Bug 254697 – Fix operator precedence in SizesCalcParser.cpp

• Status: RESOLVED
• Resolution: FIXED
• Component: CSS

[Ahmad Saleem]

Hi Team,

While going through Blink's commit, I came across another potential merge and it seems to compile and work.

Blink Commit - https://chromium.googlesource.com/chromium/src.git/+/e0bcd910832c55445bc6bb4156acd716e0667248

WebKit Source - https://searchfox.org/wubkat/source/Source/WebCore/css/parser/SizesCalcParser.cpp#65

Just wanted to raise to get confirmation, if this need to be fixed.

It compiles locally (without comments) from Line 72-91:

    bool incomingOperatorPriority;

    if (!operatorPriority(token.delimiter(), incomingOperatorPriority))
        return false;
    
    while (!stack.isEmpty()) {
        const auto& topOfStack = stack.last();
        if (topOfStack.type() != DelimiterToken)
            break;
        bool stackOperatorPriority;
        if (!operatorPriority(topOfStack.delimiter(), stackOperatorPriority))
            return false;
    if (incomingOperatorPriority && !stackOperatorPriority)
        break;
        appendOperator(topOfStack);
        stack.removeLast();
    }
    stack.append(token);
    return true;
}

________

Appreciate if someone can confirm, I am happy to run it via EWS to see, if it works.

Thanks!

[Ahmad Saleem]

The issue is reproducible based on testcase mentioned on Chrome Monorail bug - https://codepen.io/anon/pen/GyPymY?editors=1100

First box get stuck on Safari 16.4 but using local patched build, all three remain same.

[Radar WebKit Bug Importer]

<rdar://problem/107681323>

[zak ridouh]

Pull request: https://github.com/WebKit/WebKit/pull/32177

[EWS]

Committed 290768@main (a303c0e7ffc6): <https://commits.webkit.org/290768@main>

Reviewed commits have been landed. Closing PR #32177 and removing active labels.