Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: a30b2a9cbf922ee355d8aacfeb3d2a9be4e6d098
https://github.com/WebKit/WebKit/commit/a30b2a9cbf922ee355d8aacfeb3d2a9be4e6d098
Author: Ahmad Saleem <[email protected]>
Date: 2026-09-02 (Wed, 02 Sep 2026)
Changed paths:
A
LayoutTests/highlight/highlight-registry-iteration-order-after-gc-expected.txt
A LayoutTests/highlight/highlight-registry-iteration-order-after-gc.html
M Source/WebCore/Modules/highlight/HighlightRegistry.cpp
Log Message:
-----------
CSS.highlights iterates in hash order instead of registration order after its
wrapper is garbage collected
https://bugs.webkit.org/show_bug.cgi?id=322468
rdar://185754041
Reviewed by Jessica Cheung.
HighlightRegistry::initializeMapLike() populated the maplike backing map by
walking m_map, a HashMap<AtomString, Ref<Highlight>>, handing entries to the
backing JSMap in bucket order rather than the insertion order WebIDL maplike
requires. The class already tracks registration order in m_highlightNames, which
highlightsFromPoint() uses for this very reason; iterate that instead.
HighlightRegistry-iteration.html misses this because forwardSetToMapLike() calls
setFromMapLike() before getAndInitializeBackingMap(): the first
CSS.highlights.set() initializes the backing map while m_map holds one entry,
and
later set() calls find it present and skip initializeMapLike() entirely. Hash
order only surfaces when the backing map is rebuilt with two or more entries
already registered. Since DOMCSSNamespace.idl declares highlights without
[SameObject] or [CachedAttribute], the wrapper holding that backing map is only
weakly held while the registry lives on the Document, so collecting it makes the
next CSS.highlights access replay m_map in capacity-dependent order. A second JS
world reaches the same rebuild, since each world gets its own wrapper.
The test registers 32 highlights, drops the wrapper, forces a collection, and
checks keys() order. It first asserts an expando on the original wrapper is
gone,
so it fails loudly rather than vacuously if nothing was reclaimed.
Test: highlight/highlight-registry-iteration-order-after-gc.html
*
LayoutTests/highlight/highlight-registry-iteration-order-after-gc-expected.txt:
Added.
* LayoutTests/highlight/highlight-registry-iteration-order-after-gc.html: Added.
* Source/WebCore/Modules/highlight/HighlightRegistry.cpp:
(WebCore::HighlightRegistry::initializeMapLike):
Canonical link: https://commits.webkit.org/320343@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
