- Revision
- 285801
- Author
- [email protected]
- Date
- 2021-11-15 03:12:32 -0800 (Mon, 15 Nov 2021)
Log Message
Stack overflow with revert-layer
https://bugs.webkit.org/show_bug.cgi?id=233119
rdar://85342210
Reviewed by Antoine Quint.
Source/WebCore:
We would decrement the cascade layer priority by one after finding 'revert-layer' value and then try
to apply again. If both the default layer and a cascade layer contained 'revert-layer' we would
enter a very deep recursion as the default layer priority is 64k and the cascade layer priorities
start from zero.
Test: fast/css/revert-layer-stack-overflow-2.html
* style/StyleBuilder.cpp:
(WebCore::Style::Builder::applyRollbackCascadeProperty):
Fix by getting the new cascade layer priority from the actual property rather than the cascade
minimum value.
Factor into a function.
(WebCore::Style::Builder::applyProperty):
* style/StyleBuilder.h:
LayoutTests:
* fast/css/revert-layer-stack-overflow-2-expected.txt: Added.
* fast/css/revert-layer-stack-overflow-2.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (285800 => 285801)
--- trunk/LayoutTests/ChangeLog 2021-11-15 08:42:39 UTC (rev 285800)
+++ trunk/LayoutTests/ChangeLog 2021-11-15 11:12:32 UTC (rev 285801)
@@ -1,3 +1,14 @@
+2021-11-15 Antti Koivisto <[email protected]>
+
+ Stack overflow with revert-layer
+ https://bugs.webkit.org/show_bug.cgi?id=233119
+ rdar://85342210
+
+ Reviewed by Antoine Quint.
+
+ * fast/css/revert-layer-stack-overflow-2-expected.txt: Added.
+ * fast/css/revert-layer-stack-overflow-2.html: Added.
+
2021-11-14 Simon Fraser <[email protected]>
Fingers down on the trackpad should stop an animated scroll
Added: trunk/LayoutTests/fast/css/revert-layer-stack-overflow-2-expected.txt (0 => 285801)
--- trunk/LayoutTests/fast/css/revert-layer-stack-overflow-2-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/css/revert-layer-stack-overflow-2-expected.txt 2021-11-15 11:12:32 UTC (rev 285801)
@@ -0,0 +1 @@
+This test passes if it doesn't crash
Added: trunk/LayoutTests/fast/css/revert-layer-stack-overflow-2.html (0 => 285801)
--- trunk/LayoutTests/fast/css/revert-layer-stack-overflow-2.html (rev 0)
+++ trunk/LayoutTests/fast/css/revert-layer-stack-overflow-2.html 2021-11-15 11:12:32 UTC (rev 285801)
@@ -0,0 +1,11 @@
+<style>
+@layer l0 {
+ div { color: revert-layer; }
+}
+div { color: revert-layer }
+</style>
+<div>This test passes if it doesn't crash</div>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+</script>
Modified: trunk/Source/WebCore/ChangeLog (285800 => 285801)
--- trunk/Source/WebCore/ChangeLog 2021-11-15 08:42:39 UTC (rev 285800)
+++ trunk/Source/WebCore/ChangeLog 2021-11-15 11:12:32 UTC (rev 285801)
@@ -1,3 +1,29 @@
+2021-11-15 Antti Koivisto <[email protected]>
+
+ Stack overflow with revert-layer
+ https://bugs.webkit.org/show_bug.cgi?id=233119
+ rdar://85342210
+
+ Reviewed by Antoine Quint.
+
+ We would decrement the cascade layer priority by one after finding 'revert-layer' value and then try
+ to apply again. If both the default layer and a cascade layer contained 'revert-layer' we would
+ enter a very deep recursion as the default layer priority is 64k and the cascade layer priorities
+ start from zero.
+
+ Test: fast/css/revert-layer-stack-overflow-2.html
+
+ * style/StyleBuilder.cpp:
+ (WebCore::Style::Builder::applyRollbackCascadeProperty):
+
+ Fix by getting the new cascade layer priority from the actual property rather than the cascade
+ minimum value.
+
+ Factor into a function.
+
+ (WebCore::Style::Builder::applyProperty):
+ * style/StyleBuilder.h:
+
2021-11-15 Patrick Griffis <[email protected]>
CSP: Fix missing lineNumber and columnNumber in inline violation reports
Modified: trunk/Source/WebCore/style/StyleBuilder.cpp (285800 => 285801)
--- trunk/Source/WebCore/style/StyleBuilder.cpp 2021-11-15 08:42:39 UTC (rev 285800)
+++ trunk/Source/WebCore/style/StyleBuilder.cpp 2021-11-15 11:12:32 UTC (rev 285801)
@@ -255,6 +255,19 @@
m_state.m_linkMatch = SelectorChecker::MatchDefault;
}
+void Builder::applyRollbackCascadeProperty(const PropertyCascade::Property& property, SelectorChecker::LinkMatchMask linkMatchMask)
+{
+ auto* value = property.cssValue[linkMatchMask];
+ if (!value)
+ return;
+
+ SetForScope levelScope(m_state.m_cascadeLevel, property.level);
+ SetForScope scopeScope(m_state.m_styleScopeOrdinal, property.styleScopeOrdinal);
+ SetForScope layerScope(m_state.m_cascadeLayerPriority, property.cascadeLayerPriority);
+
+ applyProperty(property.id, *value, linkMatchMask);
+}
+
void Builder::applyProperty(CSSPropertyID id, CSSValue& value, SelectorChecker::LinkMatchMask linkMatchMask)
{
ASSERT_WITH_MESSAGE(!isShorthandCSSProperty(id), "Shorthand property id = %d wasn't expanded at parsing time", id);
@@ -296,19 +309,15 @@
if (rollbackCascade) {
// With the rollback cascade built, we need to obtain the property and apply it. If the property is
// not present, then we behave like "unset." Otherwise we apply the property instead of our own.
- SetForScope cascadeLevelScope(m_state.m_cascadeLevel, rollbackCascade->maximumCascadeLevel());
- SetForScope cascadeLayerPriorityScope(m_state.m_cascadeLayerPriority, rollbackCascade->maximumCascadeLayerPriority());
if (customPropertyValue) {
if (customPropertyRegistered && customPropertyRegistered->inherits && rollbackCascade->hasCustomProperty(customPropertyValue->name())) {
auto property = rollbackCascade->customProperty(customPropertyValue->name());
- if (property.cssValue[linkMatchMask])
- applyProperty(property.id, *property.cssValue[linkMatchMask], linkMatchMask);
+ applyRollbackCascadeProperty(property, linkMatchMask);
return;
}
} else if (rollbackCascade->hasProperty(id)) {
auto& property = rollbackCascade->property(id);
- if (property.cssValue[linkMatchMask])
- applyProperty(property.id, *property.cssValue[linkMatchMask], linkMatchMask);
+ applyRollbackCascadeProperty(property, linkMatchMask);
return;
}
}
Modified: trunk/Source/WebCore/style/StyleBuilder.h (285800 => 285801)
--- trunk/Source/WebCore/style/StyleBuilder.h 2021-11-15 08:42:39 UTC (rev 285800)
+++ trunk/Source/WebCore/style/StyleBuilder.h 2021-11-15 11:12:32 UTC (rev 285801)
@@ -56,6 +56,7 @@
template<CustomPropertyCycleTracking trackCycles>
void applyPropertiesImpl(int firstProperty, int lastProperty);
void applyCascadeProperty(const PropertyCascade::Property&);
+ void applyRollbackCascadeProperty(const PropertyCascade::Property&, SelectorChecker::LinkMatchMask);
void applyProperty(CSSPropertyID, CSSValue&, SelectorChecker::LinkMatchMask);
Ref<CSSValue> resolveValue(CSSPropertyID, CSSValue&);
