Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: c11d9781788dd0bf8fae0496ad66c65c1769afc5
https://github.com/WebKit/WebKit/commit/c11d9781788dd0bf8fae0496ad66c65c1769afc5
Author: Ahmad Saleem <[email protected]>
Date: 2026-07-13 (Mon, 13 Jul 2026)
Changed paths:
M Source/WebInspectorUI/UserInterface/Views/SourceCodeTextEditor.js
Log Message:
-----------
Web Inspector: _tokenTrackingControllerHighlightedMarkedExpression tests a
leaked loop variable instead of the selected marker
https://bugs.webkit.org/show_bug.cgi?id=319321
rdar://182143986
Reviewed by Devin Rousso.
_tokenTrackingControllerHighlightedMarkedExpression() iterates its markers
with `for (var marker of markers)` to find the outermost editableMarker. The
subsequent color-validity guard then tested `marker.type`, but because `var`
is function-scoped, `marker` leaks past the loop and holds the last element of
the array rather than the editableMarker actually selected. The branch it
guards is otherwise written entirely in terms of editableMarker -- it reads
this._editingController (built from editableMarker) and clears editableMarker
-- so the type check was inconsistent with the code it gates.
This is a latent correctness bug rather than a user-visible regression: it can
only change behavior when markersAtPosition() returns two overlapping markers
of different types where the outermost is not a color and the trailing one is,
and in the one case where that overlap occurs in practice (a color stop on a
continuation line of a multi-line gradient, whose single-line color-exclusion
heuristic misses it) the gradient's hover editor does not present regardless,
masking any observable difference. No reliable manual repro exists (I tried)
and the hover-driven path is not covered by the inspector test harness, so
no test is added.
Test the selected editableMarker's type, matching the editing controller and
the marker being cleared within the branch. Convert the `editableMarker` and
`marker` declarations from `var` to `let` so the loop variable is block-scoped
and can no longer leak past the loop, preventing this class of bug in the
future.
* Source/WebInspectorUI/UserInterface/Views/SourceCodeTextEditor.js:
(WI.SourceCodeTextEditor.prototype._tokenTrackingControllerHighlightedMarkedExpression):
Canonical link: https://commits.webkit.org/317124@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
