)]}'
{
  "commit": "ac97ce8ceae40a5da3237ca72038ba2d4c9ebd14",
  "tree": "55fb8a8dca1c9201496640e0e7ca5641aed3e512",
  "parents": [
    "a6e6f927abb7b10979cb9f5828a05fddcf8ee02b"
  ],
  "author": {
    "name": "Ahmad Saleem",
    "email": "ahmad.saleem792+github@gmail.com",
    "time": "Sun Jul 12 04:13:07 2026"
  },
  "committer": {
    "name": "Devin Rousso",
    "email": "hi@devinrousso.com",
    "time": "Sun Jul 12 04:13:07 2026"
  },
  "message": "Web Inspector: crash when inspecting a top-level @scope rule with a bare declaration\nhttps://bugs.webkit.org/show_bug.cgi?id\u003d318379\nrdar://181745000\n\nReviewed by Devin Rousso.\n\nSelecting an element matched by a rule inside a top-level @scope rule that\ncontains a bare (implicitly nested) declaration crashes the WebContent process.\n\nCSSParser::consumeScopeRule() emitted startRuleBody()/endRuleBody() to the\nCSSParserObserver *before* consuming the rule\u0027s nested contents, unlike every\nother group at-rule (@media, @supports, @starting-style, @layer, @container).\nendRuleBody() pops the rule off StyleSheetHandler::m_currentRuleDataStack, so a\nbare declaration then makes consumeNestedGroupRules() call\nmarkRuleBodyContainsImplicitlyNestedProperties(), which dereferences\nm_currentRuleDataStack.last() on the now-empty stack (top-level @scope) and\ncrashes when Web Inspector reparses the sheet via CSS.getMatchedStylesForNode.\n\nMove endRuleBody() to after consumeNestedGroupRules(), matching the other group\nat-rules.\n\nOther consume*Rule() functions emit endRuleBody() before consuming contents too\n(@import, @font-face, @font-feature-values, @font-palette-values, @keyframes,\n@counter-style, @view-transition, @position-try, and @layer\u0027s statement form),\nbut none need this fix: the crash is only reachable via\nmarkRuleBodyContainsImplicitlyNestedProperties(), whose sole caller is\nconsumeNestedGroupRules(), which only the group at-rules run (and all call\nendRuleBody() after it). The rest consume descriptor lists that never reach it,\nand consumeBlockContent() only drives the observer for Style/Keyframe/Page.\nAdded a regression test reparsing each of these at-rules to confirm no crash.\n\nTests: inspector/css/getMatchedStylesForNodeScopeImplicitProperties.html\n       inspector/css/getMatchedStylesForNodeAtRulesDoNotCrash.html\n\n* LayoutTests/inspector/css/getMatchedStylesForNodeScopeImplicitProperties-expected.txt: Added.\n* LayoutTests/inspector/css/getMatchedStylesForNodeScopeImplicitProperties.html: Added.\n* LayoutTests/inspector/css/getMatchedStylesForNodeAtRulesDoNotCrash-expected.txt: Added.\n* LayoutTests/inspector/css/getMatchedStylesForNodeAtRulesDoNotCrash.html: Added.\n* Source/WebCore/css/parser/CSSParser.cpp:\n(WebCore::CSSParser::consumeScopeRule):\n\nCanonical link: https://commits.webkit.org/316987@main\n",
  "tree_diff": [
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "9159e6ab5036fe2d250893b2d2b1244e90786d73",
      "new_mode": 33188,
      "new_path": "LayoutTests/inspector/css/getMatchedStylesForNodeAtRulesDoNotCrash-expected.txt"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "5a7070442e6e1c60d93073de36bf39afe95712c5",
      "new_mode": 33188,
      "new_path": "LayoutTests/inspector/css/getMatchedStylesForNodeAtRulesDoNotCrash.html"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "b77d419566e496183ed5ad6f76ef90413e915262",
      "new_mode": 33188,
      "new_path": "LayoutTests/inspector/css/getMatchedStylesForNodeScopeImplicitProperties-expected.txt"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "b1f17e1fb5bdc5de58b637a83db9a1c3241ed44b",
      "new_mode": 33188,
      "new_path": "LayoutTests/inspector/css/getMatchedStylesForNodeScopeImplicitProperties.html"
    },
    {
      "type": "modify",
      "old_id": "5828aa8a8fb434d42056cc955b2942e706a7615d",
      "old_mode": 33188,
      "old_path": "Source/WebCore/css/parser/CSSParser.cpp",
      "new_id": "9f009df3e11fec33394798a423c02c530315a3c3",
      "new_mode": 33188,
      "new_path": "Source/WebCore/css/parser/CSSParser.cpp"
    }
  ]
}