[Webkit-unassigned] [Bug 184542] New: CSS variables (custom properties) bug & a potential crash

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=184542

            Bug ID: 184542
           Summary: CSS variables (custom properties) bug & a potential
                    crash
           Product: WebKit
           Version: Safari 11
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Major
          Priority: P2
         Component: CSS
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: kizmarh at ya.ru

Created attachment 337803

  --> https://bugs.webkit.org/attachment.cgi?id=337803&action=review

Crash page

Steps to reproduce:

Go to https://codepen.io/kizu/pen/MVRRMq (I have managed to reproduce both the bug and the crash both on desktop and mobile safari)

In every other browser (including Chrome) the header should have a lime background, but in Safari it gets the pink one.

Its also possible to cause this page to crash when creating circularity (uncomment the commented line in the above example, or go to https://codepen.io/kizu/pen/OvGYXx, or open an attached page), which is probably related to the above bug as every other browser handle this without crashing (and properly displaying pink background as --foo becomes invalid).

Due to crash being caused by really short CSS string which is possible to pass just as a style attribute to an HTML element, I think it could be really dangerous.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20180412/85124c8a/attachment-0002.html>