Fix paragraph layouting index out of bounds bug (#3607)

3 files changed, 22 insertions, 9 deletions

diff --git a/crates/typst/src/layout/flow.rs b/crates/typst/src/layout/flow.rs
index bd693bd8..85f67142 100644
--- a/crates/typst/src/layout/flow.rs
+++ b/crates/typst/src/layout/flow.rs
@@ -244,17 +244,17 @@ impl<'a> FlowLayouter<'a> {
             )?
             .into_frames();
 
-        let mut sticky = self.items.len();
-        for (i, item) in self.items.iter().enumerate().rev() {
-            match *item {
-                FlowItem::Absolute(_, _) => {}
-                FlowItem::Frame { sticky: true, .. } => sticky = i,
-                _ => break,
-            }
-        }
-
         if let Some(first) = lines.first() {
             while !self.regions.size.y.fits(first.height()) && !self.regions.in_last() {
+                let mut sticky = self.items.len();
+                for (i, item) in self.items.iter().enumerate().rev() {
+                    match *item {
+                        FlowItem::Absolute(_, _) => {}
+                        FlowItem::Frame { sticky: true, .. } => sticky = i,
+                        _ => break,
+                    }
+                }
+
                 let carry: Vec<_> = self.items.drain(sticky..).collect();
                 self.finish_region(engine, false)?;
                 for item in carry {
diff --git a/tests/ref/bugs/flow-5.png b/tests/ref/bugs/flow-5.png
new file mode 100644
index 00000000..648c8c44
--- /dev/null
+++ b/tests/ref/bugs/flow-5.png
diff --git a/tests/typ/bugs/flow-5.typ b/tests/typ/bugs/flow-5.typ
new file mode 100644
index 00000000..5e580b9e
--- /dev/null
+++ b/tests/typ/bugs/flow-5.typ
@@ -0,0 +1,13 @@
+// This bug caused an index-out-of-bounds panic when layouting paragraphs needed
+// multiple reorderings.
+
+---
+#set page(height: 200pt)
+#lorem(30)
+
+#figure(placement: auto, block(height: 100%))
+
+#lorem(10)
+
+#lorem(10)
+