Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: bd7ffafffdad6b3d68373b526c0939a71313aa67
https://github.com/WebKit/WebKit/commit/bd7ffafffdad6b3d68373b526c0939a71313aa67
Author: Kiet Ho <[email protected]>
Date: 2026-08-14 (Fri, 14 Aug 2026)
Changed paths:
M
LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/pseudo-elements-005-expected.txt
M Source/WebCore/style/ContainerQueryEvaluator.cpp
M Source/WebCore/style/ContainerQueryEvaluator.h
M Source/WebCore/style/StyleTreeResolver.cpp
M Source/WebCore/style/StyleTreeResolver.h
Log Message:
-----------
[css-conditional-5] @container style queries on pseudo-element's host element
uses old style data
rdar://183158814
https://bugs.webkit.org/show_bug.cgi?id=320220
Reviewed by Antti Koivisto.
During style resolution, new styles aren't committed to the render tree right
away.
Instead, they're packaged into a Style::Update, and once style resolution
completes,
it's passed to RenderTreeUpdater to update the styles in the render tree.
@container
style queries should be evaluated against the newest style of the container
element.
But the queries are evaluated during style resolution, when new styles aren't
committed
to the render tree yet. Hence evaluating against the current (stale) render
style might
lead to incorrect results.
ContainerQueryEvaluator has a clever workaround: it has access to the
Style::Update
object, so it gets the freshest possible style of a container element from
there,
and falls back to the render style if a style isn't in Update. The Update
object is
threaded from TreeResolver -> TreeResolver::Scope -> SelectorMatchingState
-> ContainerQueryEvaluationState -> used by Style::styleForContainer to get the
style
for style query evaluation.
However, during style resolution of an element, the timing when the Update
object is
updated doesn't work for @container style queries affecting a pseudo-element.
1) resolve the element's style
2) resolve its pseudo-elements' styles
2.1) @container queries are evaluated if a @container rule affects a
pseudo-element
3) the element's and its psuedo-elements' styles are addded to the Update object
When 2.1) runs, @container style queries are evaluated against the container
element,
which is the host. But the host's new style resolved in 1) is not added to the
Update
object yet, since it's only done in 3) after all pseudo-elements' styles are
resolved.
Hence ContainerQueryEvaluator will use the (stale) host's render style.
Since the order can't be change, this patch fixes the bug by maintaining our own
WeakHashMap to store freshly resolved styles. This way, we control when styles
are
added to the hashmap and aren't dependent on Update. ContainerQueryEvaluator is
changed to use this hashmap, and we thread it from TreeResolver to
ContainerQueryEvaluator
the same way the Update object is threaded before.
For memory safety, ref-count the hash map using Box<>, so we can pass its
pointers
around without fear of use-after-free.
Test:
imported/w3c/web-platform-tests/css/css-conditional/container-queries/pseudo-elements-005.html
*
LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/pseudo-elements-005-expected.txt:
* Source/WebCore/style/ContainerQueryEvaluator.cpp:
(WebCore::Style::styleForContainer):
(WebCore::Style::ContainerQueryEvaluator::featureEvaluationContextForCondition
const):
* Source/WebCore/style/ContainerQueryEvaluator.h:
* Source/WebCore/style/StyleTreeResolver.cpp:
(WebCore::Style::TreeResolver::Scope::Scope):
(WebCore::Style::TreeResolver::resolveElement):
(WebCore::Style::TreeResolver::resolve):
* Source/WebCore/style/StyleTreeResolver.h:
Canonical link: https://commits.webkit.org/319186@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
