Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 6de57b512a758ebed5a823cef41a65fe5d0cfb08
https://github.com/WebKit/WebKit/commit/6de57b512a758ebed5a823cef41a65fe5d0cfb08
Author: Ahmad Saleem <[email protected]>
Date: 2026-10-05 (Mon, 05 Oct 2026)
Changed paths:
M Source/WebCore/style/StyleSheetContentsCache.cpp
Log Message:
-----------
StyleSheetContentsCache mismanages in-memory cache count on clear() and
duplicate add()
https://bugs.webkit.org/show_bug.cgi?id=325383
rdar://188492237
Reviewed by Antti Koivisto.
StyleSheetContentsCache tracks whether a StyleSheetContents is cached via
StyleSheetContents::m_inMemoryCacheCount, which gates copy-on-write in
CSSStyleSheet::willMutateRules() (a contents that reports isInMemoryCache()
is cloned before mutation). Two paths left this count out of sync:
- add() called contents->addedToMemoryCache() unconditionally, without
checking HashMap::add()'s AddResult. When the key already exists the map
keeps the old value and inserts nothing, so bumping the count on the
passed-in contents inflated m_inMemoryCacheCount on an object that is not
actually in the cache.
- clear() dropped the HashMap entries without calling removedFromMemoryCache()
on them. Any contents that outlived the clear (still referenced by a client)
kept m_inMemoryCacheCount > 0 forever, so isInMemoryCache() stayed true and
every later mutation triggered a needless copy-on-write clone.
Fix add() to bail out when AddResult.isNewEntry is false, and fix clear() to
call removedFromMemoryCache() on each cached contents before clearing the map.
* Source/WebCore/style/StyleSheetContentsCache.cpp:
(WebCore::Style::StyleSheetContentsCache::add):
(WebCore::Style::StyleSheetContentsCache::clear):
Canonical link: https://commits.webkit.org/322684@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
