Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 44ba2b5c111ec26ba583c657cb32bfc9f7f01084
https://github.com/WebKit/WebKit/commit/44ba2b5c111ec26ba583c657cb32bfc9f7f01084
Author: Chris Dumez <[email protected]>
Date: 2026-06-21 (Sun, 21 Jun 2026)
Changed paths:
A
LayoutTests/imported/w3c/web-platform-tests/css/cssom/insertRule-namespace-after-import-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/css/cssom/insertRule-namespace-after-import.html
M Source/WebCore/css/StyleSheetContents.cpp
Log Message:
-----------
Script-triggerable crash inserting an @namespace rule after an @import rule
via CSSOM
https://bugs.webkit.org/show_bug.cgi?id=317517
Reviewed by Anne van Kesteren.
StyleSheetContents::wrapperInsertRule() converts the caller-supplied
global rule index into a vector-local index (childVectorIndex) by
successively subtracting the sizes of m_layerRulesBeforeImportRules and
m_importRules. Every branch inserts using this adjusted local index --
except the @namespace branch, which used the original, unadjusted index:
```
m_namespaceRules.insert(index, *namespaceRule);
```
When the sheet already contains one or more @import rules, the global
index is strictly greater than the namespace-vector-local index, so
`index` can exceed m_namespaceRules.size(). That out-of-bounds position
is passed to Vector::insert(), whose mutableSpan().subspan(position) trips
libc++ hardening (_LIBCPP_HARDENING_MODE_EXTENSIVE) and aborts the
process before any write occurs.
This is reachable from script: CSSStyleSheet::insertRule() only rejects
index > length(), then forwards the index to wrapperInsertRule(). For a
sheet such as `@import url(x);`, calling
`insertRule('@namespace foo url(y);', 1)` reaches the @namespace branch
with `childVectorIndex == 0` but calls `m_namespaceRules.insert(1, ...)`
on an empty vector, crashing the process.
Fixed by inserting at childVectorIndex, matching every other branch in
the function (and wrapperDeleteRule).
Test:
imported/w3c/web-platform-tests/css/cssom/insertRule-namespace-after-import.html
*
LayoutTests/imported/w3c/web-platform-tests/css/cssom/insertRule-namespace-after-import-expected.txt:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/css/cssom/insertRule-namespace-after-import.html:
Added.
* Source/WebCore/css/StyleSheetContents.cpp:
(WebCore::StyleSheetContents::wrapperInsertRule):
Canonical link: https://commits.webkit.org/315573@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
