Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: e903a14baabdd0c7d1c1c9df8d18c54d0ba0f1e0
https://github.com/WebKit/WebKit/commit/e903a14baabdd0c7d1c1c9df8d18c54d0ba0f1e0
Author: Alan Baradlay <[email protected]>
Date: 2026-08-30 (Sun, 30 Aug 2026)
Changed paths:
A
LayoutTests/imported/w3c/web-platform-tests/css/cssom/getComputedStyle-in-unrendered-subframe-with-query-container-crash.html
M Source/WebCore/dom/Document.cpp
Log Message:
-----------
REGRESSION(319910@main): unifi.ui.com crashes with unbounded recursion in
Element::resolveComputedStyle
https://bugs.webkit.org/show_bug.cgi?id=322864
<rdar://problem/186110844>
Reviewed by Antti Koivisto.
<div style="display: none">
<iframe srcdoc="<style id='sheet'>#container { container-type: size
}</style>
<div id='container'><span
id='target'>text</span></div>"></iframe>
</div>
After touching the frame's stylesheet, getComputedStyle(target).color should
return a color.
Instead we end up triggering style recalc in an infinite loop until the web
process crashes.
A frame whose owner element does not generate a box (e.g. display: none) has no
render tree, so resolveStyle()
returns without doing anything and the recalc the stylesheet change scheduled
stays pending forever.
Element::resolveComputedStyle() asks for a style update on reaching a size
query container, and since that
update reports that it resolved style, re-enters computedStyle(), which comes
back to the same container and
asks again.
Fix by reporting no pending recalc while the render tree is withheld (matches
Firefox), the way a document in
the back/forward cache already does. Showing the frame again resolves the style
in createRenderTree().
*
LayoutTests/imported/w3c/web-platform-tests/css/cssom/getComputedStyle-in-unrendered-subframe-with-query-container-crash.html:
Added.
* Source/WebCore/dom/Document.cpp:
(WebCore::Document::needsStyleRecalc const):
(WebCore::Document::updateStyleIfNeeded): Assert what the above now guarantees,
since resolving style here
depends on it from a distance.
Canonical link: https://commits.webkit.org/320119@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
