316441 2026-06-05 12:58:39 -0700 [css-anchor-position-1] REGRESSION(311053@main): crash hiding a popover whose ::after pseudo-element inherits position-anchor and position-area 2026-06-06 07:55:13 -0700 1 1 1 Unclassified WebKit CSS Safari Technology Preview Unspecified macOS 26 RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=316463 InRadar P2 Normal --- 311690 1 yurys hi hi info koivisto webkit-bug-importer oldest_to_newest 2218106 0 479989 yurys 2026-06-05 12:58:39 -0700 Created attachment 479989 repro ## Description A `popover` whose `::after` pseudo-element inherits **both** `position-anchor` and `position-area` from an anchor-positioned host crashes the render process. Showing it (`showPopover()`) is fine; **hiding** it (`hidePopover()`) crashes on the next layout. Removing either inherited property avoids the crash. ## Steps to reproduce 1. Open the test case in Safari Technology Preview (or a WebKit nightly). 2. Hover "Trigger" — the popover appears (fine). 3. Move the mouse back out (`hidePopover()`) — the render process crashes. ## Test case ```html <!DOCTYPE html> <style> .trigger { anchor-name: --tooltip; } .tooltip { position: absolute; inset: 0; margin: 0; position-anchor: --tooltip; position-area: bottom; &::after { content: ''; inline-size: 10px; block-size: 10px; background-color: blue; position: fixed; position-anchor: inherit; /* both inherits together... */ position-area: inherit; /* ...are required to crash */ } } </style> <div class="trigger">Trigger</div> <div class="tooltip" popover="manual">Tooltip</div> <script> const trigger = document.querySelector('.trigger'); const tooltip = document.querySelector('.tooltip'); trigger.addEventListener('mouseover', () => tooltip.showPopover()); trigger.addEventListener('mouseout', () => tooltip.hidePopover()); </script> ``` ## Regression range Introduced between `309613@main` (good) and `312360@main` (bad): https://github.com/WebKit/WebKit/compare/c5cdc14...92693c2 Not bisected to a single commit yet; likely in the `position-area`/anchor-positioning churn there (e.g. 310398@main "Accommodate pseudo-elements when sorting anchor elements by tree order"). Reproduces in shipping STP/nightly; not in released Safari. Originally reported against Playwright: https://github.com/microsoft/playwright/issues/41159 2218183 1 hi 2026-06-05 16:51:22 -0700 Pull request: https://github.com/WebKit/WebKit/pull/66597 2218286 2 ews-feeder 2026-06-06 07:54:10 -0700 Committed 314698@main (f7a8a5c0476a): <https://commits.webkit.org/314698@main> Reviewed commits have been landed. Closing PR #66597 and removing active labels. 2218287 3 webkit-bug-importer 2026-06-06 07:55:13 -0700 <rdar://problem/178895863> 479989 2026-06-05 12:58:39 -0700 2026-06-05 12:58:39 -0700 repro index.html text/html 2598 yurys PCFET0NUWVBFIGh0bWw+CjxodG1sIGxhbmc9ImVuIj4KPGhlYWQ+CjxtZXRhIGNoYXJzZXQ9IlVU Ri04Ij4KPG1ldGEgbmFtZT0idmlld3BvcnQiIGNvbnRlbnQ9IndpZHRoPWRldmljZS13aWR0aCwg aW5pdGlhbC1zY2FsZT0xIj4KPHRpdGxlPldlYktpdCBhbmNob3ItcG9zaXRpb25pbmcgcG9wb3Zl ciBjcmFzaCDigJQgIzQxMTU5PC90aXRsZT4KPHN0eWxlPgogIGJvZHkgewogICAgZm9udC1mYW1p bHk6IC1hcHBsZS1zeXN0ZW0sIHN5c3RlbS11aSwgc2Fucy1zZXJpZjsKICAgIHBhZGRpbmc6IDQw cHg7CiAgICBsaW5lLWhlaWdodDogMS41OwogIH0KCiAgLmhlYXJ0YmVhdCB7CiAgICBmb250LXNp emU6IDI0cHg7CiAgICBmb250LXdlaWdodDogYm9sZDsKICAgIG1hcmdpbjogMjBweCAwOwogIH0K ICAuaGVhcnRiZWF0LmFsaXZlIHsgY29sb3I6IGdyZWVuOyB9CgogIC50cmlnZ2VyIHsKICAgIGFu Y2hvci1uYW1lOiAtLXRvb2x0aXA7CiAgICBkaXNwbGF5OiBpbmxpbmUtYmxvY2s7CiAgICBwYWRk aW5nOiA2cHggMTJweDsKICAgIGJvcmRlcjogMXB4IHNvbGlkICM4ODg7CiAgICBib3JkZXItcmFk aXVzOiA0cHg7CiAgICBjdXJzb3I6IHBvaW50ZXI7CiAgICB1c2VyLXNlbGVjdDogbm9uZTsKICB9 CgogIC50b29sdGlwIHsKICAgIHBvc2l0aW9uOiBhYnNvbHV0ZTsKICAgIGluc2V0OiAwOwogICAg bWFyZ2luOiAwOwogICAgcG9zaXRpb24tYW5jaG9yOiAtLXRvb2x0aXA7CiAgICBwb3NpdGlvbi1h cmVhOiBib3R0b207CiAgICBiYWNrZ3JvdW5kOiAjMzMzOwogICAgY29sb3I6IHdoaXRlOwogICAg cGFkZGluZzogOHB4OwogICAgYm9yZGVyOiAwOwoKICAgIC8qIFRoZSBjb21iaW5hdGlvbiBiZWxv dyBoYW5ncyB0aGUgV2ViS2l0IHJlbmRlciBwcm9jZXNzIG9uIHNob3dQb3BvdmVyKCkuICovCiAg ICAmOjphZnRlciB7CiAgICAgIGNvbnRlbnQ6ICcnOwogICAgICBpbmxpbmUtc2l6ZTogMTBweDsK ICAgICAgYmxvY2stc2l6ZTogMTBweDsKICAgICAgYmFja2dyb3VuZC1jb2xvcjogYmx1ZTsKICAg ICAgcG9zaXRpb246IGZpeGVkOwogICAgICBwb3NpdGlvbi1hbmNob3I6IGluaGVyaXQ7CiAgICAg IHBvc2l0aW9uLWFyZWE6IGluaGVyaXQ7CiAgICB9CiAgfQo8L3N0eWxlPgo8L2hlYWQ+Cjxib2R5 PgogIDxoMT5XZWJLaXQgYW5jaG9yLXBvc2l0aW9uaW5nIHBvcG92ZXIgY3Jhc2g8L2gxPgogIDxw PgogICAgUmVwcm9kdWNlcyA8YSBocmVmPSJodHRwczovL2dpdGh1Yi5jb20vbWljcm9zb2Z0L3Bs YXl3cmlnaHQvaXNzdWVzLzQxMTU5Ij5taWNyb3NvZnQvcGxheXdyaWdodCM0MTE1OTwvYT4uCiAg ICBIb3ZlciB0aGUgPGI+VHJpZ2dlcjwvYj4gYmVsb3cgKHRoZSBwb3BvdmVyIHNob3dzIOKAlCBm aW5lKSwgdGhlbiA8Yj5tb3ZlIHRoZSBtb3VzZQogICAgYmFjayBvdXQ8L2I+LiBPbiBhZmZlY3Rl ZCBXZWJLaXQgYnVpbGRzIHRoZSByZW5kZXIgcHJvY2VzcyBjcmFzaGVzIHRoZSBtb21lbnQgdGhl CiAgICBwb3BvdmVyIGlzIGhpZGRlbiDigJQgdGhlIHRhYiBkaWVzIC8gZ29lcyBibGFuayBhbmQg dGhlIGhlYXJ0YmVhdCBjb3VudGVyIHN0b3BzLgogIDwvcD4KCiAgPGRpdiBpZD0iaGVhcnRiZWF0 IiBjbGFzcz0iaGVhcnRiZWF0IGFsaXZlIj5oZWFydGJlYXQ6IDAgKHBhZ2UgaXMgcmVzcG9uc2l2 ZSk8L2Rpdj4KCiAgPHA+CiAgICA8c3BhbiBjbGFzcz0idHJpZ2dlciI+VHJpZ2dlciDigJQgaG92 ZXIgbWU8L3NwYW4+CiAgPC9wPgogIDxkaXYgY2xhc3M9InRvb2x0aXAiIHBvcG92ZXI9Im1hbnVh bCI+VG9vbHRpcDwvZGl2PgoKICA8cCBzdHlsZT0iY29sb3I6IzY2NjsgbWF4LXdpZHRoOiA2MGNo OyI+CiAgICBUaGUgaGFuZyByZXF1aXJlcyA8Yj5ib3RoPC9iPiA8Y29kZT5wb3NpdGlvbi1hbmNo b3I6IGluaGVyaXQ8L2NvZGU+IGFuZAogICAgPGNvZGU+cG9zaXRpb24tYXJlYTogaW5oZXJpdDwv Y29kZT4gb24gdGhlIDxjb2RlPjo6YWZ0ZXI8L2NvZGU+IHBzZXVkby1lbGVtZW50LgogICAgUmVt b3ZpbmcgZWl0aGVyIG9uZSBhdm9pZHMgdGhlIGZyZWV6ZS4KICA8L3A+CgogIDxzY3JpcHQ+CiAg ICBjb25zdCBoZWFydGJlYXQgPSBkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgnaGVhcnRiZWF0Jyk7 CiAgICBsZXQgY291bnQgPSAwOwogICAgZnVuY3Rpb24gdGljaygpIHsKICAgICAgY291bnQrKzsK ICAgICAgaGVhcnRiZWF0LnRleHRDb250ZW50ID0gYGhlYXJ0YmVhdDogJHtjb3VudH0gKHBhZ2Ug aXMgcmVzcG9uc2l2ZSlgOwogICAgICByZXF1ZXN0QW5pbWF0aW9uRnJhbWUodGljayk7CiAgICB9 CiAgICByZXF1ZXN0QW5pbWF0aW9uRnJhbWUodGljayk7CgogICAgY29uc3QgdHJpZ2dlciA9IGRv Y3VtZW50LnF1ZXJ5U2VsZWN0b3IoJy50cmlnZ2VyJyk7CiAgICBjb25zdCB0b29sdGlwID0gZG9j dW1lbnQucXVlcnlTZWxlY3RvcignLnRvb2x0aXAnKTsKICAgIHRyaWdnZXIuYWRkRXZlbnRMaXN0 ZW5lcignbW91c2VvdmVyJywgKCkgPT4gdG9vbHRpcC5zaG93UG9wb3ZlcigpKTsKICAgIHRyaWdn ZXIuYWRkRXZlbnRMaXN0ZW5lcignbW91c2VvdXQnLCAoKSA9PiB0b29sdGlwLmhpZGVQb3BvdmVy KCkpOwogIDwvc2NyaXB0Pgo8L2JvZHk+CjwvaHRtbD4K