Bug 87349 – REGRESSION(r96517): Attribute selector fails to match dynamically modified style attribute

• Status: RESOLVED
• Resolution: FIXED
• Component: CSS

[Mike Lawther]

As reported in at http://crbug.com/127655

Attached is a not-quite-minimal repro of a selector not working ('#container > div[style] img[border="0"]'). I've bisected it down to between 96490 and 96521, and 96517 seems most likely within that range. 

The original reporter also notes that in his live site (http://winfuture.de):

 - open console
 - type document.querySelector('#container > div[style] img[border="0"]') -> you get NULL
 - type document.querySelector('img[border="0"]') -> you get the first element
 - type document.querySelector('#container > div[style] img[border="0"]') -> you get the first element

It looks like the second line does something to a cache somewhere so the querySelector works the second time.

I tried to repro this with a simple static page, but could not. It appears important that the elements are added dynamically.

[Mike Lawther]

Created attachment 143749 [details]
repro

[Mike Lawther]

Created attachment 143916 [details]
minimal repro

Here is a minimal repro, courtesy of geki007 (from the original crbug report).

[Antti Koivisto]

Created attachment 144374 [details]
patch

Thanks for the repro!

[Andreas Kling]

Comment on attachment 144374 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=144374&action=review

> Source/WebCore/css/SelectorChecker.cpp:407
> +        // Style attribute is generated lazily but the fast path doesn't do trigger that.

This comment doesn't do English :(

> LayoutTests/fast/css/dynamic-style-attribute-query.html:12
> +document.addEventListener("DOMContentLoaded", test , false);

Silly space after 'test'.

[Andreas Kling]

Funny problem btw! r=me, etc.

[Antti Koivisto]

http://trac.webkit.org/changeset/118688