Created attachment 384463 [details] Error reproduction demo and a screenshot In some cases rules with the same selector from the different stylesheets override each other in the wrong order. It is reproduced with the large stylesheets (> 10000 rules, probably less) and is somehow related to the count of css rules in those stylesheets. Most noticeable the error is when the count of rules is near power of two. The reproduction demo is attached to this issue, or can be accessed https://saf-rule-order.subzey.now.sh/dist/0x7fff/ or GitHub: https://github.com/subzey/saf-rule-order/tree/master/dist There are 20 styleheets on a page. Each features a rule that sets the ::before contents on the body element. Other than these rules each sheet contains lots of other rules, so there are 32767 total (0x7FFF). The contents of these "dummy" rules doesn't matter, it can be even empty. *Expected:* Once all the selectors are the same, the rule from the last stylesheet should "win" and the body::before contents should be "Hello from 20.css". *Actual Behavior:* It says, "Hello from 09.css". The Inspector shows the order of rules application (see the attached screenshot) and it's totally random and does not reflect the DOM order of link elements. This order is changed if the count of "dummy" rules is changed. https://saf-rule-order.subzey.now.sh/dist/0x8000/ 32768 rules yields "Hello from 16.css"
Created attachment 384468 [details] Web Inspector Screenshot
<rdar://problem/57522566>
CSS JIT bug?
RuleData has unsigned m_position : 18; so if you have > 256k rules it will get confused about the order. The test consists of 32k rule sheets and fails as expected on 9th.
There are some free bits here so we can increment the limit some.
Created attachment 389643 [details] patch
Created attachment 389646 [details] patch
Comment on attachment 389646 [details] patch r=me
Comment on attachment 389646 [details] patch Rejecting attachment 389646 [details] from review queue. kling@webkit.org does not have reviewer permissions according to https://trac.webkit.org/browser/trunk/Tools/Scripts/webkitpy/common/config/contributors.json. - If you do not have reviewer rights please read http://webkit.org/coding/contributing.html for instructions on how to use bugzilla flags. - If you have reviewer rights please correct the error in Tools/Scripts/webkitpy/common/config/contributors.json by adding yourself to the file (no review needed). The commit-queue restarts itself every 2 hours. After restart the commit-queue will correctly respect your reviewer rights.
sad face
(In reply to Antti Koivisto from comment #10) > sad face Sorry about that. I didn’t know I had been demoted. Patch looks good fwiw.
Comment on attachment 389646 [details] patch trust kling.
I did but the bot had doubts.
Comment on attachment 389646 [details] patch Clearing flags on attachment: 389646 Committed r255671: <https://trac.webkit.org/changeset/255671>
All reviewed patches have been landed. Closing bug.