[Webkit-unassigned] [Bug 254844] New: Intermittent removal of adoptedStyleSheet CSSStyleSheet instances when assigning adoptedStyleSheet array

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=254844

            Bug ID: 254844
           Summary: Intermittent removal of adoptedStyleSheet
                    CSSStyleSheet instances when assigning
                    adoptedStyleSheet array
           Product: WebKit
           Version: Safari 16
          Hardware: Mac (Intel)
                OS: macOS 13
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: New Bugs
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: nicholas.rice119 at gmail.com

Created attachment 465713

  --> https://bugs.webkit.org/attachment.cgi?id=465713&action=review

Failure case

Safari Version: Safari 16.4 (18615.1.26.11.22)
Platform: Macintosh
OS: MacOS 13.3

Bug Description:
We noticed with the release of DocumentOrShadowRoot.adoptedStyleSheets in 16.4 that, intermittently, when assigning the adoptedStyleSheets array to a value that contains existing and new CSSStyleSheet instances, existing CSSStyleSheet instances in the adoptedStyleSheets array are removed.

Repro Steps:
1. Clone https://github.com/microsoft/fast
2. Checkout https://github.com/microsoft/fast/tree/users/nirice/safari-investigation (`git checkout users/nirice/safari-investigation`)
3. Open https://github.com/microsoft/fast/blob/users/nirice/safari-investigation/sites/fast-website/dist/index.html in Safari 16.4
4. The issue is intermittent. In the non-repro case, you will see two pink custom-element buttons. In the failure case, the second button will have no padding and blue underlined text (See attached screen-shots). Keep opening new tabs and loading the HTML file until you see the repro (this can sometimes take 30 or 40 tries to get the repro).

Additional information:
- The code that adds and removes CSSStyleSheet instances to a shadowRoot or Document is here: https://github.com/microsoft/fast/blob/users/nirice/safari-investigation/sites/fast-website/dist/main.js#L7727. To add sheets, a new array is assigned with the values of the adoptedStyleSheets array plus the new CSSStyleSheets. This is where we see the bug.
- Using push and splice to mutate adoptedStyleSheets instead of new array assignment seems to circumvent the issue.
- In the failure case (see the attached screen-shots), reading the array length before and after assignment results in no change to the array length, and the original CSSStyleSheet in the array is missing upon inspection of the array.
- The issue can also be observed at https://www.fast.design/ more frequently. During investigation, it seemed that the more JavaScript I removed or disabled, the less frequently it would repro.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20230331/188a1f5e/attachment-0001.htm>