Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 2826fcdebc5b310c60ec04f17010a42a0a2d8599
https://github.com/WebKit/WebKit/commit/2826fcdebc5b310c60ec04f17010a42a0a2d8599
Author: Kiet Ho <[email protected]>
Date: 2025-10-28 (Tue, 28 Oct 2025)
Changed paths:
A
LayoutTests/imported/w3c/web-platform-tests/css/css-anchor-position/position-try-display-none-hang-crash.html
M Source/WebCore/style/StyleTreeResolver.cpp
M Source/WebCore/style/StyleTreeResolver.h
Log Message:
-----------
[css-anchor-position-1] Style resolution repeats indefinitely when
position-try box is in a display: none tree
rdar://161570947
https://bugs.webkit.org/show_bug.cgi?id=299742
Reviewed by Antti Koivisto.
If a position-try box is in a display: none tree (one of its ancestors is
display: none):
* On the first style resolution, a PositionOption is generated for the box
* After resolution, the box is invalidated because a position hasn't been chosen
* On the second resolution, when the display: none ancestor is visited, it'll
skip
visiting its descendants because of display: none. Hence style resolution never
visits
the position-try box.
* Because there's still a PositionOption for the box, after the second
resolution,
the box is still invalidated, even though style resolution will never visit it.
The result is style resolution repeats ad infinitum. Fix this by adding logic in
TreeResolver::resetStyleForNonRenderedDescendants to remove generated
PositionOptions
of non-rendered elements.
Test:
imported/w3c/web-platform-tests/css/css-anchor-position/position-try-display-none-hang-crash.html
*
LayoutTests/imported/w3c/web-platform-tests/css/css-anchor-position/position-try-display-none-hang-crash.html:
Added.
* Source/WebCore/style/StyleTreeResolver.cpp:
(WebCore::Style::TreeResolver::resetStyleForNonRenderedDescendants):
- Remove PositionOptions of non-rendered descendants.
(WebCore::Style::resetStyleForNonRenderedDescendants):
- Move into TreeResolver so it can access the position options map.
* Source/WebCore/style/StyleTreeResolver.h:
Canonical link: https://commits.webkit.org/302254@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
