Fix invalid assertion in parseKeywordValue

https://bugs.webkit.org/show_bug.cgi?id=240593 Reviewed by Antti Koivisto. Test: fast/css/parse-non-descriptor.html * Source/WebCore/css/parser/CSSParserFastPaths.cpp: This function returns null, which is fine. Canonical link: https://commits.webkit.org/250832@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@294606 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WebKit · May 21, 2022 · fbf1615 · fbf1615
1 parent 7950c18
commit fbf1615
Show file tree

Hide file tree

Showing 3 changed files with 11 additions and 1 deletion.
diff --git a/LayoutTests/fast/css/parse-non-descriptor-expected.txt b/LayoutTests/fast/css/parse-non-descriptor-expected.txt
@@ -0,0 +1 @@
+This test passes if it does not assert.
diff --git a/LayoutTests/fast/css/parse-non-descriptor.html b/LayoutTests/fast/css/parse-non-descriptor.html
@@ -0,0 +1,8 @@
+<script>
+    if (window.testRunner) { testRunner.dumpAsText() }
+    onload = function() {
+        body.style.setProperty('src', 'url(#abc)')
+    }
+</script>
+<body id='body'>
+This test passes if it does not assert.
diff --git a/Source/WebCore/css/parser/CSSParserFastPaths.cpp b/Source/WebCore/css/parser/CSSParserFastPaths.cpp
@@ -1090,7 +1090,8 @@ static RefPtr<CSSValue> parseKeywordValue(CSSPropertyID propertyId, StringView s
     ASSERT(!string.isEmpty());
 
     bool parsingDescriptor = context.enclosingRuleType && *context.enclosingRuleType != StyleRuleType::Style;
-    ASSERT(!CSSProperty::isDescriptorOnly(propertyId) || parsingDescriptor);
+    // FIXME: The "!context.enclosingRuleType" is suspicious.
+    ASSERT(!CSSProperty::isDescriptorOnly(propertyId) || parsingDescriptor || !context.enclosingRuleType);
 
     if (!CSSParserFastPaths::isKeywordPropertyID(propertyId)) {
         // All properties, including non-keyword properties, accept the CSS-wide keywords.