Bug 249119

Summary: Web Inspector: Use-after-scope in lambda in WebCore::isValidRuleHeaderText()
Product: WebKit Reporter: David Kilzer (:ddkilzer) <ddkilzer>
Component: Web InspectorAssignee: David Kilzer (:ddkilzer) <ddkilzer>
Status: RESOLVED FIXED    
Severity: Normal CC: inspector-bugzilla-changes, pangle, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: All   
OS: All   
Bug Depends on: 246768    
Bug Blocks:    

Description David Kilzer (:ddkilzer) 2022-12-11 20:20:59 PST
Web Inspector: Use-after-scope in lambda in WebCore::isValidRuleHeaderText().

Currently, `CSSParserImpl` holds a reference to the `CSSParserContext` argument, so the context must outlive the parser.

However, in this code the context is a temporary stack variable which is destroyed after this statement, though the parser holds a reference to it.

```
        CSSParserImpl parser(parserContextForDocument(document), atRuleIdentifier + ' ' + headerText + " {}");
```

<rdar://102887283>
Comment 1 David Kilzer (:ddkilzer) 2022-12-11 20:21:38 PST
This regressed here:

    Web Inspector: Support editing @rules in the Styles sidebar
    https://bugs.webkit.org/show_bug.cgi?id=246768
    <https://commits.webkit.org/256043@main>
Comment 2 David Kilzer (:ddkilzer) 2022-12-11 20:30:25 PST
Pull request: https://github.com/WebKit/WebKit/pull/7466
Comment 3 EWS 2022-12-12 03:20:08 PST
Committed 257722@main (599c0cb20b81): <https://commits.webkit.org/257722@main>

Reviewed commits have been landed. Closing PR #7466 and removing active labels.