1864647 - :has() pseudo-class crashes when used with CSS nesting

Status: VERIFIED FIXED

(Core :: CSS Parsing and Computation, defect)

Description

[Roman Komarov]

Attachment: CodePen - firefox has crash.html

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:121.0) Gecko/20100101 Firefox/121.0

Steps to reproduce:

Visit https://codepen.io/kizu/pen/eYxEaVb or open the attached web page, or create a page with the following CSS: :has(*){:has(&){}}

Actual results:

The page crashes.

Expected results:

The page should not crash.

Now, this might be an interesting interop issue: in the specs (https://drafts.csswg.org/selectors/#relational) having the nested :has() is not allowed

The :has() pseudo-class cannot be nested; :has() is not valid within :has().

However! While a regular nested :has() like :has(> li:has(strong)) does not work (see https://codepen.io/kizu/pen/XWOaLgm), in both Safari and Chrome it actually works when nested via native CSS nesting! (opening the reported page in them renders the ul with the lime background)

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::CSS Parsing and Computation' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1864647 - Don't crash when finding nested relative selectors. r=dshin

For now, do the same as pseudo-elements, which is effectively to keep
them in the replaced selector but don't match them. Avoid crashing in
this case.

I filed https://github.com/w3c/csswg-drafts/issues/9600 since this issue
isn't specific about :has(), and depending on the result of that
discussion, the "proper" solution might be different.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/69bede2c30ec
Don't crash when finding nested relative selectors. r=dshin

Comment 4

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/43186 for changes under testing/web-platform/tests

Comment 5

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/69bede2c30ec

Comment 6

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/69bede2c30ec

Comment 7

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/69bede2c30ec

Comment 8

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot

Comment 10

[BugBot [:suhaib / :marco/ :calixte]]

Copying crash signatures from duplicate bugs.

Comment 11

[Ardelean Oana, Desktop Test Engineering [:oardelean]]

Reproducible on a 2023-11-14 Nightly build on Ubuntu 22.
Verified as fixed on Firefox 121.0b3 and Nightly 122.0a1 on Ubuntu 22, Windows 10, macOS 12.