=0x000000016133b840, computed_style=<unavailable>) at Node.cpp:697:47
    frame #3: 0x00000001088ee47c liblagom-web.0.0.0.dylib`Web::Layout::NodeWithStyle::NodeWithStyle(this=0x000000016133b840, document=<unavailable>, node=<unavailable>, computed_style=NonnullRefPtr<Web::CSS::StyleProperties> @ 0x000000016ba10960) at Node.cpp:281:5
    frame #4: 0x00000001088b08b8 liblagom-web.0.0.0.dylib`Web::Layout::Box::Box(Web::DOM::Document&, Web::DOM::Node*, AK::NonnullRefPtr<Web::CSS::StyleProperties>) [inlined] Web::Layout::NodeWithStyleAndBoxModelMetrics::NodeWithStyleAndBoxModelMetrics(this=0x000000016133b840, document=<unavailable>, node=<unavailable>, style=<unavailable>) at Node.h:247:11
    frame #5: 0x00000001088b08ac liblagom-web.0.0.0.dylib`Web::Layout::Box::Box(this=0x000000016133b840, document=<unavailable>, node=<unavailable>, style=<unavailable>) at Box.cpp:18:7
    frame #6: 0x00000001088a4a88 liblagom-web.0.0.0.dylib`Web::Layout::BlockContainer::BlockContainer(Web::DOM::Document&, Web::DOM::Node*, AK::NonnullRefPtr<Web::CSS::StyleProperties>) [inlined] Web::Layout::BlockContainer::BlockContainer(this=<unavailable>, document=<unavailable>, node=<unavailable>, style=<unavailable>) at BlockContainer.cpp:13:7
    frame #7: 0x00000001088a4a6c liblagom-web.0.0.0.dylib`Web::Layout::BlockContainer::BlockContainer(this=0x000000016133b840, document=<unavailable>, node=<unavailable>, style=<unavailable>) at BlockContainer.cpp:14:1
    frame #8: 0x000000010865ead8 liblagom-web.0.0.0.dylib`JS::NonnullGCPtr<Web::Layout::BlockContainer> JS::Heap::allocate_without_realm<Web::Layout::BlockContainer, Web::DOM::Document&, Web::DOM::Element*&, AK::NonnullRefPtr<Web::CSS::StyleProperties>>(this=0x0000000130851578, args=0x000000016037cd70, args=0x000000016ba10a30, args=0x000000016ba10a60) at Heap.h:44:22
...

Notes

Snooping around it seems like in Userland/Libraries/LibWeb/CSS/StyleProperties.cpp the dbgln I've added prints out height inherit

CSS::Size StyleProperties::size_value(CSS::PropertyID id) const
{
    auto value = property(id);
    if (value->is_keyword()) {
        dbgln("{} {}", string_from_property_id(id), value->to_string());
        switch (value->to_keyword()) {
        case Keyword::Auto:
            return CSS::Size::make_auto();
        case Keyword::MinContent:
            return CSS::Size::make_min_content();
        case Keyword::MaxContent:
            return CSS::Size::make_max_content();
        case Keyword::FitContent:
            return CSS::Size::make_fit_content();
        case Keyword::None:
            return CSS::Size::make_none();
        default:
            // we reached this :(
            VERIFY_NOT_REACHED();
        }
    }