Bug 301057 – REGRESSION (300909@main): Closing a transitioned popover with "position-try" can crash the browser window

• Component: Layout and Rendering
• Status: RESOLVED FIXED

[Ehren]

Created attachment 477130 [details]
Screen recording of Safari crashing when a popover is dismissed

Affected browers: Safari 26.0 and Safari TP 230

Demo: https://codepen.io/eharber/pen/raxpqBw?editors=1100

Closing a popover with the following styles will crash the browser tab if the toggle button is positioned near the top of the page:

[popover] {
	margin: 0;
	position-area: top;
	position-try: flip-block, flip-inline, flip-block flip-inline;
	transition-property: display, overlay, opacity, translate;
	transition-behavior: allow-discrete;
	transition-duration: .3s;
	opacity: 0;
	
	&:popover-open {
		opacity: 1;
		
		@starting-style {
			& {
				opacity: 0;
			}
		}
	}
}

[Ehren]

My apologies, Safari 26.0 doesn't actually display the popover at all. 

But in Safari TP 230, the browser tab crashes when the popover is closed.

[Alexey Proskuryakov]

0  com.apple.WebCore       	       0x1b9592f90 WTF::CrashOnOverflow::crash() + 0 wtf/CheckedArithmetic.h:110 [inlined]
1  com.apple.WebCore       	       0x1b9592f90 WTF::CrashOnOverflow::overflowed() + 0 wtf/CheckedArithmetic.h:103 [inlined]
2  com.apple.WebCore       	       0x1b9592f90 WTF::Vector<WebCore::Style::TreeResolver::PositionOption, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>::at(unsigned long) + 0 wtf/Vector.h:734 [inlined]
3  com.apple.WebCore       	       0x1b9592f90 WTF::Vector<WebCore::Style::TreeResolver::PositionOption, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>::operator[](unsigned long) + 0 wtf/Vector.h:744 [inlined]
4  com.apple.WebCore       	       0x1b9592f90 WebCore::Style::TreeResolver::sortPositionOptionsIfNeeded(WebCore::Style::TreeResolver::PositionOptions&, WebCore::Styleable const&) + 2596 Sources/WebCore/Source/WebCore/style/StyleTreeResolver.cpp:1668

[Radar WebKit Bug Importer]

<rdar://problem/163072798>

[Kiet Ho]

Besides the crash, there's also this thing where the popover "jumps" to a different position when it's dismissing. This is tracked in a different issue (rdar://160639948)

[Kiet Ho]

Pull request: https://github.com/WebKit/WebKit/pull/52775

[Kiet Ho]

The issue of the popover jumping around when dismissing is also tracked here: https://bugs.webkit.org/show_bug.cgi?id=301070

[EWS]

Committed 301966@main (1f488a95e2fc): <https://commits.webkit.org/301966@main>

Reviewed commits have been landed. Closing PR #52775 and removing active labels.