Spin-off from bug 119475. Let's take this to the next level.
Created attachment 208321 [details] Short patch name
Comment on attachment 208321 [details] Short patch name View in context: https://bugs.webkit.org/attachment.cgi?id=208321&action=review > Source/WebCore/css/CSSStyleSheet.cpp:289 > - RuleMutationScope mutationScope(this, mutationType); > + RuleMutationScope mutationScope(this, RuleInsertion); The mutation can trigger copy-on-write. In that case we might be left with dangling pointers in StyleResolver.
Created attachment 208341 [details] More hardcore version
Created attachment 208342 [details] Totally rad patch
Comment on attachment 208342 [details] Totally rad patch View in context: https://bugs.webkit.org/attachment.cgi?id=208342&action=review > Source/WebCore/css/CSSStyleSheet.h:89 > + enum WhetherContentsWereClonedForMutation { ContentsWereNotClonedForMutation = 0, ContentsWereClonedForMutation }; poetic! > Source/WebCore/dom/DocumentStyleSheetCollection.h:74 > + enum UpdateFlag { NoUpdate = 0, OptimizedUpdate, FullUpdate }; Does the = 0 do something here? > Source/WebCore/dom/DocumentStyleSheetCollection.h:137 > + // This is a mirror of m_activeAuthorStyleSheets that gets populated on demand for activeStyleSheetsContains(). > + mutable OwnPtr<HashSet<const CSSStyleSheet*>> m_weakCopyOfActiveStyleSheetListForFastLookup; Bit clunky but I don't have great suggestions.
It would also be good to check we have test coverage for insertion that causes cloning.
Committed r153829: <http://trac.webkit.org/changeset/153829>
<rdar://problem/14687740>