From c9e4abcd3a38ce20120dca72e589b191bc671693 Mon Sep 17 00:00:00 2001
From: Matthias Clasen <mclasen@redhat.com>
Date: Thu, 15 Aug 2024 10:15:04 -0400
Subject: [PATCH] css: Fix a crash in variables

We were not careful enough when checking for reference cycles.

Fixes: #6935

Test included.
---
 gtk/gtkcssvariableset.c              |  4 ++++
 testsuite/css/style/variables2.css   | 11 +++++++++++
 testsuite/css/style/variables2.nodes |  9 +++++++++
 testsuite/css/style/variables2.ui    |  7 +++++++
 4 files changed, 31 insertions(+)
 create mode 100644 testsuite/css/style/variables2.css
 create mode 100644 testsuite/css/style/variables2.nodes
 create mode 100644 testsuite/css/style/variables2.ui

diff --git a/gtk/gtkcssvariableset.c b/gtk/gtkcssvariableset.c
index 7ab862af35..957d18ebcc 100644
--- a/gtk/gtkcssvariableset.c
+++ b/gtk/gtkcssvariableset.c
@@ -139,6 +139,10 @@ check_references (GtkCssVariableSet   *self,
 
           ref_value = g_hash_table_lookup (self->variables, GINT_TO_POINTER (ref_id));
 
+          /* This variable was already removed, no point in checking further */
+          if (!ref_value)
+            return FALSE;
+
           if (check_variable (self, unvisited_variables, stack, ref_id, ref_value))
             return TRUE;
         }
diff --git a/testsuite/css/style/variables2.css b/testsuite/css/style/variables2.css
new file mode 100644
index 0000000000..cdc402825e
--- /dev/null
+++ b/testsuite/css/style/variables2.css
@@ -0,0 +1,11 @@
+:root {
+  --b: var(--a);
+}
+
+:root {
+  --a: var(--a, red);
+}
+
+* {
+ background: var(--b);
+}
diff --git a/testsuite/css/style/variables2.nodes b/testsuite/css/style/variables2.nodes
new file mode 100644
index 0000000000..a06acc3bc3
--- /dev/null
+++ b/testsuite/css/style/variables2.nodes
@@ -0,0 +1,9 @@
+window.background:dir(ltr)
+  background-color: rgba(0,0,0,0); /* variables2.css:10:2-23 */
+  background-clip: border-box; /* variables2.css:10:2-23 */
+  background-origin: padding-box; /* variables2.css:10:2-23 */
+  background-size: auto; /* variables2.css:10:2-23 */
+  background-position: left top; /* variables2.css:10:2-23 */
+  background-repeat: repeat; /* variables2.css:10:2-23 */
+  background-image: none; /* variables2.css:10:2-23 */
+  --b: var(--a); /* variables2.css:2:8-16 */
diff --git a/testsuite/css/style/variables2.ui b/testsuite/css/style/variables2.ui
new file mode 100644
index 0000000000..dfdfe7d2d0
--- /dev/null
+++ b/testsuite/css/style/variables2.ui
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<interface>
+  <object class="GtkWindow" id="window1">
+    <property name="can_focus">False</property>
+    <property name="decorated">0</property>
+  </object>
+</interface>