It can be hit.
Created attachment 459552 [details] Patch
Comment on attachment 459552 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=459552&action=review > LayoutTests/fast/css/parse-non-descriptor.html:8 > +<script> > + if (window.testRunner) { testRunner.dumpAsText() } > + onload = function() { > + body.style.setProperty('src', 'url(#abc)') > + } > +</script> > +<body id='body'> > +This test passes if it does not assert. Seems pretty wrong that we try to parse the value at all in this case, src is a descriptor for @font-face, not a CSS property (I find it unfortunate that we mix both in CSSProperties.json fwiw). https://webkit-search.igalia.com/webkit/rev/0393f2f7c7a1e97a7a4c63441b50703cc11d493f/Source/WebCore/css/CSSProperties.json#4340-4349
Do you have any better suggestions?
Comment on attachment 459552 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=459552&action=review > Source/WebCore/css/parser/CSSParserFastPaths.cpp:-1092 > bool parsingDescriptor = context.enclosingRuleType && *context.enclosingRuleType != StyleRuleType::Style; > - ASSERT(!CSSProperty::isDescriptorOnly(propertyId) || parsingDescriptor); Maybe the assert can be loosened instead? Does ASSERT(!CSSProperty::isDescriptorOnly(propertyId) || parsingDescriptor || !context.enclosingRuleType); pass? It would be good to also add a FIXME that this is suspicious.
Created attachment 459619 [details] Patch
Committed r294606 (250831@main): <https://commits.webkit.org/250831@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 459619 [details].
<rdar://problem/93691077>