Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 47409553eaf76779f8dbc5f8d5e211f12b18d46a
https://github.com/WebKit/WebKit/commit/47409553eaf76779f8dbc5f8d5e211f12b18d46a
Author: Ahmad Saleem <[email protected]>
Date: 2026-10-11 (Sun, 11 Oct 2026)
Changed paths:
A
LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/the-img-element/sizes/sizes-auto-many-commas-crash.html
M Source/WebCore/css/parser/SizesAttributeParser.cpp
Log Message:
-----------
SizesAttributeParser::parse recurses per leading "auto," entry, so a long
sizes="auto,auto,…" exhausts the stack
https://bugs.webkit.org/show_bug.cgi?id=327184
rdar://189768879
Reviewed by Sam Weinig.
When parsing a sizes attribute, each leading "auto," entry was handled by
tail-recursing into parse(). The call is not tail-call-optimized (the frame
carries locals and copies the token range), so an attribute such as
"auto,auto,auto,…" grows the stack one frame per entry and crashes the web
process once it is large enough — around 27,000 entries in a Release build.
Consume the leading "auto" entries iteratively instead. The behavior is
otherwise unchanged: "auto" followed by end-of-input or a comma sets the
auto flag (and, for a comma, parsing continues with the remainder); any
other token restores the saved range and falls through to the normal
(media-condition, length) pair parsing.
Test:
imported/w3c/web-platform-tests/html/semantics/embedded-content/the-img-element/sizes/sizes-auto-many-commas-crash.html
*
LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/the-img-element/sizes/sizes-auto-many-commas-crash.html:
Added.
* Source/WebCore/css/parser/SizesAttributeParser.cpp:
(WebCore::SizesAttributeParser::parse):
Canonical link: https://commits.webkit.org/323414@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
