Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: e297a5ca30f391ba691db0adfa2cae369a11122c
https://github.com/WebKit/WebKit/commit/e297a5ca30f391ba691db0adfa2cae369a11122c
Author: Ahmad Saleem <[email protected]>
Date: 2026-05-13 (Wed, 13 May 2026)
Changed paths:
A
LayoutTests/fast/css/CSSStyleDeclaration-setProperty-important-priority-change-expected.txt
A
LayoutTests/fast/css/CSSStyleDeclaration-setProperty-important-priority-change.html
M Source/WebCore/style/MatchResultCache.cpp
Log Message:
-----------
REGRESSION (Safari 26): setProperty fails to apply !important priority to
existing inline style if integer value is <= 255, breaking cascade
https://bugs.webkit.org/show_bug.cgi?id=313840
rdar://176099619
Reviewed by Antti Koivisto.
MatchResultCache snapshots each inline property as a (propertyID,
CSSValue*) pair and treats a property as unchanged when the value
pointer matches. It never captured the !important bit. CSSValuePool
interns CSSPrimitiveValue instances for integer pixel/number/percent
values 0-255, so re-applying the same value string with a flipped
priority (e.g. setProperty('width', '255px', 'important') after
setProperty('width', '255px')) yields the same pointer. The cache
concluded nothing had changed: the style builder skipped the property,
the cached RenderStyle was reused, and the stylesheet's !important
rule kept winning the cascade even though the inline declaration had
been upgraded to !important. Integer values >= 256 bypass the pool
and allocate a fresh CSSPrimitiveValue, which is why the bug only
manifests for small integers.
Track the original importance alongside the value pointer and treat
a priority flip as a change. The existing "clear on first change"
sentinel (valueIfUnchanged = nullptr) continues to force subsequent
iterations to re-run the cascade.
* Source/WebCore/style/MatchResultCache.cpp:
(WebCore::Style::MatchResultCache::Entry::Entry): Snapshot
property.isImportant() into OriginalInlineProperty::wasImportant.
(WebCore::Style::MatchResultCache::computeAndUpdateChangedProperties):
Compare wasImportant against the current priority in addition to
the value pointer.
*
LayoutTests/fast/css/CSSStyleDeclaration-setProperty-important-priority-change-expected.txt:
Added.
*
LayoutTests/fast/css/CSSStyleDeclaration-setProperty-important-priority-change.html:
Added.
Canonical link: https://commits.webkit.org/313159@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
