From 64d79d4c3f8e9f26ced5df3d1b6fba610f687f17 Mon Sep 17 00:00:00 2001
From: Callum Law <callumlaw1709@outlook.com>
Date: Sat, 14 Jun 2025 00:06:20 +1200
Subject: [PATCH] LibWeb: Avoid overwriting resolved values in
 compute_keyframe_values

When we have an unresolved value for a shorthand (e.g. `border-style:
var(--border-style)`, `keyframe_values` will contain an
`UnresolvedStyleValue` for the shorthand and
`PendingSubstitutionStyleValue`s for each of it's longhands.

When we come across the shorthand's `UnresolvedStyleValue` we will
resolve the value and set all of the relevant longhands.

If the longhand's `PendingSubstitutionStyleValue` was processed after
(which isn't always the case as the iteration order depends on a
HashMap) would overwrite the correctly resolved longhand.

To avoid this we just skip any `PendingSubstitutionStyleValue`s we come
across and rely on the resolution of the shorthand to set those
properties.

Resolves a crash @tcl3 was experiencing when adding a new
"border-image-repeat" property.
---
 Libraries/LibWeb/CSS/StyleComputer.cpp | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/Libraries/LibWeb/CSS/StyleComputer.cpp b/Libraries/LibWeb/CSS/StyleComputer.cpp
index f8466e8b198..752f301b436 100644
--- a/Libraries/LibWeb/CSS/StyleComputer.cpp
+++ b/Libraries/LibWeb/CSS/StyleComputer.cpp
@@ -1170,6 +1170,11 @@ void StyleComputer::collect_animation_into(DOM::Element& element, Optional<CSS::
                 continue;
             }
 
+            // If the style value is a PendingSubstitutionStyleValue we should skip it to avoid overwriting any value
+            // already set by resolving the relevant shorthand's value.
+            if (style_value->is_pending_substitution())
+                continue;
+
             if (style_value->is_revert() || style_value->is_revert_layer())
                 style_value = computed_properties.property(property_id);
             if (style_value->is_unresolved())