Bug 165034 – Reproducible crash when you define css custom properties with value '%'

• Component: CSS
• Status: RESOLVED FIXED

[Matteo Gilardoni]

Created attachment 295339 [details]
Error you see

Issue found on:
- iPhone 5 Safari 9
- MacOs 10.12.1 Safari 9/10

to replicate the issue create an html page and add this: <div style="--size:%;width:calc(var(--size));"></div> 

The page will crash and report an error.

[Matteo Gilardoni]

I did some other test:

this code
<div style="--size:%;"></div>

is enough to break safari, it looks like it has got problem evaluating % it does not matter if you use it.

[Alexey Proskuryakov]

Created attachment 295357 [details]
test case

[David Kilzer (:ddkilzer)]

<rdar://problem/29394988>

[Matteo Gilardoni]

(In reply to comment #1)
> I did some other test:
> 
> this code
> <div style="--size:%;"></div>
> 
> is enough to break safari, it looks like it has got problem evaluating % it
> does not matter if you use it.

the previous case happen only if you open the debugger.

this one happen even with the debugger close
<div style="--size:%;width:var(--size);"></div>

[Matteo Gilardoni]

Created attachment 295456 [details]
reproducible bug on safari 10

added test case number 2

[Dave Hyatt]

This works fine in the new parser FYI.

[Matteo Gilardoni]

(In reply to comment #6)
> This works fine in the new parser FYI.

cool thank you. Next release should include this new parser? do you know when is going to happen?

[Dave Hyatt]

Fixed with new parser turning on:
https://trac.webkit.org/changeset/209396