1798656 - [wpt-sync] Sync PR 36779 - [css-nesting] Fix a use-after-free on inserted parent selectors.

Status: RESOLVED FIXED

(Core :: CSS Parsing and Computation, task, P4)

Description

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Sync web-platform-tests PR 36779 into mozilla-central (this bug is closed when the sync is complete).

PR: https://github.com/web-platform-tests/wpt/pull/36779
Details from upstream follow.

Steinar H. Gunderson <[e-mail]> wrote:

[css-nesting] Fix a use-after-free on inserted parent selectors.

When checking whether a selector list is nest containing,
we temporarily set last_in_selector_list_ on the selector
right before the (possibly) inserted &. However, when clearing
it afterwards, we'd clear it on the wrong element (we didn't
take into account that back() pointed to something else),
leaving the flag there. This meant that Oilpan tracing
would stop at the element, missing later complex selectors
in the same list, eventually causing use-after-free.

Only relevant when CSS Nesting is activated (which it isn't
by default).

Fixed: 1380313
Change-Id: Ia912ee2d5538d7067c0d14786158372a544d5cd3

Reviewed-on: https://chromium-review.googlesource.com/3999320
WPT-Export-Revision: 2ec4c27311d5db8f6f0c5d0231a522c795a0c455

Comment 1

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Pushed to try (stability) https://treeherder.mozilla.org/#/jobs?repo=try&revision=31c39b6b03c4741953f550bf6a70dc5c34496203

Comment 2

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Pushed to try (stability) https://treeherder.mozilla.org/#/jobs?repo=try&revision=295489ec6d93ee9e7fc28007fa0dfd65980a8fed

Comment 3

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

CI Results

Ran 9 Firefox configurations based on mozilla-central, and Firefox, Chrome, and Safari on GitHub CI

Total 1 tests

Status Summary

Firefox

PASS: 1

Chrome

PASS: 1

Safari

PASS: 1

Links

Gecko CI (Treeherder)
GitHub PR Head
GitHub PR Base

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/1cfafb462b83
[wpt PR 36779] - [css-nesting] Fix a use-after-free on inserted parent selectors., a=testonly

Comment 5

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/1cfafb462b83