Skip to content

Cherry-pick(s) c01cc7d0deac. rdar://191051301 - #78742

Open
webkit-opensource-integration wants to merge 1 commit into
mainfrom
integration/conflict/c01cc7d0deac_c01cc7d0deac_main
Open

webkit-opensource-integration wants to merge 1 commit into
mainfrom
integration/conflict/c01cc7d0deac_c01cc7d0deac_main

Conversation

@webkit-opensource-integration

@webkit-opensource-integration webkit-opensource-integration commented Oct 29, 2026 •

Copy link
Copy Markdown

Integration has hit a merge conflict while cherry-picking rdar://191051301 to main. [c01cc7d] caused a merge conflict.

GC does not keep shadow host alive when only a node in its shadow tree is referenced by JS
https://bugs.webkit.org/show_bug.cgi?id=322208
rdar://183926623
rdar://183926406

Reviewed by Geoffrey Garen.

Keep the shadow host and its ancestors when there is a JS reference to a node within its shadow tree.

This is a GC correctness fix and also a hardening for webkit.org/b/321943 / rdar://178311709.

Tests: fast/shadow-dom/remove-shadow-host-keeps-shadow-tree-attached.html
       fast/shadow-dom/remove-shadow-host-stale-shadow-including-root-crash.html

* LayoutTests/fast/shadow-dom/remove-shadow-host-keeps-shadow-tree-attached-expected.txt: Added.
* LayoutTests/fast/shadow-dom/remove-shadow-host-keeps-shadow-tree-attached.html: Added.
* LayoutTests/fast/shadow-dom/remove-shadow-host-stale-shadow-including-root-crash-expected.txt: Added.
* LayoutTests/fast/shadow-dom/remove-shadow-host-stale-shadow-including-root-crash.html: Added.
* Source/WebCore/bindings/js/JSNodeCustom.h:
(WebCore::willCreatePossiblyOrphanedTreeByRemoval):
* Source/WebCore/dom/ContainerNodeAlgorithms.cpp:
(WebCore::observabilityOfRemovedNode):
(WebCore::observabilityOfRemovedShadowRoot):
(WebCore::notifyNodeRemovedFromDocument):
(WebCore::notifyNodeRemovedFromTree):

Originally-landed-as: 316606.425@safari-7625-branch (c01cc7d0deac). rdar://191051301


ℹ️ Info

RC_REMOVE_SEC_ACCEL_* guards were removed with unifdef before cherry-picking, keeping only the code built when the macro is not defined.

c562008

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows
❌ 🧪 style ❌ 🛠 ios ❌ 🛠 mac ❌ 🛠 wpe ❌ 🛠 win
❌ 🧪 bindings ❌ 🛠 ios-sim ❌ 🛠 mac-cmake-debug ❌ 🧪 wpe-wk2 ❌ 🧪 win-tests
❌ 🧪 webkitperl ❌ 🧪 ios-wk2 ❌ 🧪 api-mac ❌ 🧪 api-wpe
❌ 🧪 ios-wk2-wpt ❌ 🧪 api-mac-cmake-debug ❌ 🧪 jsc-wpe
❌ 🧪 jsc-x86-64 ❌ 🧪 api-ios ❌ 🧪 mac-wk2 ❌ 🛠 gtk3-gcc
❌ 🛠 ios-safer-cpp ❌ 🧪 mac-cmake-debug-wk2 ❌ 🛠 gtk
❌ 🛠 vision ❌ 🧪 mac-wk2-stress ❌ 🧪 gtk-wk2
❌ 🛠 vision-sim ❌ 🧪 mac-intel-wk2 ❌ 🧪 api-gtk
❌ 🧪 vision-wk2 ❌ 🛠 mac-safer-cpp ❌ 🛠 playstation
❌ 🛠 tv ❌ 🧪 mac-site-isolation
❌ 🛠 tv-sim
❌ 🛠 watch
❌ 🛠 watch-sim

…e is referenced by JS

https://bugs.webkit.org/show_bug.cgi?id=322208
rdar://183926623
rdar://183926406

Reviewed by Geoffrey Garen.

Keep the shadow host and its ancestors when there is a JS reference to a node within its shadow tree.

This is a GC correctness fix and also a hardening for webkit.org/b/321943 / rdar://178311709.

Tests: fast/shadow-dom/remove-shadow-host-keeps-shadow-tree-attached.html
       fast/shadow-dom/remove-shadow-host-stale-shadow-including-root-crash.html

* LayoutTests/fast/shadow-dom/remove-shadow-host-keeps-shadow-tree-attached-expected.txt: Added.
* LayoutTests/fast/shadow-dom/remove-shadow-host-keeps-shadow-tree-attached.html: Added.
* LayoutTests/fast/shadow-dom/remove-shadow-host-stale-shadow-including-root-crash-expected.txt: Added.
* LayoutTests/fast/shadow-dom/remove-shadow-host-stale-shadow-including-root-crash.html: Added.
* Source/WebCore/bindings/js/JSNodeCustom.h:
(WebCore::willCreatePossiblyOrphanedTreeByRemoval):
* Source/WebCore/dom/ContainerNodeAlgorithms.cpp:
(WebCore::observabilityOfRemovedNode):
(WebCore::observabilityOfRemovedShadowRoot):
(WebCore::notifyNodeRemovedFromDocument):
(WebCore::notifyNodeRemovedFromTree):

Originally-landed-as: 316606.425@safari-7625-branch (c01cc7d). rdar://191051301
@webkit-opensource-integration

Copy link
Copy Markdown
Author

Integration performed the following cherry-picks: c01cc7d for rdar://191051301. c01cc7d caused a merge conflict.

@webkit-opensource-integration

Copy link
Copy Markdown
Author

At the time this pull request was created the following files were in conflict and need to be resolved:

  • LayoutTests/platform/glib/damage/remove-shadow-host-keeps-shadow-tree-attached-expected.txt — added on the target branch and left unmerged
  • LayoutTests/platform/glib/damage/remove-shadow-host-keeps-shadow-tree-attached.html — added on the target branch and left unmerged
  • LayoutTests/platform/glib/damage/remove-shadow-host-stale-shadow-including-root-crash-expected.txt — added on the target branch and left unmerged
  • LayoutTests/platform/glib/damage/remove-shadow-host-stale-shadow-including-root-crash.html — added on the target branch and left unmerged
  • Source/WebCore/bindings/js/JSNodeCustom.h — modified on both the target branch and the incoming commit (content conflict)
  • Source/WebCore/dom/ContainerNodeAlgorithms.cpp — modified on both the target branch and the incoming commit (content conflict)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants