Skip to content

css: compare url() values by their text - #46895

Closed
robobun wants to merge 4 commits into
robobun/1095c942/css-url-text-stack-basefrom
robobun/1095c942/css-url-text-equality
Closed

robobun wants to merge 4 commits into
robobun/1095c942/css-url-text-stack-basefrom
robobun/1095c942/css-url-text-equality

Conversation

@robobun

@robobun robobun commented Oct 25, 2026 •

Copy link
Copy Markdown
Collaborator

Stacked on #42018: the base branch is main with its two commits. Land #42018 first.

Problem

Fix

  • Url keeps the text of the url. eql and hash use it. The record index still resolves and prints the url.
  • Correct because each stylesheet is minified alone, and one text in one file names one file.
  • Verified: test/js/bun/css/css.test.ts ("url") and test/bundler/esbuild/css.test.ts (the base fails 7 tests). Also test/js/bun/css/, test/bundler/css/.
  • Self-reviewed: 3 concerns raised, 2 addressed. Kept: a pointer and a u32 length, because a slice field makes Property 224 bytes.

Background

  • An import record is the bundler's entry for one url(): the path as written, its source range, and later the resolved file.
  • Two rules with equal declaration blocks become one rule with a selector list.
  • Considered one record for each distinct url. It needs a lookup for every url().

Downsides

  • Url grows from 12 to 24 bytes. Image, TokenOrValue and Property (216) do not grow. .text grows 256 bytes.
  • 20,000 rules with two urls each: 0.14% more instructions. The 15 fixture sheets: no change above the noise.
  • url(a.png) and url(./a.png) are not equal.
Notes

Outputs (bun build f.css --minify)

Input bun 1.3.14 and main This PR lightningcss 1.33.0 esbuild 0.28.2
.a{background:url(data:,a)}.b{background:url(data:,a)} unchanged .a,.b{background:url(data:,a)} .a,.b{background:url(data:,a)} unchanged
.a{background:url(data:,a)}.b{background:url("data:,a")} two rules .a,.b{background:url(data:,a)} .a,.b{background:url(data:,a)} two rules
.a{--i:url(data:,a)}.b{--i:url(data:,a)} unchanged .a,.b{--i:url(data:,a)} .a,.b{--i:url(data:,a)} unchanged
.a{background:url(data:,a)}.b{background:url(data:,b)} unchanged unchanged unchanged unchanged
  • The same holds for mask, cursor, content, filter, clip-path, list-style, shape-outside, image-set() and an unknown property.
  • Two declarations of one rule print as before. The property handlers already replaced the earlier one.
  • Rules of two files do not merge: one/a.css and two/b.css can both hold url(./x.png), and each file is minified alone (css/RulesWithTheSameURLTextInTwoFilesStayApart).

Why now

Source main #46861 #46861 with this PR
.a:not(.b,.c){background:url(data:,a)} 3, 5, 5, 5, 5, 5 3, 5, 7, 9, 11, 13 3, 5, 5, 5, 5, 5
.a:autofill:not(.b,.c){background:url(data:,a)} 3, 7, 7, 7, 7, 7 3, 7, 17, 41, 99, 239 3, 7, 7, 7, 7, 7

Why the stack

Measurements

Release builds of the base branch (main 179664e with #42018) and of this PR, linux x64. Instructions are user-space counts from a perf_event_open counter around the whole process. perf, valgrind and bloaty are not in the container.

  • First build of the 3,942 sheets: 5 sheets differ, all in handsontable. 26 rules with one url() become 13. 6,946 bytes fewer, with and without browser targets.
  • Rebuild (each output minified again): 58,008 bytes fewer at build 2, and 78,169 fewer from build 3 (20 sheets).
  • bun build --minify of the 15 sheets in test/js/bun/css/files: 796,492,512 to 796,396,799 instructions, interleaved, median of 5, spread 0.25%. All 60 outputs are identical (browser and bun target, with and without --minify).
  • 20,000 rules with two different urls each: 626,474,645 to 627,355,227 instructions (44 more for each rule). The output is identical.
  • Url 12 to 24 bytes. Image 32, TokenOrValue 72 and Property 216 bytes on both builds. With a slice field: Url 32, Image 40, Property 224.
  • .text 82,165,897 to 82,166,153 bytes. .rodata does not change.

Self-review

  1. Url::new took a plain borrowed slice and kept a raw pointer to it. Addressed: it takes the &'static [u8] that the parser's expect_url_cloned returns, the form this crate uses for source text.
  2. Equal urls reach the inverted border-image test. Addressed: the PR sits on css: keep border-image and border in source cascade order within a rule #42018, with a test.
  3. The text is a raw pointer with a u32 length, read through one unsafe block. Not changed: the sizes above are the reason.

Tests

  • Debug build: test/js/bun/css/css.test.ts and test/bundler/esbuild/css.test.ts pass (1,407 tests). With the src/ of the base branch, 7 fail: the six merge cases of the "url" block and css/RulesWithTheSameURLMerge.
  • Debug build: the other 28 files of test/js/bun/css/ (without css-fuzz.test.ts), test/bundler/css/ and test/regression/issue/27117.test.ts pass (1,388 tests).

[human-review] gate passed · iteration 0 · 5 files touched

fails on main (without fix)
ASAN without fix: 7 failed, 77 skipped
$ BUN_DEBUG_QUIET_LOGS=1 bun scripts/build.ts --profile=debug --quiet test "--reporter=junit" "--reporter-outfile=/tmp/pr_gate.xml" test/bundler/esbuild/css.test.ts test/js/bun/css/css.test.ts
bun test v1.4.4 (367d939d9)

test/bundler/esbuild/css.test.ts:
(pass) bundler > css/CSSEntryPoint [586.80ms]
(pass) bundler > css/CSSEntryPointEmpty [140.55ms]
(pass) bundler > css/CSSNesting [122.07ms]
(pass) bundler > css/CSSAtImportMissing [106.11ms]
(pass) bundler > css/CSSAtImportSimple [164.45ms]
(pass) bundler > css/CSSAtImportDiamond [152.90ms]
(pass) bundler > css/CSSAtImportCycle [135.62ms]
(pass) bundler > css/CSSUrlImport [153.36ms]
(pass) bundler > css/ImportCSSFromJSComposes [131.63ms]
(pass) bundler > css/ImportCSSFromJSComposesFromMissingImport [338.46ms]
(pass) bundler > css/ImportCSSFromJSComposesFromNotCSS [97.90ms]
(pass) bundler > css/ImportCSSFromJSComposesCircular [116.66ms]
(pass) bundler > css/ImportCSSFromJSComposesFromCircular [170.54ms]
(pass) bundler > css/ImportCSSFromJSComposesIDSelector [136.75ms]
(pass) bundler > css/ImportCSSFromJSComposesElementSelector [125.08ms]
(pass) bundler > css/ImportCSSFromJSComposesCompoundSelector [151.50ms]
(pass) 
... (truncated)

release without fix: 77 skipped
bun test v1.4.4-canary.1 (f6375ab7b)

test/bundler/esbuild/css.test.ts:
(pass) bundler > css/CSSEntryPoint [97.63ms]
(pass) bundler > css/CSSEntryPointEmpty [11.05ms]
(pass) bundler > css/CSSNesting [8.57ms]
(pass) bundler > css/CSSAtImportMissing [10.22ms]
(pass) bundler > css/CSSAtImportSimple [7.95ms]
(pass) bundler > css/CSSAtImportDiamond [14.19ms]
(pass) bundler > css/CSSAtImportCycle [12.58ms]
(pass) bundler > css/CSSUrlImport [13.90ms]
(pass) bundler > css/ImportCSSFromJSComposes [15.63ms]
(pass) bundler > css/ImportCSSFromJSComposesFromMissingImport [29.03ms]
(pass) bundler > css/ImportCSSFromJSComposesFromNotCSS [14.87ms]
(pass) bundler > css/ImportCSSFromJSComposesCircular [17.98ms]
(pass) bundler > css/ImportCSSFromJSComposesFromCircular [14.83ms]
(pass) bundler > css/ImportCSSFromJSComposesIDSelector [7.33ms]
(pass) bundler > css/ImportCSSFromJSComposesElementSelector [10.88ms]
(pass) bundler > css/ImportCSSFromJSComposesCompoundSelector [8.55ms]
(pass) bundler > css/ImportCSSFromJSComposesComplexSelector [6.40ms]
(pass) bundler > css/ImportCSSFromJSComposesPseudoClass [5.11ms]
(pass) bundler > css/ImportCSSFromJSComposesAttributeSelector [4.99ms]
(pass
... (truncated)
passes on PR (with fix)
ASAN with fix: 77 skipped
$ BUN_DEBUG_QUIET_LOGS=1 bun scripts/build.ts --profile=debug --quiet test "--reporter=junit" "--reporter-outfile=/tmp/pr_gate.xml" test/bundler/esbuild/css.test.ts test/js/bun/css/css.test.ts
bun test v1.4.4 (367d939d9)

test/bundler/esbuild/css.test.ts:
(pass) bundler > css/CSSEntryPoint [695.82ms]
(pass) bundler > css/CSSEntryPointEmpty [156.15ms]
(pass) bundler > css/CSSNesting [155.23ms]
(pass) bundler > css/CSSAtImportMissing [135.64ms]
(pass) bundler > css/CSSAtImportSimple [122.90ms]
(pass) bundler > css/CSSAtImportDiamond [198.23ms]
(pass) bundler > css/CSSAtImportCycle [133.71ms]
(pass) bundler > css/CSSUrlImport [142.60ms]
(pass) bundler > css/ImportCSSFromJSComposes [267.01ms]
(pass) bundler > css/ImportCSSFromJSComposesFromMissingImport [514.03ms]
(pass) bundler > css/ImportCSSFromJSComposesFromNotCSS [145.93ms]
(pass) bundler > css/ImportCSSFromJSComposesCircular [184.74ms]
(pass) bundler > css/ImportCSSFromJSComposesFromCircular [169.48ms]
(pass) bundler > css/ImportCSSFromJSComposesIDSelector [142.46ms]
(pass) bundler > css/ImportCSSFromJSComposesElementSelector [106.99ms]
(pass) bundler > css/ImportCSSFromJSComposesCompoundSelector [110.74ms]
(pass)
... (truncated)

release with fix: 77 skipped
$ bun scripts/build.ts --profile=release
[configured] bun-profile → bun (stripped) in 1930ms (unchanged)
ninja: Entering directory `/workspace/bun/build/release'
[1/110] build.rs build_script_build
[2/110] rustc bun_platform 
[3/110] rustc bun_core 
[4/110] rustc bun_safety 
[5/110] rustc bun_output 
[6/110] rustc bun_zlib_sys 
[7/110] rustc bun_zstd 
[8/110] rustc bun_brotli 
[9/110] rustc bun_picohttp 
[10/110] rustc bun_base64 
[11/110] rustc bun_boringssl_sys 
[12/110] rustc bun_cares_sys 
[13/110] rustc bun_ptr 
[14/110] rustc bun_clap 
[15/110] rustc bun_lsquic_sys 
[16/110] rustc bun_errno 
[17/110] rustc bun_valkey 
[18/110] rustc bun_tcc_sys 
[19/110] rustc bun_text_diff 
[20/110] rustc bun_paths 
[21/110] rustc bun_shell_parser 
warning: `feature(generic_const_exprs)` is not supported with the next-generation trait solver
 --> src/shell_parser/lib.rs:1:30
  |
1 | #![feature(adt_const_params, generic_const_exprs, allocator_api)]
  |                              ^^^^^^^^^^^^^^^^^^^
  |
  = note: `-Znext-solver=globally` is currently enabled by default for testing
  = note: reverted the setting to `-Znext-solver=coherence` for this crate
  = note: the curre
... (truncated)
diff hotspot
src/css/properties/custom.rs     | 27 +++-----------------
 src/css/values/image.rs          | 16 ++++++------
 src/css/values/url.rs            | 51 ++++++++++++++++++++++++++------------
 test/bundler/esbuild/css.test.ts | 53 ++++++++++++++++++++++++++++++++++++++++
 test/js/bun/css/css.test.ts      | 33 +++++++++++++++++++++++++
 5 files changed, 131 insertions(+), 49 deletions(-)

gate history · 1 passed · 0 rejected · iteration 0

evidence per changed file
file                              reads  edits  tests
src/css/properties/custom.rs          0      0     62
src/css/values/image.rs               0      0     62
src/css/values/url.rs                 0      0     62
test/bundler/esbuild/css.test.ts      1      1     47
test/js/bun/css/css.test.ts           0      0     37

Each `url()` in a stylesheet gets its own import record, and `Url::eql`
compared the record indexes. So two `url()` values were never equal, and
two rules that differ only in the selector did not become one rule when
they hold a `url()`. lightningcss compares the url text.

`Url` now keeps the text of the url and compares that. `Url` is 24 bytes
(12 before). `Image`, `TokenOrValue` and `Property` do not grow.
@robobun

robobun commented Oct 25, 2026 •

Copy link
Copy Markdown
Collaborator Author
Updated 11:18 AM PT - Oct 25th, 2026

✅ @robobun, your commit e25570d3f422b73255fcbe91fc97c8be96e9cf4d passed in Build #132672! 🎉


🧪   To try this PR locally:

bunx bun-pr 46895

That installs a local version of the PR into your bun-46895 executable, so you can run:

bun-46895 --bun

@robobun

robobun commented Oct 25, 2026 •

Copy link
Copy Markdown
Collaborator Author

Status

Landed in #47025 (7942008). This PR is closed.

Checked on main at 7942008 (release build):

printf '.a{background:url(data:,a)}\n.b{background:url(data:,a)}\n' > in.css
bun build ./in.css --minify
# 1.4.2:  .a{background:url(data:,a)}.b{background:url(data:,a)}
# main:   .a,.b{background:url(data:,a)}

@claude claude Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nothing blocking. The comments below are optional suggestions. There is no need to push a fix for them before merging.

Beyond the inline note, I also checked the lifetime behind the new Url.text raw pointer: every Url::new caller passes the same erased slice that add_import_record (src/css/css_parser.rs:3101-3103) already stores as ImportRecord.path, so the pointer carries no lifetime assumption the import records did not already make. I also checked whether text-equality could merge rules from two files that resolve to different assets — each stylesheet is minified on its own before bundling, and the new css/RulesWithTheSameURLTextInTwoFilesStayApart test covers that case.

Extended reasoning...

The change adds a raw pointer plus u32 length to the CSS Url value so eql/hash compare url text instead of import record index, letting the minifier merge rules with identical url() values; it touches unsafe Rust but no auth, crypto, or injection surface. The only posted finding is a stale SAFETY comment nit, and the remaining lifetime and cross-file-merge concerns were traced to existing code paths and new tests.

Additional findings (outside the current diff — GitHub can't attach inline comments there):

  • 🟡 src/css/properties/custom.rs — nit: Maintainers reading custom.rs:51-53 get a SAFETY comment that no longer describes what the erased slice is used for. It says url only needs to outlive the add_import_record call, but the same &'static [u8] is now also stored as a raw pointer in Url::new at custom.rs:57 and read back for the life of the stylesheet. Fix: make the SAFETY comment state the real bound, that the slice is parser source/arena memory which outlives every value of the stylesheet, matching the wording at url.rs:53, or route this inline through expect_url_cloned like Url::parse does so no local erasure is needed.

    Why this was flagged

    The diff changes custom.rs:57 from building Url with two Copy fields to Url::new(url, ...), which keeps url.as_ptr() in Url.text (url.rs:30) and dereferences it later in Url::text (url.rs:55) during eql/hash. The SAFETY comment at custom.rs:51-52 justifying the &'static erasure still only claims the borrow outlives the add_import_record call. The claim is true in practice because expect_url returns source or arena bytes (css_parser.rs:4114-4117), so there is no memory-safety defect; this is a stale SAFETY comment, which the repository's review rules require to be accurate. On the base branch the comment matched the only use of the erased slice.

    Verification: Any maintainer auditing the unsafe lifetime erasure in url_parse meets it. src/css/properties/custom.rs:51-53 still says url "outlives the add_import_record call" and erases it to &'static [u8], but custom.rs:57-58 now also passes url to Url::new, which keeps a raw pointer dereferenced for the life of the stylesheet. No memory-safety bug results; the SAFETY comment is inaccurate.

`url_parse` in the token-list parser erased the lifetime of the url slice
in place. Its SAFETY comment spoke only of the `add_import_record` call,
and `Url` now keeps the slice. `expect_url_cloned` returns the same slice
through the erasure that the parser documents, as `Url::parse` does.
Comment thread src/css/values/url.rs Resolved
Comment thread src/css/values/url.rs Resolved
@robobun

robobun commented Oct 25, 2026

Copy link
Copy Markdown
Collaborator Author

The stale SAFETY comment in url_parse (src/css/properties/custom.rs) is gone in 5f19531: the function now reads the url through expect_url_cloned, as Url::parse does, so it has no lifetime erasure of its own. 8c383ce shortens the two comments in src/css/values/url.rs that the comment check marked.

@claude claude Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nothing blocking. The comments below are optional suggestions. There is no need to push a fix for them before merging.

Comment thread src/css/properties/custom.rs Resolved
`ext::url_parse` in the token-list parser had the same body as
`Url::parse`. One function now builds every `Url`.
@robobun

robobun commented Oct 25, 2026

Copy link
Copy Markdown
Collaborator Author

e25570d removes the second copy of the url parser: ext::url_parse in src/css/properties/custom.rs had the same body as Url::parse, so the two token-list call sites now call Url::parse. One function builds every Url. test/js/bun/css/css.test.ts, test/bundler/esbuild/css.test.ts and test/bundler/css/ pass on the debug build.

@claude claude Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I re-reviewed after e25570d and found no bugs; the duplicated url parser from my earlier comment is gone. Since this adds a raw pointer plus unsafe to a core value type and changes which rules the minifier merges for every build, a human look is still worthwhile.

What was reviewed:

  • Url::text SAFETY: expect_url_cloned and arena_str hand back the same parser source/arena storage that ImportRecord.path already borrows through src_str, so the pointer has the same lifetime the crate already relies on.
  • text_len saturation in Url::new can only shorten the slice, and add_import_record already panics on positions past i32::MAX, so it is unreachable in practice.
  • Thread affinity: ImageSetOption.file_type already held a *const [u8], so stylesheets were not Send before this change.
  • Url::new is the sole constructor (url.rs, image.rs); eql/hash both key on the unescaped text, and the tests cover quoted vs unquoted spellings, custom properties, image-set, and the cross-file case.
Extended reasoning...

The change touches three Rust files in the CSS parser (src/css/values/url.rs, src/css/values/image.rs, src/css/properties/custom.rs) plus two test files, replacing import-record-index equality on Url with text equality so same-url rules merge during minification, and storing that text as a raw pointer and u32 length read back through unsafe from_raw_parts. It touches no security-sensitive surface. The code is small and the lifetime argument matches the crate's existing src_str convention, but it introduces new unsafe in a widely embedded value type and alters minifier output semantics for all users, which is why a human should also look rather than this being auto-approved. No CODEOWNER covers src/css, and the earlier github-actions inline threads were resolved only by the author.

Jarred-Sumner added a commit that referenced this pull request Oct 27, 2026
### What does this PR do?

Consolidates the open pull requests on the CSS parser (`src/css`:
parsing, minifying, lowering, printing, CSS modules) into one.

179 open pull requests were in scope. Each was judged by one rule: **the
output must mean to a browser what the input meant.** Every claim was
run through a build of `main`, a build with the change, lightningcss
1.33 and Chromium 156 (CSSOM, computed values, painted pixels for colors
and gradients), and counted against 10,116 real stylesheets: the
published CSS of about 190 popular npm packages, plus stylesheets from
open source repositories. 107 land here, whole or in part, most of them
cut down. The source diff is net negative.

Of the 10,116, 9,509 are stylesheets that someone ships. The rest are
test fixtures of other tools (521), Tailwind v4 source that needs its
plugin (59) and SCSS, PostCSS or template source (27).

| 9,509 shipped stylesheets | `main` | this branch |
|---|---|---|
| fail to build | 71 | 35 |
| ... of those, valid CSS that Bun rejects | | 0 |
| minified output reads differently in Chromium than the input | 552 | 2
|
| CSS modules with a name that is referenced but not defined, or
exported but not defined | 166 | 0 |

| all 10,116 | `main` | this branch |
|---|---|---|
| fail to build | 192 | 141 |
| minified output reads differently in Chromium than the input | 593 |
15 |
| build on `main`, fail here | | 0 |
| right on `main`, wrong here (minified, and at the default targets) | |
0 |
| size of the minified output, no targets | 162.32 MB | 162.47 MB
(+0.093%) |
| size of the output at the default targets | 224.1 MB | 210.2 MB
(-6.2%) |

A syntax error is a build error, with one exception: the IE star hack
`*zoom: 1` is skipped, because tachyons and handsontable ship it. The 35
shipped stylesheets that fail are invalid CSS: 28 have a selector that
Chromium drops (semantic-ui-css, swiper, @ionic/core, Adobe Spectrum,
xp.css), 2 an `@import` after other rules, and one each `@supports not X
and Y`, a nested `@keyframes`, a stray comma, a selector list in
`::slotted()`, `@media screen\0` (govuk-frontend). The 2 that read
differently fold a `color-mix()` inside a gradient (see the known gaps).

The growth of the minified output is rules and declarations that `main`
deleted by mistake: 87 KB of rules, 45 KB of prefixed declarations that
only browser targets can rule out.

#### Popular CSS that `main` breaks today

- normalize.css, modern-normalize, sanitize.css: `font-family:
monospace, monospace` is collapsed to `monospace`, which changes the
font size from 16px to 13px (#46662).
- CKEditor 5, Tabler, Carbon, VitePress, Ionic, PatternFly, Excalidraw:
a rule of custom properties is deleted as a "duplicate" of a later rule
with the same selector and other custom properties. 37 stylesheets lose
1,681 custom properties (#33684).
- Material Components, daisyUI, DocSearch, plyr: a `var()` size loses to
its own fallback (#42101).
- nextra, daisyUI, CKEditor: declarations written after a nested rule
are moved above it (#45462).
- antd 4, purecss, govuk-frontend: browser hacks in selector lists start
to apply everywhere (#42100).
- foundation-sites, flatpickr, 98.css, blueprintjs, scalar,
react-datepicker: the build fails on valid CSS (#46756, #38552, #38534).
tachyons, handsontable: it fails on the IE star hack (#46751).
- nodejs.org, Mantine: a CSS module exports classes that no rule
defines, because the `@apply` or `@mixin` in them is moved out of the
rule (#46759).
- hint.css and 42 more: `z-index: 1000001` and `1000000` become the same
number (#46715).
- Adobe Spectrum: `--version: 5.0.1` prints as `5.1`.
- A quarter of all stylesheets: minified output has a stray space in
`align-items: center` (#41993).

#### Behavior changes to look at first

1. **`light-dark()` is kept as written at the default browser targets**
(#42009). The lowered form `var(--buncss-light, a) var(--buncss-dark,
b)` is invalid unless a compiled `color-scheme` covers the element: 184
of the 215 real stylesheets that get it never define the variable, so
every browser drops the declaration. The docs section on the polyfill is
removed.
2. **`border` is not built from longhands** (#42072):
`border-width:0;border-style:solid;border-color:red` stays three
declarations, because `border` also resets `border-image`. 305 real
stylesheets grow by 30 KB in total; `bootstrap.min.css` by 113 bytes, 5
gzipped. No real stylesheet was found where the old merge shows, so this
is the one to drop if size matters more. 14 existing expectations
change.
3. **A CSS module no longer exports names that only occur inside
`:global(...)`** (#45487). 73 real modules lose 202 export keys, all of
them names that no rule has. `import { g }` or `composes: g` of such a
name becomes a build error.
4. **Container names and `@counter-style` names stay global in a CSS
module** (#45247 by @mikamikasuki). `main` hashes the `@container` name
but not `container-name`, so a named query never matches.
postcss-modules (Vite, css-loader, Next.js) keeps them global;
lightningcss and esbuild hash both. Global keeps a container that is
queried from another file or from JS working.
5. **Syntax errors are build errors, also two that `main` lets
through**: a media query that stops short (`@media screen and {`,
`@media not {`, `@import "a.css" screen and;`) and `@media (width <) foo
{`. No stylesheet of the 10,116 has either. A condition that is valid by
the grammar though no browser knows it, `( ... )` or `fn( ... )`, is
kept as written (#46756): `(min-width:0\0)`, `(not(hover))`.
6. **Declarations after a nested rule stay where they were written**, as
a nested declarations rule (#45462). Changes the output of 199 real
stylesheets; in a fuzz of 2,850 nested programs compared by computed
style, `main` was wrong in 1,056 and the pull request's code, before it
was trimmed here, in none.
7. **`Bun.color`**: `color()` inputs are converted instead of returned
as a string (`Bun.color("color(srgb 1 0 0)", "hex")` was `"color(srgb 1
0 0)"`); `currentColor`, system colors and `light-dark()` give `null` in
the converting formats instead of the keyword as a string; a relative
color or `color-mix()` outside sRGB is clipped, not gamut-mapped
(`hsl(from oklch(100% .399 336.3) h s l)` is `#ff5bff`, was `#fff`).
8. The `:-moz-any()` and `:-webkit-any()` copies of rules with `:is()`
are gone at the default targets (#45945, #42029). The `:-webkit-any()`
copy outranked the original rule: `.title{color:blue}
:is(h1,h2,h3){color:red}` painted red. 5.8% of all default-target output
was the `:-moz-any()` copies.
9. `Property` grows from 216 to 224 bytes: `Url` stores its text as a
slice so that two `url()` values can be compared (#46895). The pull
request packed a pointer and a `u32` behind `unsafe` to avoid that.

#### Not in this PR, needs a decision

- **Raise the default browser targets (#40369) and add a `cssTarget`
option (#40368).** Today: Chrome 80, Edge 80, Firefox 78, Safari 14,
Opera 67, and no public way to change them. At Vite 8's floor the output
of the 9,924 stylesheets is 15.3% smaller (3.9% gzipped). About a dozen
fixes here only matter at today's floor, and code for older targets is
unreachable without the option.
- Vendor prefixes for `user-select`, `appearance`, `hyphens` and five
more (#45814): 1,116 real stylesheets lack a prefix they need at the
default targets. And for `backdrop-filter` (#44648): 173.
- Clip instead of gamut-map in the sRGB fallback of a plain wide-gamut
color: deletes about 90 lines, changes every pinned fallback hex. If the
mapping stays, #44647 by @oddharsh makes it closer to what browsers
paint (colors off by 2/255 or more: 168 to 110 of 3,170 real ones).

#### Changes

**Rules: duplicates, merging, nesting, fallbacks**

- The `:-moz-any()` copy of every rule with `:is()` or `:not(a, b)` is
gone: Firefox 78 has `:is()` (#45945). 1,164 real stylesheets
- Keep declarations written after a nested rule in place with a nested
declarations rule (#45462). 379 real stylesheets
- With nesting compiled away, an unknown at-rule inside a style rule was
moved out of it: `.wrapper{@apply flex}` printed a bare `@apply flex;`
and the rule was gone, so a CSS module exported a class that no rule
defines. It now stays in a block under the compiled selector. 72 real
modules with Tailwind's `@apply`, 25 with Mantine's `@mixin` (#46759).
316 real stylesheets
- Keep !important in the rules generated for logical properties and
color-scheme (#38597). 311 real stylesheets
- With browser targets, remove an earlier duplicate rule only when its
declaration block is equal (#46861). 171 real stylesheets
- Compare custom property names in `PropertyId` equality and importance
in duplicate-rule detection (#33684). 40 real stylesheets
- Keep same-condition @supports rules and empty named @layer blocks
(#46733). 31 real stylesheets
- Keep target-added vendor prefix passes on cloned and re-minified
rules, and never print a bare `:full-screen` (#43339). 12 real
stylesheets
- Keep the selectors on rules added for color fallbacks and logical
properties (#43240). 3 real stylesheets
- A later declaration of a property drops the `@supports` color copies
of the earlier one, which printed after the rule and won (#45560). 2
real stylesheets
- Do not merge style rules in a stylesheet that holds `revert-rule`
(#46953). 1 real stylesheets
- `@import ... supports(-webkit-mask: none)` kept its prefix (#38589)

**Properties and shorthands**

- Print align-items:center without a stray space when no safe/unsafe
keyword is given (#41993). 3,317 real stylesheets
- Emit the physical longhands instead of the inset shorthand for targets
without it (#38583). 1,452 real stylesheets
- Keep the stops of an upward gradient as written, and drop a `50%` hint
only at the midpoint (#46790). 104 real stylesheets
- Emit unparsed border-block-* declarations when compiling logical
borders (#38582). 89 real stylesheets
- Keep repeated font families and dedupe only the inserted system-ui
fallbacks (#46662). 88 real stylesheets
- A `width` / `height` / `min-*` / `max-*` with `var()` or `env()` was
printed before the plain fallback written above it, so the fallback won
(#42101). 26 real stylesheets
- Keep box-orient and box-direction when flex-direction or flex-flow
follows (#45672). 16 real stylesheets
- Write held prefixed background declarations at every flush (#46882). 6
real stylesheets
- Derive equality for Size2D and BorderRadius, and keep every prefix in
the border-radius handler (#45665). 2 real stylesheets
- Print `none` instead of an empty border-image, mask-border or
mask-box-image value (#45143). 2 real stylesheets
- Keep font/transition sub-properties on the side of the shorthand they
were written on (#41990). 2 real stylesheets
- CSS-wide keywords are not names: `font:12px Arial;font-family:inherit`
printed `font:12px inherit`, `color-scheme:inherit` and
`color-scheme:auto` printed `normal`, `transition-property:unset` was
folded into `transition` (#42022). 2 real stylesheets
- Only fold font longhands into `font` when the rule declared a `font`
(#45459)
- Keep a font family name quoted when its identifiers do not read back
as the same name (#46606)
- Stop rewriting valid positions into ones browsers reject (#45197)
- `border` is no longer built from longhands unless the rule also sets
what `border` resets (`border-image`), and an author's `border-image`
reset is no longer dropped. `transition` is likewise only written where
the rule wrote one, because it resets `transition-behavior` (#42072)
- `border; border-image: <gradient>; border-image-slice: 1` lost the
gradient in every default build (#42018)
- A prefixed `linear-gradient` keeps its direction, written or
generated: the prefixed syntax names the starting side and measures
angles differently (#46697)

**At-rules**

- Print @font-face format() keywords as strings (#37979). 439 real
stylesheets
- Print @supports `not` conditions without a leading space (#38559). 88
real stylesheets
- Reset after the number token of a unicode-range (#45835). 33 real
stylesheets
- Keep `<general-enclosed>` media and container conditions as written
(#46756). 24 real stylesheets
- A strict range such as `(width < 768px)` lowered for old targets still
matched at exactly 768px. The step is now `.02px`. The `not all and`
form for other units is not taken (#46806). 18 real stylesheets
- Keep scanning an @supports condition after a nested block (#38552). 9
real stylesheets
- Every `@counter-style name` printed as `@counter-stylename`, which
browsers drop (also #46692). In a CSS module the name now stays global,
like the `list-style` that refers to it (#33679). 9 real stylesheets
- Keep a keyframe whose block has an invalid item (#46288). 2 real
stylesheets
- Read an @Property initial-value on the stylesheet's parser, keep an
unmatched value as written (#45806). 2 real stylesheets
- `@media {}` is `all`. A media query that stops after `and`, `or` or
`not` (`@media screen and {`) is a build error; `main` printed `not all`
or dropped the condition, silently. The `@layer` and type selector parts
are not taken (#46869). 2 real stylesheets
- Accept a name-only `@container` and a `style()` feature with no value
(#46689). 1 real stylesheets
- Parse `<timeline-range-name> <percentage>` keyframe selectors (#45652)
- Allow `or` inside parentheses after a media type (#45088)
- Print the `=` comparison in media and container queries as `=`
(#45071)
- Parse the @font-palette-values font-family descriptor as a list of
family names (#45484)

**Selectors**

- Never wrap a selector list in :is() (#46787). 414 real stylesheets
- Stop emitting :-webkit-any() copies of :is() that outrank the original
rule (#42029). 373 real stylesheets
- With browser targets, a selector list with a vendor-prefixed member
was split, which revives hacks that rely on other engines dropping the
whole list: `.s *::-ms-backdrop,.s{flex:auto}` applied everywhere.
Rewritten; the list is printed as written (#42100). 42 real stylesheets
- Print the vendor prefix on downleveled :any-link, :read-only,
:read-write, :placeholder-shown and :autofill (#42131). 12 real
stylesheets
- Fix nesting lowering of a `&` that does not lead its selector
(#43047). 8 real stylesheets
- `@scope`: `&` and implicit selectors compile to `:where(:scope)`,
relative selectors and bare declarations parse (#43165). 7 real
stylesheets
- Only reject bare :global / :local pseudo-classes in CSS modules
(#38534). 5 real stylesheets
- Stop truncating `@scope to (...)` and stop replacing `&` in the
scope-end selector (#43146). 2 real stylesheets
- `[xl|href$=".pdf"]` lost its namespace prefix (#45159). 2 real
stylesheets
- Match An+B keywords exactly and take only `+` as the leading sign
(#42953). 1 real stylesheets
- Parse ::details-content and ::picker() like ::part() (#45504). 1 real
stylesheets
- Parse :window-inactive as an ordinary pseudo-class, and accept it
after ::selection (#45815)
- Print :nth-col(1) and :nth-last-col(1) in functional form (#41575)
- `li::before::marker` failed the build (#45810)
- `&` inside `:nth-child(... of S)` is resolved when nesting is compiled
away. The second selector serializer (326 lines) is deleted (#43024)

**Colors and `Bun.color`**

- Keep light-dark() as written under the default browser targets
(#42009). 227 real stylesheets
- Number and percentage channels parse in `lab()`, `lch()`, `oklab()`,
`oklch()`, `hsl()` and `hwb()`; the hue of `lch` / `oklch` is no longer
scaled by alpha (#45084). 130 real stylesheets
- `Bun.color` returns `null` for `currentColor`, system colors and
`light-dark()` in the converting formats, instead of the CSS keyword as
a string (#33047). 130 real stylesheets
- Relative colors: channel keywords are on the scale of their function
(`rgb(from #369 calc(r + 10) g b)`), the origin's alpha is kept, a
relative color kept as written gets no `@supports` copies, and a result
outside sRGB is not folded (#45362). 31 real stylesheets
- Keep rotate: 0deg out of none, and keep the origin alpha in relative
colors (#38486). 13 real stylesheets
- Compute the D50 reference white in f32 so greys convert to lab(l 0 0)
like lightningcss (#38535). 7 real stylesheets
- Return a missing hue for a grey from conversions into lch, oklch, hsl
and hwb (#45201). 5 real stylesheets
- Fix color(a98-rgb), srgb-linear relative colors and color-mix(in
xyz-d50) (#38487). 4 real stylesheets
- Match named colors without regard to ASCII case (#45092). 3 real
stylesheets
- Fold min(), max() and clamp() over plain numbers (#39515)
- `calc(l - .08)` in a percentage channel of a relative color became NaN
and printed `#000` (also #45970) (#45971)
- Bun.color: convert color() inputs instead of returning them as a CSS
string (#38488)
- A `color-mix(in srgb, ...)` result outside sRGB prints `color(srgb
...)` instead of a gamut-mapped hex (#39269)

**`calc()` and numbers**

- Rounding to 6 significant digits ate into the integer part:
`z-index:2147483647` became `2147480000`, `max-width:9999999px` became
`10000000px`, `--x:1234567.5` became `1234570`. It now only cuts a
fraction short: a value kept as tokens prints its source text, a typed
value prints every integer digit and at least one digit of the fraction
(#46715). 43 real stylesheets
- A number without a unit is no longer repaired into `px`
(`height:1.5715` is dropped by a standards-mode browser, so it prints as
written), `calc(-1 * 0)` is not a length, and on a property of the range
[0,∞] (sizes, border radii, padding, border and outline widths, gap,
`flex-basis`, `font-size`) a `calc()` that folds below zero prints `0`
instead of an invalid negative literal, and a negative literal no longer
replaces the valid declaration before it (`width:10px;width:-5px`
printed `width:-5px`) (#42104). 24 real stylesheets
- Print numbers from the f32's shortest digits, not its f64 expansion
(#38565). 17 real stylesheets
- Print negative numbers below 1 with a single minus sign (#38516)
- Keep math functions over two different length units as written
(#38489)
- Fold rem() with a truncated quotient, so it keeps the sign of the
dividend (#32286)
- A one-argument `min()` / `max()` around a sum printed without any
function (`width:100% - 20px`) (#46145)
- `round()` breaks ties upward and handles a negative step as browsers
do (#45249)

**CSS modules**

- A CSS module exports its `@keyframes` names (`styles.spin`). Hashing
is unchanged (#46720). 145 real stylesheets
- A name inside `:global(...)` prints plain but was exported as
`name_<hash>`, a class no rule has (also #38573) (#45487). 90 real
stylesheets
- Keep container names global in CSS modules (#45247). 6 real
stylesheets
- Tag the keyframes name when an `animation` value falls back to raw
tokens (#46034). 6 real stylesheets
- In a plain stylesheet `composes: a from "./b.css"` was treated as an
import: the file was inlined and an absolute path printed (#45961). 4
real stylesheets
- Drop a rejected composes instead of failing the file at print time
(#38538). 1 real stylesheets
- Keep every rule's custom properties for the composes conflict check
(#38523)
- Keep composes working after a nested rule in the same block (#38520)
- `IdentOrRef::hash` read 2 of 16 bytes, so in release builds every
class of a module hashed alike (#30784)

**Tokens, `url()`, diagnostics**

- The block skip stack no longer allocates on every block exit (#39533)
- Report the diagnostic's line without its line breaks in
position.lineText (#38342). 192 real stylesheets
- Compare `url()` values by their text (#46895). 26 real stylesheets
- Values kept as tokens keep the blanks they were written with instead
of having them re-invented at print time: `attr(x type(<number>))`
printed `type(< number> )`, which browsers drop. Minified output still
drops the blanks that cannot matter (#45577). 19 real stylesheets
- The IE star hack (`*zoom:1`) failed the whole build. The declaration
is skipped, as every browser does. It is the one syntax error that
builds: tachyons, handsontable and jasmine ship it (#46751). 8 real
stylesheets
- The path of a copied asset spliced into `url()` is always quoted, so a
file name with a space or a parenthesis cannot end the `url()` (#41557).
7 real stylesheets
- Move the skip loop of parse_until_before out of the generic body
(#39520)
- Remove dead code from bun_css: the unused `impl Default for Property`
(#45618)
- Default the at-rule and qualified-rule parser traits, drop the
url_to_css shim (#31999)

**Speed**

Four inputs that took quadratic or exponential time, or produced output
out of proportion, are now linear, with no new limit and no extra pass
(#31639, #42243, #38531, #43421).

**Tests only**

- `css-fuzz.test.ts` never ran in CI and timed out on debug builds; it
is a deterministic table now (#38500)
- `nth-anplusb-ident.test.ts` counts heaps in a child process (#46331)
- `color.test.ts` checks the ansi-16 sweep with one `expect()` (#42824)
- Not CSS, but it failed this PR's CI and fails on `main` too:
`ws-proxy.test.ts` on Windows, "a message sent during a TLS
renegotiation arrives after it". The helper server now renegotiates from
the callback of the frame's write (#46170)

**No pull request covered these**

- `--v: 5.0.1` printed as `5.1`, `--w: 1.0.0` as `10`, `--x: 1+2` as
`12`, `2n+1` as `2n1`: a number token that touches another keeps its
source text.
- `color-scheme: auto` printed as `normal`, and `color-scheme: dark
light` as `light dark`.
- A bare `:global` or `:local` in a CSS module sets the scope of the
names after it, up to the end of the selector, as in css-loader. It was
a build error.
- The scrollbar states (`a:horizontal`,
`::-webkit-scrollbar{&:horizontal{}}`) are valid in a plain compound, as
in WebKit and Blink.
- Without browser targets, `-webkit-box-align`, `-ms-flex-align` and the
like were dropped next to their standard form (flatpickr,
foundation-sites, materialize-css: 28 stylesheets), and
`-webkit-fill-available` before `-moz-available` (beercss).
- `(-o-min-device-pixel-ratio: 2/1)` printed as `2`.
- `sin()`, `cos()` and `tan()` are exact at multiples of 90deg:
`calc(100px * cos(90deg))` printed `-.00000437114px`.
- A `display-p3` color at targets that have P3 but not the other
`color()` spaces (Safari 10.1 to 14) got itself as a fallback.
- `width: rem(-18px, 5px)` folds to a negative literal once `rem()` is
right; it prints `0`.
- Consecutive nested declarations rules, which arise when same-query
`@media` blocks in one rule merge, are folded into one and count against
the existing selector expansion limit as the `&{}` rules they replace
did.

#### Known and not fixed here

- Four longhands are still folded into a `transition` the author did not
write where the targets add a prefixed copy of a property (`mask-image`
at Chrome 80): only the shorthand gives the copy its own times.
- A later `background`, `box-shadow` or `border-*` declaration still
loses to the `@supports` copy of an earlier `var()` value of the same
property with a wide-gamut color. Same on `main`; #45560 is taken for
the properties of the fallback handler and for unparsed values only.
- A merged rule prints the unprefixed name in the passes of the rule it
absorbed: `.d::-webkit-input-placeholder{}.d::-moz-placeholder{}` prints
`::placeholder` for the second (#42106, not taken: it breaks the merge
of prefix-equivalent rules).
- The `border`, `outline` and `font` shorthands, `line-height`,
`scroll-padding`, `background-size` and a few more still print a
`calc()` that folds below zero as a negative literal. No real stylesheet
has one.
- `all` is not a property Bun knows, so `a{margin-top:1px;all:unset}`
prints `all` first. Same on `main`.
- A selector kept as raw tokens loses the blank before `*` when
minified: `--sel: .dark *` prints `.dark*`. Same on `main`.
- `width:calc(0% + 12px)` folds to `12px`, which lays out differently in
a table cell. Same on `main`.
- The `:dir()` / `:lang()` rules of a lowered logical property print
before the nested rules of their rule, so a logical declaration written
after a nested rule of equal specificity still loses to it. Same on
`main`.
- A fraction is still rounded to 6 significant digits (`12345.678`
prints `12345.7`, `33.3333333333%` prints `33.3333%`). Keeping every
digit would add up to 282 KB over the corpus.
- `@keyframes "quoted"` is hashed in a module but not exported.
- In a module, a keyframes name inside a `var()` fallback is not hashed:
`animation: var(--enter, fade 1s)`. Same on `main`.
- A `color-mix()` or relative color folded to a hex inside a gradient
changes the interpolation from Oklab to sRGB (VS Code, clawhub).
Printing `color(srgb ..)` instead needs a fallback for `mask-image`,
`list-style-image` and custom properties at the default targets, which
have none.
- A comma list in `@container` still fails the build.
- After a bare `:global`, names that are hashed at print time
(`::view-transition-old(foo)`) are still hashed; inside `:global(...)`
they are not.

#### Pull requests in scope that do not land here

- Duplicates of a pull request that lands here: #36961 (of #37979),
#38478 (of #46662), #38480 (of #46733), #38482 (of #46715), #38491 (of
#38500), #38508 (of #45201), #38513 (of #45362), #38573 (of #45487),
#38640 (of #38500), #45525 (of #45247), #45589 (of #46756), #45970 (of
#45971)
- Already fixed on `main`: #38674
- Right, but for input nobody writes (0 of 10,116 stylesheets, and not
new syntax): #31916, #38526, #38592, #39349, #41139, #41801, #42042,
#42484, #43078, #45604, #45908, #46086, #46221, #46224, #46273, #46694,
#46707, #46737, #46755, #46816, #46870, #46934
- Right or harmless, but not worth their code, their bigger output or
the behavior they change: #30905, #31924, #33332, #34426, #36225,
#38006, #38512, #38547, #38551, #38561, #38572, #38576, #38607, #38623,
#38667, #38692, #42106, #42912, #42918, #43407, #43434, #44700, #45442,
#45546, #45747, #45759, #45825, #45946, #46061, #46127, #46206
- Need a decision (see above), stay open: #40368, #40369, #44647,
#44648, #45814
- Stays open: #45787

Out of scope: CSS linking and chunking in the bundler, the dev server,
docs-only pull requests, and repository-wide sweeps that touch `src/css`
in passing.

Thanks to @mikamikasuki (#45247), @alii (#39520, #31999) and @oddharsh,
whose measurements on #40369 and #41990 were used.

Fixes #16727.
Fixes #24770.
Fixes #30772.
Fixes #44704.
Fixes #45089.
Fixes #45237.
Fixes #46872.

### How did you verify your code works?

- The 35 CSS test files pass on a debug build, also with
`FORCE_COLOR=1`. 600+ of the tests in this branch fail on a build of
`main`. An earlier head of this branch passed all 179 CI jobs that ran.
- The reproduction of each issue listed above was run on `main` (wrong)
and on this branch (right).
- Differential run over the 10,116 stylesheets, `main` against this
branch, minified without targets and through `Bun.build` at the default
targets: no stylesheet that builds on `main` fails; Chromium 156
compares the output with the input rule by rule (CSSOM, then computed
values on a sized element in a standards-mode document, colors as
painted pixels in sRGB and P3). The comparison has 195 control pairs
that must read equal or different. For stylesheets that read differently
on both builds, mostly because of lowering, the sets of differences were
compared; the three new ones are two minifier fixtures that are wrong on
both and one comparison artifact.
- CSS modules are checked for consistency instead, since hashed names
defeat the comparison: every reference points at a name the output
defines, every export exists.
- `Bun.color`: 59 inputs in 13 formats on both builds; every changed
cell was read.
@Jarred-Sumner

Copy link
Copy Markdown
Collaborator

Landed in #47025 (7942008).

Compare url() values by their text. 26 real stylesheets

@robobun

robobun commented Oct 27, 2026

Copy link
Copy Markdown
Collaborator Author

Checked main at 7942008 with a release build.

  • .a{background:url(data:,a)}.b{background:url(data:,a)} prints .a,.b{background:url(data:,a)}.
  • The output of a rebuild no longer grows. Six builds in a row of .a:autofill:not(.b,.c){background:url(data:,a)} and of .a:not(.b,.c){color:lab(none 0 0)} give 2, 3, 3, 3, 3, 3 rules.
  • .a{height:100vh}.z{top:0}.a{height:100dvh} prints all three rules with the browser target and with --target bun.

One case from the #46861 thread is the same as before #47025: .a::-moz-selection{color:red}.a::selection{color:red}.z{top:0}.a::-moz-selection{color:red} prints .z{top:0}.a::-moz-selection{color:red}, so .a::selection is lost. I found no published stylesheet with that shape in 3,942 npm stylesheets, so I do not open a PR for it unless it is wanted.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants