Bug 281239 – Assertion fired in heise.de, SHOULD NEVER BE REACHED in CSSPropertyParsing::parseStyleProperty

• Status: RESOLVED
• Resolution: FIXED
• Component: CSS

[Nikolas Zimmermann]

Just opened heise.de in MiniBrowser (on WPE port, but the problem looks cross-platform):

SHOULD NEVER BE REACHED
/host/home/nzimmermann/Software/GitRepositories/WebKit/WebKitBuild/WPE/Release/WebCore/DerivedSources/CSSPropertyParsing.cpp(4621) : static WTF::RefPtr<WebCore::CSSValue> WebCore::CSSPropertyParsing::parseStyleProperty(WebCore::CSSParserTokenRange&, WebCore::CSSPropertyID, WebCore::CSSPropertyID, const WebCore::CSSParserContext&)
1   0x70e274f9bcfb WebCore::CSSPropertyParsing::parseStyleProperty(WebCore::CSSParserTokenRange&, WebCore::CSSPropertyID, WebCore::CSSPropertyID, WebCore::CSSParserContext const&)
2   0x70e276f0ee65 WebCore::CSSPropertyParser::parseSingleValue(WebCore::CSSPropertyID, WebCore::CSSParserTokenRange const&, WebCore::CSSParserContext const&)
3   0x70e276dc17b9 WebCore::CSSVariableReferenceValue::resolveSingleValue(WebCore::Style::BuilderState&, WebCore::CSSPropertyID) const
4   0x70e2784fff8b WebCore::Style::Builder::resolveVariableReferences(WebCore::CSSPropertyID, WebCore::CSSValue&)
5   0x70e278510581 WebCore::Style::Builder::applyProperty(WebCore::CSSPropertyID, WebCore::CSSValue&, WebCore::SelectorChecker::LinkMatchMask)
6   0x70e2785117f8 WebCore::Style::Builder::applyCascadeProperty(WebCore::Style::PropertyCascade::Property const&)
7   0x70e278511e59 void WebCore::Style::Builder::applyPropertiesImpl<(WebCore::Style::Builder::CustomPropertyCycleTracking)0>(int, int)
8   0x70e278512413 WebCore::Style::Builder::applyNonHighPriorityProperties()
9   0x70e27855157a WebCore::Style::Resolver::applyMatchedProperties(WebCore::Style::Resolver::State&, WebCore::Style::MatchResult const&)
10  0x70e278551959 WebCore::Style::Resolver::styleForElement(WebCore::Element&, WebCore::Style::ResolutionContext const&, WebCore::RuleMatchingBehavior)
11  0x70e27855620a WebCore::Style::TreeResolver::styleForStyleable(WebCore::Styleable const&, WebCore::Style::TreeResolver::ResolutionType, WebCore::Style::ResolutionContext const&, WebCore::RenderStyle const*)
12  0x70e2785612da WebCore::Style::TreeResolver::resolveElement(WebCore::Element&, WebCore::RenderStyle const*, WebCore::Style::TreeResolver::ResolutionType)
13  0x70e278562a69 WebCore::Style::TreeResolver::resolveComposedTree()
14  0x70e27856358b WebCore::Style::TreeResolver::resolve()
15  0x70e277101c9e WebCore::Document::resolveStyle(WebCore::Document::ResolveStyleType)
16  0x70e277102479 WebCore::Document::updateStyleIfNeeded()
17  0x70e27710265d WebCore::Document::updateLayout(WTF::OptionSet<WebCore::LayoutOptions>, WebCore::Element const*)
18  0x70e27714e67f WebCore::Element::boundingClientRect()
19  0x70e27714ea25 WebCore::Element::getBoundingClientRect()
20  0x70e2755247b1 WebCore::jsElementPrototypeFunction_getBoundingClientRect(JSC::JSGlobalObject*, JSC::CallFrame*)
21  0x70e21c810038 ???

[Radar WebKit Bug Importer]

<rdar://problem/138136534>

[Fujii Hironori]

Windows Debug MiniBrowser 293333@main hits this assertion failure at https://www.apple.com/ today on my PC.
But, no problem for http://heise.de/

[Fujii Hironori]

`id` was 59 (CSSPropertyBackdropFilter) at https://www.apple.com/.
https://github.com/WebKit/WebKit/blob/87e850f7c889adf2595c626c34bdf49296045cd0/Source/WebCore/css/scripts/test/TestCSSPropertiesResults/CSSPropertyParsing.cpp#L3153

I confirmed that enabling CSSUnprefixedBackdropFilterEnabled works around this problem for Windows port.

[Fujii Hironori]

Pull request: https://github.com/WebKit/WebKit/pull/43723

[EWS]

Committed 293373@main (05f398291782): <https://commits.webkit.org/293373@main>

Reviewed commits have been landed. Closing PR #43723 and removing active labels.