Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 8ce7ca092057b07052d0c88e5e3e940970cc75d3
https://github.com/WebKit/WebKit/commit/8ce7ca092057b07052d0c88e5e3e940970cc75d3
Author: Antti Koivisto <[email protected]>
Date: 2026-08-10 (Mon, 10 Aug 2026)
Changed paths:
A LayoutTests/fast/css/css-typed-om/var-name-argument-unparsed-expected.txt
A LayoutTests/fast/css/css-typed-om/var-name-argument-unparsed.html
A
LayoutTests/fast/css/variables/env/env-name-argument-not-substituted-expected.txt
A LayoutTests/fast/css/variables/env/env-name-argument-not-substituted.html
M
LayoutTests/imported/w3c/web-platform-tests/css/css-variables/var-ident-function-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/css/css-variables/var-parsing-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/css/css-variables/var-parsing.html
M
LayoutTests/imported/w3c/web-platform-tests/css/css-variables/variable-declaration-29.html
A
LayoutTests/imported/w3c/web-platform-tests/css/css-variables/variable-reference-name-substitution-attr-taint-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/css/css-variables/variable-reference-name-substitution-attr-taint.html
A
LayoutTests/imported/w3c/web-platform-tests/css/css-variables/variable-reference-name-substitution-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/css/css-variables/variable-reference-name-substitution.html
M
LayoutTests/imported/w3c/web-platform-tests/css/css-variables/variable-reference.html
M
LayoutTests/imported/w3c/web-platform-tests/css/css-variables/variable-supports-30.html
M
LayoutTests/imported/w3c/web-platform-tests/css/css-variables/variable-supports-64.html
M Source/WebCore/css/CSSSubstitutionValue.cpp
M Source/WebCore/css/parser/CSSSubstitutionParser.cpp
M Source/WebCore/css/query/ContainerQuery.cpp
M Source/WebCore/css/typedom/CSSUnparsedValue.cpp
M Source/WebCore/style/StyleSubstitutionResolver.cpp
M Source/WebCore/style/StyleSubstitutionResolver.h
Log Message:
-----------
[css-variables-2] var() should be an arbitrary substitution function
https://bugs.webkit.org/show_bug.cgi?id=320896
rdar://183913427
Reviewed by Sam Weinig.
var() function is an arbitrary substitution function, and its argument grammar
is:
<var-args> = var( <declaration-value> , <declaration-value>? )
https://drafts.csswg.org/css-variables-2/#using-variables
This moves the argument validation to computed-value time and allows using
other substitution functions
inside var() (assuming there was ident() implementation):
color: var(ident(--foo-color- attr(bar-attr)))
Tests: fast/css/css-typed-om/var-name-argument-unparsed.html
fast/css/variables/env/env-name-argument-not-substituted.html
imported/w3c/web-platform-tests/css/css-variables/variable-reference-name-substitution-attr-taint.html
imported/w3c/web-platform-tests/css/css-variables/variable-reference-name-substitution.html
* LayoutTests/fast/css/css-typed-om/var-name-argument-unparsed-expected.txt:
Added.
* LayoutTests/fast/css/css-typed-om/var-name-argument-unparsed.html: Added.
A var() that no longer has a name to reify must round-trip as text through
Typed OM.
*
LayoutTests/fast/css/variables/env/env-name-argument-not-substituted-expected.txt:
Added.
* LayoutTests/fast/css/variables/env/env-name-argument-not-substituted.html:
Added.
Covers the env() limitation. Not in the imported tree, since the spec allows
what this asserts is invalid.
*
LayoutTests/imported/w3c/web-platform-tests/css/css-variables/var-ident-function-expected.txt:
Fallback subtests pass now that a bad substituted name triggers the fallback.
*
LayoutTests/imported/w3c/web-platform-tests/css/css-variables/var-parsing-expected.txt:
*
LayoutTests/imported/w3c/web-platform-tests/css/css-variables/var-parsing.html:
*
LayoutTests/imported/w3c/web-platform-tests/css/css-variables/variable-reference.html:
Malformed name arguments are valid at parse time and round-trip.
*
LayoutTests/imported/w3c/web-platform-tests/css/css-variables/variable-declaration-29.html:
An invalid substituted name (--) triggers the fallback rather than dropping the
declaration.
*
LayoutTests/imported/w3c/web-platform-tests/css/css-variables/variable-supports-30.html:
*
LayoutTests/imported/w3c/web-platform-tests/css/css-variables/variable-supports-64.html:
var() with a dimension-token name argument is valid at parse time, so the
declaration is supported.
*
LayoutTests/imported/w3c/web-platform-tests/css/css-variables/variable-reference-name-substitution-attr-taint-expected.txt:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/css/css-variables/variable-reference-name-substitution-attr-taint.html:
Added.
A name resolved from an attribute must not sneak a URL past the taint check,
including when an
earlier value in the same declaration was already tainted.
*
LayoutTests/imported/w3c/web-platform-tests/css/css-variables/variable-reference-name-substitution-expected.txt:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/css/css-variables/variable-reference-name-substitution.html:
Added.
Names from other substitution functions, names that don't parse as
<custom-property-name>,
{}-wrapped names, cycles through the name argument, and registered properties.
* Source/WebCore/css/CSSSubstitutionValue.cpp:
(WebCore::CSSSubstitutionValue::cacheSimpleReference):
Only cache a name that var() or env() could actually name. Taking the first
token whatever it was
made var(20px) cache a reference to "px", so every resolution did a futile
custom property lookup
first.
* Source/WebCore/css/parser/CSSSubstitutionParser.cpp:
(WebCore::isValidDeclarationValueArgument):
(WebCore::isValidVariableReference):
Validate the name argument as a <declaration-value> split at the first literal
comma. It is a
free-form production, so isValidDeclarationValueArgument() applies the
{}-wrapping rules to it.
* Source/WebCore/style/StyleSubstitutionResolver.cpp:
(WebCore::Style::SubstitutionResolver::substituteVarArgumentGrammar):
Substitute the name argument and parse it as a <custom-property-name>. A name
that does not parse is
an unset optional, leaving the reference guaranteed-invalid while still
permitting the fallback.
m_isAttrTainted is a sticky resolver-wide flag, so it is isolated across the
name substitution:
diffing it would miss the taint whenever an earlier value had already set it,
letting a tainted name
reach a URL.
(WebCore::Style::SubstitutionResolver::substituteVarFunction):
(WebCore::Style::SubstitutionResolver::substituteEnvFunction):
One entry point each. env() names a literal <ident> with nothing to substitute,
so sharing meant
branching on the function id. Its argument grammar is the same as var()'s per
css-env-1, so the
ident-only name is a WebKit limitation and now says so.
(WebCore::Style::SubstitutionResolver::substituteNamedValueOrFallback):
The tail they do share: look up the name, fall back when the result is
guaranteed-invalid.
(WebCore::Style::SubstitutionResolver::substituteTokenRange):
(WebCore::Style::SubstitutionResolver::substituteVariableFunction): Deleted.
* Source/WebCore/style/StyleSubstitutionResolver.h:
* Source/WebCore/css/typedom/CSSUnparsedValue.cpp:
(WebCore::CSSUnparsedValue::create):
The assumption that a parsed var() has a literal <ident> name no longer holds.
var(20px) hit the
ASSERT and then aborted in release on the CSSOMVariableReferenceValue::create()
exception, reachable
from attributeStyleMap.get() and CSSStyleValue.parse(). Reify a variable
reference only for a
literal name and keep anything else as text.
* Source/WebCore/css/query/ContainerQuery.cpp:
(WebCore::Style::collectCustomPropertyNames):
FIXME for the names that only exist after substitution, which this cannot see.
Canonical link: https://commits.webkit.org/318912@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
