commit c55071f4ec2e09550268da19033edb73f91f56f4
parent 80baf9fd1cd2634173a592eae3cbd226186109a9
Author: David Shin <dshin@mozilla.com>
Date: Thu, 6 Nov 2025 16:00:32 +0000
Bug 1998106: Ensure that <number> fallbacks are disallowed in fallbacks for anchor functions in calc() functions. r=layout-anchor-positioning-reviewers,firefox-style-system-reviewers,emilio
Differential Revision: https://phabricator.services.mozilla.com/D271479
Diffstat:
4 files changed, 52 insertions(+), 11 deletions(-)
diff --git a/servo/components/style/values/specified/calc.rs b/servo/components/style/values/specified/calc.rs
@@ -523,15 +523,19 @@ impl GenericAnchorFunction<Box<CalcNode>, Box<CalcNode>> {
let fallback = i
.try_parse(|i| {
i.expect_comma()?;
- let node = CalcNode::parse_argument(
- context,
- i,
- AllowParse {
- units: CalcUnits::LENGTH_PERCENTAGE,
- additional_functions,
- },
- )?;
- Ok::<Box<CalcNode>, ParseError<'i>>(Box::new(node))
+ Ok::<Box<CalcNode>, ParseError<'i>>(Box::new(
+ CalcNode::parse_argument(
+ context,
+ i,
+ AllowParse {
+ units: CalcUnits::LENGTH_PERCENTAGE,
+ additional_functions,
+ },
+ )?
+ .into_length_or_percentage(AllowedNumericType::All)
+ .map_err(|_| i.new_custom_error(StyleParseErrorKind::UnspecifiedError))?
+ .node,
+ ))
})
.ok();
Ok(Self {
@@ -552,8 +556,14 @@ impl GenericAnchorSizeFunction<Box<CalcNode>> {
return Err(input.new_custom_error(StyleParseErrorKind::UnspecifiedError));
}
GenericAnchorSizeFunction::parse_inner(context, input, |i| {
- CalcNode::parse_argument(context, i, AllowParse::new(CalcUnits::LENGTH_PERCENTAGE))
- .map(|r| Box::new(r))
+ Ok(Box::new(CalcNode::parse_argument(
+ context,
+ i,
+ AllowParse::new(CalcUnits::LENGTH_PERCENTAGE),
+ )?
+ .into_length_or_percentage(AllowedNumericType::All)
+ .map_err(|_| i.new_custom_error(StyleParseErrorKind::UnspecifiedError))?
+ .node))
})
}
}
diff --git a/testing/web-platform/tests/css/css-anchor-position/anchor-function-in-calc-number-crash.html b/testing/web-platform/tests/css/css-anchor-position/anchor-function-in-calc-number-crash.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<title>CSS Anchor Positioning: Crash with anchor functions in calc() with number fallback</title>
+<link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1998106">
+<style>
+.anchor {
+ anchor-name: --a;
+ width: 100px;
+ height: 100px;
+ background: magenta;
+}
+.positioned {
+ position: absolute;
+ position-anchor: --a;
+ width: 10px;
+ height: 10px;
+ background: purple;
+}
+</style>
+<div class=anchor></div>
+<div class=positioned style="left: calc(anchor(left, Infinity) + 1px);"></div>
+<div class=positioned style="left: calc(anchor(left, 0) + 1px);"></div>
+<div class=positioned style="left: calc(anchor(left, 1) + 1px);"></div>
+<div class=positioned style="width: calc(anchor-size(width, Infinity) + 1px);"></div>
+<div class=positioned style="width: calc(anchor-size(width, 0) + 1px);"></div>
+<div class=positioned style="width: calc(anchor-size(width, 1) + 1px);"></div>
diff --git a/testing/web-platform/tests/css/css-anchor-position/anchor-parse-invalid.html b/testing/web-platform/tests/css/css-anchor-position/anchor-parse-invalid.html
@@ -42,4 +42,7 @@ test_invalid_value('top', 'anchor(--foo top, auto');
test_invalid_value('top', 'calc(anchor(foo top) + 10px + 10%)');
test_invalid_value('top', 'calc(10px + 100 * anchor(--foo top, anchor(bar bottom)))');
test_invalid_value('top', 'min(anchor(--foo top), anchor(--bar bottom), anchor-size(baz height))');
+
+// Invalid unit anchor fallback value in calc tree
+test_invalid_value('top', 'calc(anchor(--foo top, 1) + 1px)');
</script>
diff --git a/testing/web-platform/tests/css/css-anchor-position/anchor-size-parse-invalid.html b/testing/web-platform/tests/css/css-anchor-position/anchor-size-parse-invalid.html
@@ -39,4 +39,7 @@ test_invalid_value('width', 'anchor-size(--foo width, anchor(--bar top))');
test_invalid_value('width', 'calc(anchor-size(foo width) + 10px + 10%)');
test_invalid_value('width', 'calc(10px + 100 * anchor-size(--foo width, anchor-size(bar bottom)))');
test_invalid_value('width', 'min(anchor-size(--foo width), anchor-size(--bar height), anchor(--baz top))');
+
+// Invalid unit anchor size fallback value in calc tree
+test_invalid_value('top', 'calc(anchor-size(--foo width, 1) + 1px)');
</script>
