Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 3801ac23e1641d048c562f1392e861563da9ff87
      
https://github.com/WebKit/WebKit/commit/3801ac23e1641d048c562f1392e861563da9ff87
  Author: Chris Dumez <[email protected]>
  Date:   2026-07-29 (Wed, 29 Jul 2026)

  Changed paths:
    A 
LayoutTests/fast/css/webkit-border-image-width-length-serialization-expected.txt
    A LayoutTests/fast/css/webkit-border-image-width-length-serialization.html
    M Source/WebCore/css/parser/CSSPropertyParserConsumer+Background.cpp

  Log Message:
  -----------
  REGRESSION(313588@main): -webkit-border-image width flag is lost when a 
length edge precedes a non-length edge
https://bugs.webkit.org/show_bug.cgi?id=320545

Reviewed by Sam Weinig and Darin Adler.

The -webkit-border-image legacy behavior treats a border-image-width whose value
contains a fixed <length> as also overriding the element's border widths. The
parser records this in the "hasLength" flag, which must be true if ANY of the
up-to-four width edges is a length.

313588@main refactored consumeUnresolvedBorderImageWidth() and, in the process,
silently changed how "hasLength" is accumulated:
```
      Before: if (numericValue->isLength())
                  hasLength = true;          // monotonic latch
      After:  hasLength = WTF::switchOn(...) // last-write-wins overwrite
```
With the overwrite, "hasLength" ends up reflecting only the last
length-percentage edge instead of whether any edge is a length. For a width such
as `10px 5%`, the length edge (10px) sets it true, then the percentage edge (5%)
overwrites it back to false.

This corrupts the stored legacyWebkitBorderImage flag, which two independent
consumers (ShorthandSerializer and the style extractor) recompute as
anyOf(isLength) and compare against. On mismatch they bail out, so
`-webkit-border-image: url(...) 10 / 10px 5%` fails to serialize (returns the
empty string) via getComputedStyle / cssText, and the legacy border-width
override is dropped at paint time. The result is order-dependent: `5% 10px`
round-trips but `10px 5%` does not.

Restore the original monotonic-latch semantics by OR-accumulating the flag
across edges.

Test: fast/css/webkit-border-image-width-length-serialization.html

* Source/WebCore/css/parser/CSSPropertyParserConsumer+Background.cpp:
(WebCore::CSSPropertyParserHelpers::consumeUnresolvedBorderImageWidth):
* 
LayoutTests/fast/css/webkit-border-image-width-length-serialization-expected.txt:
 Added.
* LayoutTests/fast/css/webkit-border-image-width-length-serialization.html: 
Added.

Canonical link: https://commits.webkit.org/318214@main



To unsubscribe from these emails, change your notification settings at 
https://github.com/WebKit/WebKit/settings/notifications

Reply via email to