Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 25aef1bb0796d5fc672ea035f3f46c200771eb9d
https://github.com/WebKit/WebKit/commit/25aef1bb0796d5fc672ea035f3f46c200771eb9d
Author: David Kilzer <[email protected]>
Date: 2026-09-28 (Mon, 28 Sep 2026)
Changed paths:
M Source/WebCore/css/parser/CSSParser.cpp
M Source/WebCore/css/parser/CSSParser.h
M Tools/TestWebKitAPI/Tests/WebCore/CSSParser.cpp
Log Message:
-----------
[CSS] CSSParser builds a 4 KB NestingContext temporary on the stack for each
nesting level
<https://bugs.webkit.org/show_bug.cgi?id=325430>
<rdar://188534575>
Reviewed by Darin Adler.
Construct each `CSSParser::NestingContext` in place. Pushing one with
`append(NestingContext { })` materializes a 4128-byte temporary in the
caller's frame before moving it into `m_nestingContextStack`. The
caller keeps that stack slot reserved while the recursion below it
runs, so deeply nested `@media` and style rules can exhaust a 512 KB
thread stack before `maximumRuleListNestingLevel` stops the recursion.
In a macOS release build, this cuts the stack used per `@media` plus
style-rule nesting pair from about 9.6 KB to about 1.3 KB.
Also initialize `m_nestingContextStack` with `Vector(size_t)` rather
than an initializer list, which copies the initial context from another
4 KB temporary.
Test: Tools/TestWebKitAPI/Tests/WebCore/CSSParser.cpp
* Source/WebCore/css/parser/CSSParser.cpp:
(WebCore::CSSParser::runInNewNestingContext):
* Source/WebCore/css/parser/CSSParser.h:
* Tools/TestWebKitAPI/Tests/WebCore/CSSParser.cpp:
(TestWebKitAPI::paintStackBelow): Add.
(TestWebKitAPI::parseStyleSheet): Add.
(TestWebKitAPI::deepestStackUseBelow): Add.
(TestWebKitAPI::TEST(CSSParser,
ParseMediaAndStyleRulesNestedToRuleListLimitStackUse)): Add.
- Measure the stack used to parse 64 nested `@media` and style-rule
pairs, the full 128-level limit, and require less than 512 KB. Run
on the main thread, since `strictCSSParserContext()` is main-thread
only. In a macOS release build, the parse uses about 154 KB with the
fix and about 671 KB without it. Skip the test under ASan, which
enlarges stack frames due to red zones.
Canonical link: https://commits.webkit.org/322126@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
