Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 1bbc068de5dae4fa194a1c705aeada4d4641baa6
https://github.com/WebKit/WebKit/commit/1bbc068de5dae4fa194a1c705aeada4d4641baa6
Author: Ahmad Saleem <[email protected]>
Date: 2026-08-02 (Sun, 02 Aug 2026)
Changed paths:
M Source/WebCore/dom/SpaceSplitString.cpp
M Source/WebCore/dom/SpaceSplitString.h
Log Message:
-----------
SpaceSplitStringData::create() leaks a table entry for every distinct
whitespace-only class attribute value
https://bugs.webkit.org/show_bug.cgi?id=320752
rdar://183751460
Reviewed by Chris Dumez.
create() adds to spaceSplitStringTable() before it knows the token count, then
returns nullptr for whitespace-only input, leaving an entry that is never
filled in.
destroy() only removes keys that got a SpaceSplitStringData, so nothing reclaims
these, and the table is a NeverDestroyed. Since the constructor filters empty
strings but not whitespace-only ones, script grows it for the lifetime of the
process, retaining one AtomString per entry:
for (let i = 1; i < 100000; ++i)
element.className = " ".repeat(i);
Remove the entry before returning nullptr. No behavior change: a cached null was
already the right answer for such a key, it just could not be freed.
No test, because the table is a file-local NeverDestroyed with no size accessor
and
the leaked entries are unreachable from any existing testing hook. A regression
test
would need a SpaceSplitStringData size accessor plus an Internals counter, as
memoryCacheSize() has.
Also replace containsAll()'s do/while, which read other[0] before testing
other.m_size, with a range-based for; zero-token instances are ruled out by
both the
constructor and create(), so this is hardening, not a fix. While here, make
containsAll() and contains() const.
* Source/WebCore/dom/SpaceSplitString.cpp:
(WebCore::SpaceSplitStringData::containsAll const):
(WebCore::SpaceSplitStringData::create):
(WebCore::SpaceSplitStringData::containsAll): Deleted.
* Source/WebCore/dom/SpaceSplitString.h:
(WebCore::SpaceSplitStringData::contains const):
(WebCore::SpaceSplitStringData::contains): Deleted.
Canonical link: https://commits.webkit.org/318427@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
