Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 8697bb2e6e78ade6d7e8915c0de15807552a2230
https://github.com/WebKit/WebKit/commit/8697bb2e6e78ade6d7e8915c0de15807552a2230
Author: Ahmad Saleem <[email protected]>
Date: 2026-10-09 (Fri, 09 Oct 2026)
Changed paths:
A
LayoutTests/imported/w3c/web-platform-tests/css/cssom/medialist-mutation-after-owner-gc-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/css/cssom/medialist-mutation-after-owner-gc.html
M Source/WebCore/css/MediaList.cpp
Log Message:
-----------
MediaList writes are silently dropped after its owner rule or stylesheet is
destroyed
https://bugs.webkit.org/show_bug.cgi?id=326790
rdar://189496021
Reviewed by Antti Koivisto.
A MediaList wrapper does not keep its owning CSSMediaRule, CSSImportRule
or CSSStyleSheet alive. When the owner is destroyed while script still
holds the MediaList, the owner's destructor calls detachFromParent(), which
snapshots the queries into m_detachedMediaQueries and clears both parent
pointers.
Reads were served from that snapshot, but MediaList::setMediaQueries() only
wrote through the parent pointers. Both are null by then, so the mediaText
setter, appendMedium() and deleteMedium() became silent no-ops, and the list
kept reporting its old value. Whether a write took effect depended on GC
timing.
Store writes into m_detachedMediaQueries when the list is detached.
Test:
imported/w3c/web-platform-tests/css/cssom/medialist-mutation-after-owner-gc.html
*
LayoutTests/imported/w3c/web-platform-tests/css/cssom/medialist-mutation-after-owner-gc-expected.txt:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/css/cssom/medialist-mutation-after-owner-gc.html:
Added.
* Source/WebCore/css/MediaList.cpp:
(WebCore::MediaList::setMediaQueries):
Canonical link: https://commits.webkit.org/323203@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
