Bug 239967

Summary:

[CSS Cascade Layers] Endless recursion with revert-layer in other tree context

Product:

WebKit

Reporter:

Brandon <brandonstewart>

Component:

CSS

Assignee:

Antti Koivisto <koivisto>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

bfulgham, koivisto, webkit-bug-importer, zalan

Priority:

Keywords:

InRadar

Version:

Other

Hardware:

Unspecified

OS:

Unspecified

Attachments:

Description	Flags
Patch	none

Description Brandon 2022-05-02 08:51:19 PDT

<rdar://92449950>

Comment 1 Brandon 2022-05-02 08:51:42 PDT

Test Case:

<style>
  ::-webkit-input-placeholder {
    display: revert-layer;
  }
</style>
<input placeholder="a">

Comment 2 Brandon 2022-05-02 12:22:22 PDT

The issue is occurring here due to constant back and forth between applyProperty and applyRollbackCascadeProperty. This accumulates into an endless recursion that eventually crashes.

We need a way to add an exit condition here.

Comment 3 Antti Koivisto 2022-05-03 06:43:36 PDT

Created attachment 458737 [details]
Patch

Comment 4 Antti Koivisto 2022-05-03 06:47:31 PDT

Also https://github.com/web-platform-tests/wpt/pull/33907

Comment 5 EWS 2022-05-03 08:46:36 PDT

Committed r293725 (250213@main): <https://commits.webkit.org/250213@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 458737 [details].