Title: [285713] trunk
- Revision
- 285713
- Author
- [email protected]
- Date
- 2021-11-12 04:28:01 -0800 (Fri, 12 Nov 2021)
Log Message
Stack overflow with revert and revert-layer
https://bugs.webkit.org/show_bug.cgi?id=233033
rdar://85336439
Reviewed by Antoine Quint.
Source/WebCore:
Test: fast/css/revert-layer-stack-overflow.html
We end up using a rollback cascade made for revert-layer to do revert and that leads to eternal recursion.
* style/StyleBuilder.cpp:
(WebCore::Style::Builder::ensureRollbackCascadeForRevert):
(WebCore::Style::Builder::ensureRollbackCascadeForRevertLayer):
Key the rollback cascade map with the reverted values instead of the original ones since the same
original keys produce different rollbacks depending on whether it is made for revert or revert-layer.
LayoutTests:
* fast/css/revert-layer-stack-overflow-expected.txt: Added.
* fast/css/revert-layer-stack-overflow.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (285712 => 285713)
--- trunk/LayoutTests/ChangeLog 2021-11-12 11:43:26 UTC (rev 285712)
+++ trunk/LayoutTests/ChangeLog 2021-11-12 12:28:01 UTC (rev 285713)
@@ -1,5 +1,16 @@
2021-11-12 Antti Koivisto <[email protected]>
+ Stack overflow with revert and revert-layer
+ https://bugs.webkit.org/show_bug.cgi?id=233033
+ rdar://85336439
+
+ Reviewed by Antoine Quint.
+
+ * fast/css/revert-layer-stack-overflow-expected.txt: Added.
+ * fast/css/revert-layer-stack-overflow.html: Added.
+
+2021-11-12 Antti Koivisto <[email protected]>
+
REGRESSION(r285624) Using revert keyword with a css variable hits assert
https://bugs.webkit.org/show_bug.cgi?id=233031
rdar://85332271
Added: trunk/LayoutTests/fast/css/revert-layer-stack-overflow-expected.txt (0 => 285713)
--- trunk/LayoutTests/fast/css/revert-layer-stack-overflow-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/css/revert-layer-stack-overflow-expected.txt 2021-11-12 12:28:01 UTC (rev 285713)
@@ -0,0 +1 @@
+This test passes if it doesn't crash.
Added: trunk/LayoutTests/fast/css/revert-layer-stack-overflow.html (0 => 285713)
--- trunk/LayoutTests/fast/css/revert-layer-stack-overflow.html (rev 0)
+++ trunk/LayoutTests/fast/css/revert-layer-stack-overflow.html 2021-11-12 12:28:01 UTC (rev 285713)
@@ -0,0 +1,15 @@
+<style>
+ @layer l0 {
+ html {
+ width: revert;
+ }
+ }
+ html {
+ height: revert-layer;
+ }
+</style>
+This test passes if it doesn't crash.
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+</script>
Modified: trunk/Source/WebCore/ChangeLog (285712 => 285713)
--- trunk/Source/WebCore/ChangeLog 2021-11-12 11:43:26 UTC (rev 285712)
+++ trunk/Source/WebCore/ChangeLog 2021-11-12 12:28:01 UTC (rev 285713)
@@ -1,5 +1,24 @@
2021-11-12 Antti Koivisto <[email protected]>
+ Stack overflow with revert and revert-layer
+ https://bugs.webkit.org/show_bug.cgi?id=233033
+ rdar://85336439
+
+ Reviewed by Antoine Quint.
+
+ Test: fast/css/revert-layer-stack-overflow.html
+
+ We end up using a rollback cascade made for revert-layer to do revert and that leads to eternal recursion.
+
+ * style/StyleBuilder.cpp:
+ (WebCore::Style::Builder::ensureRollbackCascadeForRevert):
+ (WebCore::Style::Builder::ensureRollbackCascadeForRevertLayer):
+
+ Key the rollback cascade map with the reverted values instead of the original ones since the same
+ original keys produce different rollbacks depending on whether it is made for revert or revert-layer.
+
+2021-11-12 Antti Koivisto <[email protected]>
+
REGRESSION(r285624) Using revert keyword with a css variable hits assert
https://bugs.webkit.org/show_bug.cgi?id=233031
rdar://85332271
Modified: trunk/Source/WebCore/style/StyleBuilder.cpp (285712 => 285713)
--- trunk/Source/WebCore/style/StyleBuilder.cpp 2021-11-12 11:43:26 UTC (rev 285712)
+++ trunk/Source/WebCore/style/StyleBuilder.cpp 2021-11-12 12:28:01 UTC (rev 285713)
@@ -375,9 +375,11 @@
if (rollbackCascadeLevel == CascadeLevel::UserAgent)
return nullptr;
+ --rollbackCascadeLevel;
+
auto key = makeRollbackCascadeKey(rollbackCascadeLevel, RuleSet::cascadeLayerPriorityForUnlayered);
return m_rollbackCascades.ensure(key, [&] {
- return makeUnique<const PropertyCascade>(m_cascade, --rollbackCascadeLevel, RuleSet::cascadeLayerPriorityForUnlayered);
+ return makeUnique<const PropertyCascade>(m_cascade, rollbackCascadeLevel, RuleSet::cascadeLayerPriorityForUnlayered);
}).iterator->value.get();
}
@@ -386,9 +388,11 @@
if (!rollbackLayerPriority)
return nullptr;
+ --rollbackLayerPriority;
+
auto key = makeRollbackCascadeKey(cascadeLevel, rollbackLayerPriority);
return m_rollbackCascades.ensure(key, [&] {
- return makeUnique<const PropertyCascade>(m_cascade, cascadeLevel, rollbackLayerPriority - 1);
+ return makeUnique<const PropertyCascade>(m_cascade, cascadeLevel, rollbackLayerPriority);
}).iterator->value.get();
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
