Changeset 286064 in webkit

Timestamp:

Nov 19, 2021, 9:09:32 AM (5 years ago)

Author:

Antti Koivisto

Message:

[CSS Cascade Layers] [Debug] ASSERTION FAILED: m_childRules.isEmpty() when using @import with layer name
​https://bugs.webkit.org/show_bug.cgi?id=233283
<rdar://problem/85520733>

Reviewed by Antoine Quint.

Source/WebCore:

CSS parser is allowing rules in illegal order (@import rule following @layer block)

Test: fast/css/layer-illegal-import.html

• css/parser/CSSParserImpl.cpp:

(WebCore::computeNewAllowedRules):

Only stay in AllowLayerStatementRules state if the new layer is a statement, not a block.

LayoutTests:

• fast/css/layer-illegal-import-expected.html: Added.
• fast/css/layer-illegal-import.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/css/layer-illegal-import-expected.html (added)
• LayoutTests/fast/css/layer-illegal-import.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/css/parser/CSSParserImpl.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2021-11-19  Antti Koivisto  <antti@apple.com>
+
+        [CSS Cascade Layers] [Debug] ASSERTION FAILED: m_childRules.isEmpty() when using @import with layer name
+        https://bugs.webkit.org/show_bug.cgi?id=233283
+        <rdar://problem/85520733>
+
+        Reviewed by Antoine Quint.
+
+        * fast/css/layer-illegal-import-expected.html: Added.
+        * fast/css/layer-illegal-import.html: Added.
+
 2021-11-19  Antti Koivisto  <antti@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-11-19  Antti Koivisto  <antti@apple.com>
+
+        [CSS Cascade Layers] [Debug] ASSERTION FAILED: m_childRules.isEmpty() when using @import with layer name
+        https://bugs.webkit.org/show_bug.cgi?id=233283
+        <rdar://problem/85520733>
+
+        Reviewed by Antoine Quint.
+
+        CSS parser is allowing rules in illegal order (@import rule following @layer block)
+
+        Test: fast/css/layer-illegal-import.html
+
+        * css/parser/CSSParserImpl.cpp:
+        (WebCore::computeNewAllowedRules):
+
+        Only stay in AllowLayerStatementRules state if the new layer is a statement, not a block.
+
 2021-11-19  Antti Koivisto  <antti@apple.com>
 

trunk/Source/WebCore/css/parser/CSSParserImpl.cpp

@@ -344 +344 @@
     if (!rule || allowedRules == CSSParserImpl::KeyframeRules || allowedRules == CSSParserImpl::CounterStyleRules || allowedRules == CSSParserImpl::NoRules)
         return allowedRules;
+    
     ASSERT(allowedRules <= CSSParserImpl::RegularRules);
-    if (allowedRules <= CSSParserImpl::AllowLayerStatementRules && (rule->isCharsetRule() || rule->isLayerRule()))
+    if (rule->isCharsetRule())
+        return CSSParserImpl::AllowLayerStatementRules;
+    if (allowedRules <= CSSParserImpl::AllowLayerStatementRules && rule->isLayerRule() && downcast<StyleRuleLayer>(*rule).isStatement())
         return CSSParserImpl::AllowLayerStatementRules;
     if (rule->isImportRule())