Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: ac97ce8ceae40a5da3237ca72038ba2d4c9ebd14
https://github.com/WebKit/WebKit/commit/ac97ce8ceae40a5da3237ca72038ba2d4c9ebd14
Author: Ahmad Saleem <[email protected]>
Date: 2026-07-11 (Sat, 11 Jul 2026)
Changed paths:
A
LayoutTests/inspector/css/getMatchedStylesForNodeAtRulesDoNotCrash-expected.txt
A LayoutTests/inspector/css/getMatchedStylesForNodeAtRulesDoNotCrash.html
A
LayoutTests/inspector/css/getMatchedStylesForNodeScopeImplicitProperties-expected.txt
A
LayoutTests/inspector/css/getMatchedStylesForNodeScopeImplicitProperties.html
M Source/WebCore/css/parser/CSSParser.cpp
Log Message:
-----------
Web Inspector: crash when inspecting a top-level @scope rule with a bare
declaration
https://bugs.webkit.org/show_bug.cgi?id=318379
rdar://181745000
Reviewed by Devin Rousso.
Selecting an element matched by a rule inside a top-level @scope rule that
contains a bare (implicitly nested) declaration crashes the WebContent process.
CSSParser::consumeScopeRule() emitted startRuleBody()/endRuleBody() to the
CSSParserObserver *before* consuming the rule's nested contents, unlike every
other group at-rule (@media, @supports, @starting-style, @layer, @container).
endRuleBody() pops the rule off StyleSheetHandler::m_currentRuleDataStack, so a
bare declaration then makes consumeNestedGroupRules() call
markRuleBodyContainsImplicitlyNestedProperties(), which dereferences
m_currentRuleDataStack.last() on the now-empty stack (top-level @scope) and
crashes when Web Inspector reparses the sheet via CSS.getMatchedStylesForNode.
Move endRuleBody() to after consumeNestedGroupRules(), matching the other group
at-rules.
Other consume*Rule() functions emit endRuleBody() before consuming contents too
(@import, @font-face, @font-feature-values, @font-palette-values, @keyframes,
@counter-style, @view-transition, @position-try, and @layer's statement form),
but none need this fix: the crash is only reachable via
markRuleBodyContainsImplicitlyNestedProperties(), whose sole caller is
consumeNestedGroupRules(), which only the group at-rules run (and all call
endRuleBody() after it). The rest consume descriptor lists that never reach it,
and consumeBlockContent() only drives the observer for Style/Keyframe/Page.
Added a regression test reparsing each of these at-rules to confirm no crash.
Tests: inspector/css/getMatchedStylesForNodeScopeImplicitProperties.html
inspector/css/getMatchedStylesForNodeAtRulesDoNotCrash.html
*
LayoutTests/inspector/css/getMatchedStylesForNodeScopeImplicitProperties-expected.txt:
Added.
*
LayoutTests/inspector/css/getMatchedStylesForNodeScopeImplicitProperties.html:
Added.
*
LayoutTests/inspector/css/getMatchedStylesForNodeAtRulesDoNotCrash-expected.txt:
Added.
* LayoutTests/inspector/css/getMatchedStylesForNodeAtRulesDoNotCrash.html:
Added.
* Source/WebCore/css/parser/CSSParser.cpp:
(WebCore::CSSParser::consumeScopeRule):
Canonical link: https://commits.webkit.org/316987@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
