Bug 316441

Summary: [css-anchor-position-1] REGRESSION(311053@main): crash hiding a popover whose ::after pseudo-element inherits position-anchor and position-area
Product: WebKit Reporter: Yury Semikhatsky <yurys>
Component: CSSAssignee: Devin Rousso <hi>
Status: RESOLVED FIXED    
Severity: Normal CC: hi, info, koivisto, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: Safari Technology Preview   
Hardware: Unspecified   
OS: macOS 26   
See Also: https://bugs.webkit.org/show_bug.cgi?id=316463
Bug Depends on: 311690    
Bug Blocks:    
Attachments:
Description Flags
repro none

Yury Semikhatsky
Reported 2026-06-05 12:58:39 PDT
Created attachment 479989 [details] repro ## Description A `popover` whose `::after` pseudo-element inherits **both** `position-anchor` and `position-area` from an anchor-positioned host crashes the render process. Showing it (`showPopover()`) is fine; **hiding** it (`hidePopover()`) crashes on the next layout. Removing either inherited property avoids the crash. ## Steps to reproduce 1. Open the test case in Safari Technology Preview (or a WebKit nightly). 2. Hover "Trigger" — the popover appears (fine). 3. Move the mouse back out (`hidePopover()`) — the render process crashes. ## Test case ```html <!DOCTYPE html> <style> .trigger { anchor-name: --tooltip; } .tooltip { position: absolute; inset: 0; margin: 0; position-anchor: --tooltip; position-area: bottom; &::after { content: ''; inline-size: 10px; block-size: 10px; background-color: blue; position: fixed; position-anchor: inherit; /* both inherits together... */ position-area: inherit; /* ...are required to crash */ } } </style> <div class="trigger">Trigger</div> <div class="tooltip" popover="manual">Tooltip</div> <script> const trigger = document.querySelector('.trigger'); const tooltip = document.querySelector('.tooltip'); trigger.addEventListener('mouseover', () => tooltip.showPopover()); trigger.addEventListener('mouseout', () => tooltip.hidePopover()); </script> ``` ## Regression range Introduced between `309613@main` (good) and `312360@main` (bad): https://github.com/WebKit/WebKit/compare/c5cdc14...92693c2 Not bisected to a single commit yet; likely in the `position-area`/anchor-positioning churn there (e.g. 310398@main "Accommodate pseudo-elements when sorting anchor elements by tree order"). Reproduces in shipping STP/nightly; not in released Safari. Originally reported against Playwright: https://github.com/microsoft/playwright/issues/41159
Attachments
repro (2.54 KB, text/html)
2026-06-05 12:58 PDT, Yury Semikhatsky 		no flags
Details
View All Add attachment proposed patch, testcase, etc.
Devin Rousso
Comment 1 2026-06-05 16:51:22 PDT
Pull request: https://github.com/WebKit/WebKit/pull/66597
EWS
Comment 2 2026-06-06 07:54:10 PDT
Committed 314698@main (f7a8a5c0476a): <https://commits.webkit.org/314698@main> Reviewed commits have been landed. Closing PR #66597 and removing active labels.
Radar WebKit Bug Importer
Comment 3 2026-06-06 07:55:13 PDT
<rdar://problem/178895863>
Note You need to log in before you can comment on or make changes to this bug.