tor-browser

commit cae6e73ae8fe8bb48aabdc73958644e8964bca16
parent 48f2d9c0aa7c0dd829a2a46834b23165047788a8
Author: Jan Varga <jan.varga@gmail.com>
Date:   Fri, 21 Nov 2025 12:26:08 +0000

Bug 1990419 - Throw TypeError when CSSStyleValue has mismatched associated property in StylePropertyMap::Set; r=emilio,firefox-style-system-reviewers

Implement the Typed OM requirement that StylePropertyMap.set() must throw a
TypeError when a supplied CSSStyleValue has a non null
[[associatedProperty]] that does not match the property being set.

Differential Revision: https://phabricator.services.mozilla.com/D271811

Diffstat:
M
layout/style/typedom/CSSStyleValue.h
 | 
7
+++++++
M
layout/style/typedom/CSSUnsupportedValue.cpp
 | 
10
++++++++++
M
layout/style/typedom/CSSUnsupportedValue.h
 | 
2
++
M
layout/style/typedom/StylePropertyMap.cpp
 | 
15
+++++++++++++--
M
testing/web-platform/meta/css/css-typed-om/the-stylepropertymap/inline/set.tentative.html.ini
 | 
3
---

5 files changed, 32 insertions(+), 5 deletions(-)
diff --git a/layout/style/typedom/CSSStyleValue.h b/layout/style/typedom/CSSStyleValue.h
@@ -20,6 +20,7 @@ class RefPtr;
 
 namespace mozilla {
 
+struct CSSPropertyId;
 class ErrorResult;
 
 namespace dom {
@@ -64,6 +65,12 @@ class CSSStyleValue : public nsISupports, public nsWrapperCache {
   // Defined in CSSUnsupportedValue.cpp
   CSSUnsupportedValue& GetAsCSSUnsupportedValue();
 
+  // Returns nullptr if this value is not a CSSUnsupportedValue, caller must
+  // null check.
+  //
+  // Defined in CSSUnsupportedValue.cpp
+  const CSSPropertyId* GetPropertyId();
+
   bool IsCSSKeywordValue() const;
 
   // Defined in CSSKeywordValue.cpp
diff --git a/layout/style/typedom/CSSUnsupportedValue.cpp b/layout/style/typedom/CSSUnsupportedValue.cpp
@@ -28,4 +28,14 @@ CSSUnsupportedValue& CSSStyleValue::GetAsCSSUnsupportedValue() {
   return *static_cast<CSSUnsupportedValue*>(this);
 }
 
+const CSSPropertyId* CSSStyleValue::GetPropertyId() {
+  if (!IsCSSUnsupportedValue()) {
+    return nullptr;
+  }
+
+  CSSUnsupportedValue& unsupportedValue = GetAsCSSUnsupportedValue();
+
+  return &unsupportedValue.GetPropertyId();
+}
+
 }  // namespace mozilla::dom
diff --git a/layout/style/typedom/CSSUnsupportedValue.h b/layout/style/typedom/CSSUnsupportedValue.h
@@ -33,6 +33,8 @@ class CSSUnsupportedValue final : public CSSStyleValue {
                       const CSSPropertyId& aPropertyId,
                       RefPtr<DeclarationBlock> aDeclarations);
 
+  const CSSPropertyId& GetPropertyId() const { return mPropertyId; }
+
   void GetValue(nsACString& aRetVal) const;
 
  private:
diff --git a/layout/style/typedom/StylePropertyMap.cpp b/layout/style/typedom/StylePropertyMap.cpp
@@ -42,12 +42,14 @@ void StylePropertyMap::Set(
     ErrorResult& aRv) {
   // Step 2.
 
-  NonCustomCSSPropertyId propId = nsCSSProps::LookupProperty(aProperty);
-  if (propId == eCSSProperty_UNKNOWN) {
+  NonCustomCSSPropertyId id = nsCSSProps::LookupProperty(aProperty);
+  if (id == eCSSProperty_UNKNOWN) {
     aRv.ThrowTypeError("Invalid property: "_ns + aProperty);
     return;
   }
 
+  auto propertyId = CSSPropertyId::FromIdOrCustomProperty(id, aProperty);
+
   if (aValues.Length() != 1) {
     aRv.Throw(NS_ERROR_NOT_IMPLEMENTED);
     return;
@@ -62,6 +64,15 @@ void StylePropertyMap::Set(
 
   CSSStyleValue& styleValue = styleValueOrString.GetAsCSSStyleValue();
 
+  // Step 4
+
+  const auto valuePropertyId = styleValue.GetPropertyId();
+
+  if (valuePropertyId && *valuePropertyId != propertyId) {
+    aRv.ThrowTypeError("Invalid type for property"_ns);
+    return;
+  }
+
   nsAutoCString value;
 
   if (styleValue.IsCSSUnsupportedValue()) {
diff --git a/testing/web-platform/meta/css/css-typed-om/the-stylepropertymap/inline/set.tentative.html.ini b/testing/web-platform/meta/css/css-typed-om/the-stylepropertymap/inline/set.tentative.html.ini
@@ -31,6 +31,3 @@
 
   [StylePropertyMap.set is case-insensitive]
     expected: FAIL
-
-  [Setting a property with a CSSStyleValue whose associated property does not match throws TypeError]
-    expected: FAIL