Closed Bug 2071160 Opened 2 months ago Closed 2 months ago

[wpt-sync] Sync PR 62605 - Prevent CSS transition from leaking tainted value

Categories

(Core :: CSS Parsing and Computation, task, P4)

Product:
Core
Component:
CSS Parsing and Computation
Type:
task

Tracking

()

Status:
RESOLVED FIXED
Milestone:
158 Branch
Tracking Flags:
Tracking Status
firefox158 --- fixed

People

(Reporter: wpt-sync, Unassigned)

References

(
URL
)

Details

(Whiteboard: [wptsync downstream])

Sync web-platform-tests PR 62605 into mozilla-central (this bug is closed when the sync is complete).

PR: https://github.com/web-platform-tests/wpt/pull/62605
Details from upstream follow.

Kevin Ellis <kevers@google.com> wrote:

Prevent CSS transition from leaking tainted value

Previously we could leak an attr-tainted value by stopping an
animation in the same frame that a transition starts that affects the
same property. Removal of the CSS animation can result in the start
value of a transition being attr-tainted. We were incorrectly getting
the variable data from the previous update's style and not from
before-change style.

Bug: 537107728
Change-Id: Ie070a17a8d5af469895fff33fa19e9a114529815

Reviewed-on: https://chromium-review.googlesource.com/8386356
WPT-Export-Revision: addd9b8bb437d674658f43b0cc5fc09e8b20f589

Component: web-platform-tests → CSS Parsing and Computation
Product: Testing → Core
Whiteboard: [wptsync downstream] → [wptsync downstream error]
Whiteboard: [wptsync downstream error] → [wptsync downstream]

CI Results

Ran 11 Firefox configurations based on mozilla-central, and Firefox, Chrome, and Safari on GitHub CI

Total 248 tests

Status Summary

Firefox

OK : 1[GitHub] 62[Gecko-android-em-14-x86_64-debug-geckoview, Gecko-android-em-14-x86_64-lite-opt-geckoview, Gecko-android-em-14-x86_64-opt-geckoview, Gecko-linux2404-64-debug, Gecko-linux2404-64-opt, Gecko-windows11-32-25h2-debug, Gecko-windows11-32-25h2-opt, Gecko-windows11-64-25h2-debug, Gecko-windows11-64-25h2-opt]
PASS: 1[GitHub] 4[Gecko-linux2204-64-wayland-debug, Gecko-linux2204-64-wayland-opt] 512[Gecko-windows11-32-25h2-debug, Gecko-windows11-32-25h2-opt] 686[Gecko-android-em-14-x86_64-debug-geckoview, Gecko-android-em-14-x86_64-lite-opt-geckoview, Gecko-android-em-14-x86_64-opt-geckoview] 687[Gecko-windows11-64-25h2-debug, Gecko-windows11-64-25h2-opt] 689[Gecko-linux2404-64-debug, Gecko-linux2404-64-opt]
FAIL: 79[Gecko-windows11-32-25h2-debug, Gecko-windows11-32-25h2-opt] 84[Gecko-linux2404-64-debug, Gecko-linux2404-64-opt] 86[Gecko-windows11-64-25h2-debug, Gecko-windows11-64-25h2-opt] 87[Gecko-android-em-14-x86_64-debug-geckoview, Gecko-android-em-14-x86_64-lite-opt-geckoview, Gecko-android-em-14-x86_64-opt-geckoview]

Chrome

OK : 1
FAIL: 1

Safari

OK : 1
PASS: 1

Links

Gecko CI (Treeherder)
GitHub PR Head
GitHub PR Base

Details

New Tests That Don't Pass

  • /css/css-variables/revert-layer-in-fallback.html [wpt.fyi]
    • var(--unknown, revert-layer) in custom property: FAIL
  • /css/css-variables/revert-rule-in-fallback.html [wpt.fyi]
    • var(--unknown, revert-rule) in custom property: FAIL
  • /css/css-variables/var-ident-function.html [wpt.fyi]
    • Referencing a custom property with ident(): FAIL
    • ident() is substituted on custom properties: FAIL
    • ident() causing lookup of invalid custom property, fallback: FAIL
    • ident() causing lookup of invalid custom property, fallback, CSS-wide keyword: FAIL
  • /css/css-variables/var-parsing.html [wpt.fyi]
    • e.style['width'] = "var(--x ())" should set the property value: FAIL
    • e.style['width'] = "var(--x () )" should set the property value: FAIL
    • e.style['width'] = "var(--x() )" should set the property value: FAIL
    • e.style['width'] = "var(--x (),)" should set the property value: FAIL
    • e.style['width'] = "var(--x(),)" should set the property value: FAIL
    • e.style['width'] = "var({--x})" should set the property value: FAIL
    • e.style['width'] = "var({--x}, 10px)" should set the property value: FAIL
    • e.style['width'] = "var({--x, --y})" should set the property value: FAIL
  • /css/css-variables/variable-css-wide-keywords-after-substitution.html [wpt.fyi]
    • CSS-wide keyword revert-layer after var() substitution: FAIL
    • revert-layer after var() substitution takes effect on the cascade: FAIL
  • /css/css-variables/variable-css-wide-keywords.html [wpt.fyi]
    • revert-layer as a var() fallback for an unregistered custom property: FAIL
    • revert-layer as a var() fallback for a non-inheriting registered custom property: FAIL
    • revert-layer as a var() fallback for an inheriting registered custom property: FAIL
  • /css/css-variables/variable-definition.html [wpt.fyi]
    • white space value (single space): FAIL
    • white space value (double space): FAIL
    • can overwrite with no value: FAIL
    • can overwrite with space value: FAIL
    • white space value (single space) (Computed Style): FAIL
    • white space value (double space) (Computed Style): FAIL
    • can overwrite with no value (Computed Style): FAIL
    • can overwrite with space value (Computed Style): FAIL
    • white space value (single space) (Cascading): FAIL
    • white space value (double space) (Cascading): FAIL
    • can overwrite with no value (Cascading): FAIL
    • can overwrite with space value (Cascading): FAIL
    • CSSOM.setProperty with space 1: FAIL
    • CSSOM.setProperty with space 2: FAIL
  • /css/css-variables/variable-presentation-attribute.html [wpt.fyi]
    • Testing 'clip' on '#test4'.: FAIL [Gecko-android-em-14-x86_64-debug-geckoview, Gecko-android-em-14-x86_64-lite-opt-geckoview, Gecko-android-em-14-x86_64-opt-geckoview, Gecko-linux2404-64-debug, Gecko-linux2404-64-opt], PASS [Gecko-windows11-32-25h2-debug, Gecko-windows11-32-25h2-opt, Gecko-windows11-64-25h2-debug, Gecko-windows11-64-25h2-opt]
    • Testing 'alignment-baseline'.: FAIL
    • Testing 'baseline-shift'.: FAIL
    • Testing 'color-interpolation-filters'.: FAIL
    • Testing 'fill'.: FAIL
    • Testing 'flood-color'.: FAIL
    • Testing 'font-family'.: FAIL
    • Testing 'glyph-orientation-vertical'.: FAIL
    • Testing 'kerning'.: FAIL
    • Testing 'lighting-color'.: FAIL
    • Testing 'pointer-events'.: FAIL
    • Testing 'stop-color'.: FAIL
    • Testing 'stroke'.: FAIL
    • Testing 'writing-mode'.: FAIL
  • /css/css-variables/variable-reference-name-substitution-attr-taint.html [wpt.fyi]
    • attr()-tainted name argument does not invalidate values that are not URLs: FAIL
    • attr()-tainted name argument substitutes normally into a custom property: FAIL
    • untainted substituted name argument does not taint the value: FAIL
  • /css/css-variables/variable-reference-name-substitution.html [wpt.fyi]
    • var() name comes from another var(): FAIL
    • var() name comes from a chain of var()s: FAIL
    • invalid substituted name falls back: FAIL
    • unset name-providing var() falls back: FAIL
    • whitespace around substituted name: FAIL
    • name argument substituting to nothing falls back: FAIL
    • multi-token substituted name falls back: FAIL
    • dimension-token substituted name falls back: FAIL
    • string substituted name falls back: FAIL
    • -- as substituted name falls back: FAIL
    • {}-wrapped literal name argument: FAIL
    • {}-wrapped substituted name argument: FAIL
    • {}-wrapped name argument with whitespace: FAIL
    • {}-wrapped name argument with fallback: FAIL
    • var() name comes from attr(): FAIL
    • var() name from attr() that is not a name falls back: FAIL
    • var() name comes from if(): FAIL
    • var() name comes from random-item(): FAIL
    • substituted name resolves a registered property: FAIL
    • substituted name of a guaranteed-invalid registered property uses the fallback: FAIL
    • fallback of an unparsed name is not syntax checked: FAIL
  • /css/css-variables/variable-reference.html [wpt.fyi]
    • width: var(prop);: FAIL
    • width: var(-prop);: FAIL
    • width: var(--prop 20px);: FAIL
    • width: var(--prop, var(prop));: FAIL
    • width: var(--prop, var(-prop));: FAIL
    • width: var(20px);: FAIL
    • width: var(var(--prop));: FAIL
    • Variable reference left open at end of stylesheet: FAIL
  • /css/css-variables/variable-substitution-variable-declaration.html [wpt.fyi]
    • target6 --varC: FAIL
  • /css/css-variables/variable-declaration-29.html [wpt.fyi]: FAIL
  • /css/css-variables/variable-external-font-face-01.html [wpt.fyi]: FAIL [Gecko-android-em-14-x86_64-debug-geckoview, Gecko-android-em-14-x86_64-lite-opt-geckoview, Gecko-android-em-14-x86_64-opt-geckoview, Gecko-windows11-64-25h2-debug, Gecko-windows11-64-25h2-opt], PASS [Gecko-linux2404-64-debug, Gecko-linux2404-64-opt]
  • /css/css-variables/variable-font-face-01.html [wpt.fyi]: FAIL [Gecko-android-em-14-x86_64-debug-geckoview, Gecko-android-em-14-x86_64-lite-opt-geckoview, Gecko-android-em-14-x86_64-opt-geckoview, Gecko-windows11-64-25h2-debug, Gecko-windows11-64-25h2-opt], PASS [Gecko-linux2404-64-debug, Gecko-linux2404-64-opt]
  • /css/css-variables/variable-font-face-02.html [wpt.fyi]: FAIL [Gecko-android-em-14-x86_64-debug-geckoview, Gecko-android-em-14-x86_64-lite-opt-geckoview, Gecko-android-em-14-x86_64-opt-geckoview, Gecko-windows11-64-25h2-debug, Gecko-windows11-64-25h2-opt], PASS [Gecko-linux2404-64-debug, Gecko-linux2404-64-opt]
  • /css/css-variables/variable-supports-30.html [wpt.fyi]: FAIL
  • /css/css-variables/variable-supports-64.html [wpt.fyi]: FAIL
  • /css/css-variables/vars-background-shorthand-001.html [wpt.fyi]: FAIL
Pushed by wptsync@mozilla.com: https://github.com/mozilla-firefox/firefox/commit/688a4ad4c0e4 https://hg.mozilla.org/integration/autoland/rev/432e43aa67fe [wpt PR 62605] - Prevent CSS transition from leaking tainted value, a=testonly

https://hg.mozilla.org/mozilla-central/rev/432e43aa67fe

Status: NEW → RESOLVED
Closed: 2 months ago
status-firefox158: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → 158 Branch
You need to log in before you can comment on or make changes to this bug.