css: bound raw-token expansion when compiling nesting for older targets

src/css/css_parser.rs

@@ -2595,6 +2595,7 @@ mod stylesheet_impl {
                 err: None,
                 selector_expansion_multiplier: 1,
                 selector_expansion_total: 0,
+                token_expansion_total: 0,
             };
 
             if self.rules.minify(&mut minify_ctx, false).is_err() {

src/css/declaration.rs

@@ -91,6 +91,25 @@ impl<'bump> DeclarationBlock<'bump> {
         self.declarations.len() + self.important_declarations.len()
     }
 
+    /// Recursive `TokenOrValue` count across every unparsed / custom
+    /// property in this block. Other property kinds are fixed-size values
+    /// whose clone cost is already bounded by the selector-expansion cap.
+    /// See [`css_rules::MAX_TOKEN_EXPANSION`](crate::css_rules::MAX_TOKEN_EXPANSION).
+    pub fn token_weight(&self) -> usize {
+        fn one(p: &css::Property) -> usize {
+            match p {
+                css::Property::Unparsed(u) => u.value.token_weight(),
+                css::Property::Custom(c) => c.value.token_weight(),
+                _ => 0,
+            }
+        }
+        self.declarations
+            .iter()
+            .chain(self.important_declarations.iter())
+            .map(one)
+            .sum()
+    }
+
     pub fn new_in(bump: &'bump Bump) -> Self {
         Self {
             important_declarations: DeclarationList::new_in(bump),

src/css/error.rs

@@ -515,6 +515,10 @@ pub enum MinifyErrorKind {
     /// Compiling nested rules for the configured browser targets would expand to
     /// more than [`crate::css_rules::MAX_SELECTOR_EXPANSION`] selectors.
     selector_expansion_limit_exceeded,
+    /// Compiling nested rules for the configured browser targets would clone
+    /// unparsed property values totalling more than
+    /// [`crate::css_rules::MAX_TOKEN_EXPANSION`] raw tokens.
+    token_expansion_limit_exceeded,
     /// Rule minification failed without recording a more specific diagnostic on
     /// `MinifyContext::err`. Defensive fallback — every failing path is expected
     /// to record one before returning an error.
@@ -540,6 +544,11 @@ impl fmt::Display for MinifyErrorKind {
                 "Nested CSS rules expand to more than {} selectors when compiled for the configured browser targets. Reduce the nesting depth or the number of selectors per rule, or target browsers that support CSS nesting.",
                 crate::css_rules::MAX_SELECTOR_EXPANSION,
             ),
+            Self::token_expansion_limit_exceeded => write!(
+                f,
+                "Nested CSS rules expand to more than {} raw property tokens when compiled for the configured browser targets. Reduce the nesting depth, the number of selectors per rule, or the size of unparsed property values, or target browsers that support CSS nesting.",
+                crate::css_rules::MAX_TOKEN_EXPANSION,
+            ),
             Self::unknown => write!(f, "CSS minification failed"),
         }
     }

src/css/properties/custom.rs

@@ -815,6 +815,40 @@
         res
     }
 
+    /// Number of `TokenOrValue` nodes in this list, counting through nested
+    /// `Function`/`var()`/`env()`/`light-dark()` etc. so the result reflects
+    /// the allocation a `deep_clone` of this list performs. Used by the
+    /// minify-time token-expansion budget (see
+    /// [`css_rules::MAX_TOKEN_EXPANSION`](crate::css_rules::MAX_TOKEN_EXPANSION)).
+    pub fn token_weight(&self) -> usize {
+        let mut n = self.v.len();
+        for t in self.v.iter() {
+            match t {
+                TokenOrValue::Function(f) => n += f.arguments.token_weight(),
+                TokenOrValue::Var(v) => {
+                    if let Some(fallback) = &v.fallback {
+                        n += fallback.token_weight();
+                    }
+                }
+                TokenOrValue::Env(e) => {
+                    if let Some(fallback) = &e.fallback {
+                        n += fallback.token_weight();
+                    }
+                }
+                TokenOrValue::UnresolvedColor(c) => match c {
+                    UnresolvedColor::RGB { alpha, .. } | UnresolvedColor::HSL { alpha, .. } => {
+                        n += alpha.token_weight();
+                    }
+                    UnresolvedColor::LightDark { light, dark } => {
+                        n += light.token_weight() + dark.token_weight();
+                    }
+                },
+                _ => {}
+            }
+        }
+        n
+    }
+
     pub fn get_necessary_fallbacks(&self, targets: &css::targets::Targets) -> ColorFallbackKind {
         let mut fallbacks = ColorFallbackKind::empty();
         for token_or_value in self.v.iter() {

src/css/rules/mod.rs

@@ -1281,6 +1281,21 @@ pub struct StyleContext<'a> {
 /// instead.
 pub const MAX_SELECTOR_EXPANSION: u32 = 65_536;
 
+/// Upper bound on the number of raw `TokenOrValue` nodes that compiling
+/// nested rules for the configured targets may clone across a stylesheet.
+///
+/// Companion to [`MAX_SELECTOR_EXPANSION`]: that cap counts expanded rules,
+/// this one counts the raw-token payload those rules carry. A rule split
+/// for an incompatible selector deep-clones its declarations (and the
+/// already-expanded nested tree), so a large unparsed property value under
+/// a handful of split levels is duplicated once per expanded rule. The
+/// selector cap alone permits up to 65,536 copies, which for a
+/// multi-thousand-token value is gigabytes of `TokenOrValue` allocations
+/// long before that cap is reached. One million tokens is on the order of
+/// 100 MB of in-memory `TokenOrValue` and a few MB of printed output;
+/// real stylesheets stay far below it.
+pub const MAX_TOKEN_EXPANSION: usize = 1 << 20;
+
 /// Per-stylesheet minification state threaded through `CssRuleList::minify`
 /// and every leaf rule's `minify`.
 ///
@@ -1316,4 +1331,7 @@ pub struct MinifyContext<'a, 'bump> {
     /// Running total of selectors that compiling nested rules for the targets
     /// will expand to, checked against [`MAX_SELECTOR_EXPANSION`].
     pub selector_expansion_total: u32,
+    /// Running total of raw `TokenOrValue` nodes that compiling nested rules
+    /// for the targets will clone, checked against [`MAX_TOKEN_EXPANSION`].
+    pub token_expansion_total: usize,
 }

src/css/rules/style.rs

@@ -390,18 +390,35 @@
         context: &mut MinifyContext<'_, '_>,
     ) -> Result<(), MinifyErr> {
         if context.selector_expansion_multiplier > 1 {
-            context.selector_expansion_total = context.selector_expansion_total.saturating_add(
-                context
-                    .selector_expansion_multiplier
-                    .saturating_mul(self.selectors.v.len().max(1)),
-            );
+            let copies = context
+                .selector_expansion_multiplier
+                .saturating_mul(self.selectors.v.len().max(1));
+            context.selector_expansion_total =
+                context.selector_expansion_total.saturating_add(copies);
             if context.selector_expansion_total > super::MAX_SELECTOR_EXPANSION {
                 context.err = Some(crate::error::MinifyError {
                     kind: crate::error::MinifyErrorKind::selector_expansion_limit_exceeded,
                     loc: self.loc,
                 });
                 return Err(MinifyErr::minify_err);
             }
+            // Same expansion multiplies this rule's unparsed/custom property
+            // token lists. A large raw value under the selector cap still
+            // deep-clones into gigabytes of `TokenOrValue`, so budget the
+            // token payload separately.
+            let weight = self.declarations.token_weight();
+            if weight > 0 {
+                context.token_expansion_total = context
+                    .token_expansion_total
+                    .saturating_add((copies as usize).saturating_mul(weight));
+                if context.token_expansion_total > super::MAX_TOKEN_EXPANSION {
+                    context.err = Some(crate::error::MinifyError {
+                        kind: crate::error::MinifyErrorKind::token_expansion_limit_exceeded,
+                        loc: self.loc,
+                    });
+                    return Err(MinifyErr::minify_err);
+                }
+            }
         }
         Ok(())
     }

test/js/bun/css/nested-selector-list-expansion.test.ts

@@ -14,9 +14,10 @@ import { bunEnv, bunExe, tempDir } from "harness";
 // plain `bun build` since the default bundler targets predate `:is()` and
 // native nesting. The minifier now bounds the expansion and reports an error.
 
-const { minifyTest, prefixTest } = cssInternals;
+const { minifyTest, prefixTest, _test } = cssInternals;
 
 const LIMIT_ERROR = "Nested CSS rules expand to more than";
+const TOKEN_LIMIT_ERROR = "raw property tokens when compiled for the configured browser targets";
 
 // `outer` plain-nested two-selector rules, then `atRule`'s block, then `inner`
 // more nested two-selector rules. The blocks are left unclosed (the CSS parser
@@ -263,3 +264,129 @@ test("bun build does not hang on deeply nested multi-selector css spanning @star
   expect(exitCode).toBe(1);
   expect(await Bun.file(`${dir}/out/input.css`).exists()).toBe(false);
 });
+
+// Regression test for unbounded token-list cloning when compiling CSS nesting
+// for browser targets that don't support it.
+//
+// The selector-expansion cap counts the number of rules the expansion
+// produces, but each split rule also deep-clones its declarations. An
+// unparsed property value (any value the property-specific parser couldn't
+// read) is stored as a raw TokenList and copied in full for every clone, so
+// a few thousand tokens under ten ::part()-selector nesting levels expanded
+// into gigabytes of in-memory tokens while the selector count stayed well
+// under its 65,536 cap. Found by fuzzing. The minifier now bounds the total
+// cloned-token count and reports an error.
+
+/** `depth` nested ::part() rules with a large unparsed `color:` value at the
+ * bottom. `::part()` is a pseudo-element so the selector list can never be
+ * collapsed into `:is()`; each level is split into one cloned rule per
+ * selector, and the clone carries a full copy of the inner value. */
+function nestedWithLargeUnparsedValue(depth: number, tokens: number): string {
+  // `x ` parses to two tokens (ident + whitespace); the unknown function
+  // `f(...)` around it keeps the whole thing one raw TokenList.
+  const payload = Buffer.alloc(tokens * 2, "x ").toString();
+  return (
+    "x::part(a), y::part(b) {\n".repeat(depth) +
+    ".inner { color: f(" +
+    payload +
+    "var(--x)) }\n" +
+    "}\n".repeat(depth)
+  );
+}
+
+test("nested selector splits with a large unparsed value error instead of exploding (minify)", () => {
+  // 8 two-selector levels = 256 copies of a ~6000-token value = ~1.5M tokens,
+  // past the 1M cap. Before the fix this emitted ~800 KB of output (and at
+  // slightly larger depths allocated gigabytes before the selector cap was
+  // reached).
+  const src = nestedWithLargeUnparsedValue(8, 3000);
+  expect(() => minifyTest(src, "", OLD_TARGETS)).toThrow(TOKEN_LIMIT_ERROR);
+});
+
+test("nested selector splits with a large unparsed value error instead of exploding (prefix)", () => {
+  const src = nestedWithLargeUnparsedValue(8, 3000);
+  expect(() => prefixTest(src, "", OLD_TARGETS)).toThrow(TOKEN_LIMIT_ERROR);
+});
+
+test("nested selector splits with a large unparsed value error instead of exploding (_test)", () => {
+  // The fuzzer entrypoint.
+  const src = nestedWithLargeUnparsedValue(8, 3000);
+  expect(() => _test(src, "", OLD_TARGETS)).toThrow(TOKEN_LIMIT_ERROR);
+});
+
+test("nested selector splits with a large unparsed value below the token limit still compile for old targets", () => {
+  // 6 levels = 64 copies of ~6000 tokens = ~384K tokens, under the 1M cap.
+  const src = nestedWithLargeUnparsedValue(6, 3000);
+  const out = minifyTest(src, "", OLD_TARGETS);
+  expect(out).toContain("var(--x)");
+  expect(out.length).toBeLessThan(1_000_000);
+});
+
+test("unparsed-value output below the token limit is unchanged by the cap", () => {
+  // Shallow enough that neither cap applies: the cap must not affect what
+  // valid expansions emit.
+  const src = nestedWithLargeUnparsedValue(2, 20);
+  expect(minifyTest(src, "", OLD_TARGETS)).toMatchInlineSnapshot(
+    `":is(x::part(a),y::part(b)) x::part(a) .inner{color:f(x x x x x x x x x x x x x x x x x x x x var(--x))}:is(x::part(a),y::part(b)) y::part(b) .inner{color:f(x x x x x x x x x x x x x x x x x x x x var(--x))}"`,
+  );
+});
+
+test("large unparsed values are preserved as-is for targets that support CSS nesting", () => {
+  // No split, no clone: the input passes through with native nesting intact
+  // regardless of value size.
+  const src = nestedWithLargeUnparsedValue(12, 3000);
+  const out = minifyTest(src, "", MODERN_TARGETS);
+  expect(out).toContain("var(--x)");
+  expect(out.length).toBeLessThan(20_000);
+});
+
+test("large unparsed values are preserved as-is when no targets are configured", () => {
+  const src = nestedWithLargeUnparsedValue(12, 3000);
+  const out = minifyTest(src, "");
+  expect(out).toContain("var(--x)");
+  expect(out.length).toBeLessThan(20_000);
+});
+
+test("token limit still applies when the large unparsed value sits inside a context-preserving at-rule", () => {
+  // Same `@starting-style` hiding mechanism as the selector-cap tests above:
+  // the token charge must follow the multiplier through the at-rule.
+  const payload = Buffer.alloc(6000, "x ").toString();
+  const src =
+    "x::part(a), y::part(b) {\n".repeat(4) +
+    "@starting-style {\n" +
+    "x::part(a), y::part(b) {\n".repeat(4) +
+    ".inner { color: f(" +
+    payload +
+    "var(--x)) }";
+  expect(() => minifyTest(src, "", OLD_TARGETS)).toThrow(TOKEN_LIMIT_ERROR);
+});
+
+test("bun build reports an error instead of OOMing on deeply nested selectors with a large unparsed value", async () => {
+  using dir = tempDir("css-token-expansion", {
+    // 12 levels and a ~6000-token value: before the fix this allocated on the
+    // order of a gigabyte of cloned TokenOrValue before reaching the selector
+    // cap.
+    "input.css": nestedWithLargeUnparsedValue(12, 3000),
+  });
+  await using proc = Bun.spawn({
+    cmd: [bunExe(), "build", "input.css", "--outdir", "out", "--minify"],
+    env: bunEnv,
+    cwd: String(dir),
+    stdout: "pipe",
+    stderr: "pipe",
+    // Kill switch for a regression: before the fix this allocated past the
+    // container's memory budget, so let the child terminate itself instead of
+    // hanging the runner.
+    timeout: 20_000,
+    killSignal: "SIGKILL",
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+  // Must terminate on its own (reporting the limit error), not be SIGKILLed
+  // by the timeout or OOM-killed by the OS.
+  expect({ signalCode: proc.signalCode, stderr, stdout, exitCode }).toMatchObject({
+    signalCode: null,
+    stderr: expect.stringContaining(LIMIT_ERROR),
+    exitCode: 1,
+  });
+  expect(await Bun.file(`${dir}/out/input.css`).exists()).toBe(false);
+});