[css-houdini-drafts] [css-typed-om] Recursion in CSSUnparsedValue isn't handled in serialization algorithm (#1158)

AtkinsSJ has just created a new issue for https://github.com/w3c/css-houdini-drafts:

== [css-typed-om] Recursion in CSSUnparsedValue isn't handled in serialization algorithm ==
Blink issue: https://issues.chromium.org/issues/371292572

This is tested by WPT ([test](https://wpt.live/css/css-typed-om/cycle-in-unparsed-value-crash.html)) but I couldn't see an existing issue here about it.

When constructing `CSSUnparsedValue`s from JS, it's possible to create one that contains itself, such as this from the above WPT test:

```js
  var unparsed_value = new CSSUnparsedValue([]);
  var var_ref = new CSSVariableReferenceValue('--A', unparsed_value);
  unparsed_value[0] = var_ref;
```

The [serialization algorithms](https://drafts.css-houdini.org/css-typed-om-1/#unparsedvalue-serialization) for `CSSUnparsedValue` and `CSSVariableReferenceValue` don't handle this case, and following the spec directly will result in infinite recursion. Blink reportedly solves this by serializing as the empty string if a cycle is detected. I think I would prefer throwing an exception of some kind (which is [what DOMMatrix does](https://www.w3.org/TR/geometry-1/#dommatrixreadonly-stringification-behavior) when it can't be serialized), but that's up to you folks to decide. :^)

Please view or discuss this issue at https://github.com/w3c/css-houdini-drafts/issues/1158 using your GitHub account


-- 
Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config

Received on Friday, 3 October 2025 12:23:56 UTC