Bug 239967

Summary: [CSS Cascade Layers] Endless recursion with revert-layer in other tree context
Product: WebKit Reporter: Brandon <brandonstewart>
Component: CSSAssignee: Antti Koivisto <koivisto>
Status: RESOLVED FIXED    
Severity: Normal CC: bfulgham, koivisto, webkit-bug-importer, zalan
Priority: P2 Keywords: InRadar
Version: Other   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch none

Brandon
Reported 2022-05-02 08:51:19 PDT
<rdar://92449950>
Attachments
Patch (9.45 KB, patch)
2022-05-03 06:43 PDT, Antti Koivisto 		no flags
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Brandon
Comment 1 2022-05-02 08:51:42 PDT
Test Case: <style> ::-webkit-input-placeholder { display: revert-layer; } </style> <input placeholder="a">
Brandon
Comment 2 2022-05-02 12:22:22 PDT
The issue is occurring here due to constant back and forth between applyProperty and applyRollbackCascadeProperty. This accumulates into an endless recursion that eventually crashes. We need a way to add an exit condition here.
Antti Koivisto
Comment 3 2022-05-03 06:43:36 PDT
Created attachment 458737 [details] Patch
Antti Koivisto
Comment 4 2022-05-03 06:47:31 PDT
Also https://github.com/web-platform-tests/wpt/pull/33907
EWS
Comment 5 2022-05-03 08:46:36 PDT
Committed r293725 (250213@main): <https://commits.webkit.org/250213@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 458737 [details].
Note You need to log in before you can comment on or make changes to this bug.