LadybirdBrowser · awesomekling · Aug 19, 2026 · Aug 18, 2026 · Aug 16, 2026 · Aug 16, 2026
diff --git a/Documentation/Style/StyleEngine.md b/Documentation/Style/StyleEngine.md
diff --git a/Documentation/Style/StyleEngineTesting.md b/Documentation/Style/StyleEngineTesting.md
@@ -34,11 +34,11 @@ A focused loop for style work:
 ./bin/test-web --verify-style -f Text/input/css/style-engine/ -f Text/input/css/style-invalidation/
 ```
 
-The gates are per-mechanism checks that run at their mechanism's site. Some re-derive incremental results through the exact cold evaluator and compare (`LIBWEB_VERIFY_STYLE_ANSWER_PATCH`, `LIBWEB_VERIFY_CASCADE_WINNERS`); others assert structural properties (`LIBWEB_VERIFY_STYLE_PLAN_PROVENANCE`, `LIBWEB_VERIFY_PUBLISHED_STYLE_TRANSACTION`), and three C++-side gates cover input reuse, the computed closure, and the style-diff fast path (`LIBWEB_VERIFY_STYLE_INPUT_REUSE`, `LIBWEB_VERIFY_COMPUTED_CLOSURE`, `LIBWEB_VERIFY_STYLE_DIFF_FAST_PATH`).
+The gates are per-mechanism checks that run at their mechanism's site. Some re-derive incremental results through the exact cold evaluator and compare (`LIBWEB_VERIFY_STYLE_ANSWER_PATCH`, `LIBWEB_VERIFY_SELECTOR_TRUTH_DERIVATION`, `LIBWEB_VERIFY_CASCADE_WINNERS`); others assert structural properties (`LIBWEB_VERIFY_STYLE_PLAN_PROVENANCE`, `LIBWEB_VERIFY_PUBLISHED_STYLE_TRANSACTION`), and three C++-side gates cover input reuse, the computed closure, and the style-diff fast path (`LIBWEB_VERIFY_STYLE_INPUT_REUSE`, `LIBWEB_VERIFY_COMPUTED_CLOSURE`, `LIBWEB_VERIFY_STYLE_DIFF_FAST_PATH`).
 
-Verification is **observer-only**: checks compare against private state, cannot publish into engine caches, and are exposed as unit-returning closures, so using a gate to steer engine behavior is a compile error. A verifier must never disable or bypass the fast path it is checking, and an incomplete comparison is a failure, not a skip.
+Verification is **observer-only**: structural checks receive an immutable engine view, while checks that need the exact cold evaluator receive a dedicated verifier capability whose only operations perform comparisons. Neither API exposes cache publication or general engine mutation, and every gate returns unit, so a verifier cannot steer engine behavior. A verifier must never disable or bypass the fast path it is checking, and an incomplete comparison is a failure, not a skip.
 
-The four engine-side gates are engine inputs: recordings store their bit set, and replay refuses a capture under a different configuration. The three C++-side gates are outside the recorded surface.
+The five engine-side gates are engine inputs: recordings store their bit set, including bit 4 for `LIBWEB_VERIFY_SELECTOR_TRUTH_DERIVATION`, and replay refuses a capture under a different configuration. The three C++-side gates are outside the recorded surface.
 
 ## 2. Record and replay
 

diff --git a/Libraries/LibWeb/CSS/ComputedValues.cpp b/Libraries/LibWeb/CSS/ComputedValues.cpp
@@ -892,7 +892,7 @@ void ComputedValues::borrow_style_record_payloads(ReadonlySpan<void const*> payl
 }
 
 ComputedStyleRecordView::ComputedStyleRecordView(StyleEngineFFI::FfiStyleRecordView const& view, StyleComputer const& style_computer, StyleRecordID style_record_identity)
-    : m_style_computer(view.animation_overlay_identity != 0 ? &style_computer : nullptr)
+    : m_style_computer(&style_computer)
     , m_style_record_identity(style_record_identity)
 {
     VERIFY(view.present);

diff --git a/Libraries/LibWeb/CSS/CustomPropertyData.h b/Libraries/LibWeb/CSS/CustomPropertyData.h
@@ -50,12 +50,13 @@ class WEB_API CustomPropertyData : public RefCounted<CustomPropertyData> {
 
     // The engine's identities for the names this environment declares, sorted and deduplicated,
     // worked out once for the environment rather than once for each element handed it: a page whose
-    // theme declares a thousand names hands the same thousand to every element under it. Atoms are
-    // document-local, so the document that asked is part of what the answer is good for.
+    // theme declares a thousand names hands the same thousand to every element under it. Atom ids
+    // are process-global, but each document must acquire its own references, so the document that
+    // asked is part of what the answer is good for.
     template<typename InternName>
-    [[nodiscard]] ReadonlySpan<StyleAtomID> declared_name_atoms(FlatPtr document_identity, InternName&& intern) const
+    [[nodiscard]] ReadonlySpan<StyleAtomID> declared_name_atoms(FlatPtr document_identity, u64 atom_generation, InternName&& intern) const
     {
-        if (m_cached_name_atoms_document_identity == document_identity)
+        if (m_cached_name_atoms_document_identity == document_identity && m_cached_name_atoms_generation == atom_generation)
             return m_cached_declared_name_atoms.span();
         m_cached_declared_name_atoms.clear_with_capacity();
         m_cached_declared_name_atoms.ensure_capacity(m_declared_count);
@@ -73,6 +74,7 @@ class WEB_API CustomPropertyData : public RefCounted<CustomPropertyData> {
         }
         m_cached_declared_name_atoms.shrink(unique);
         m_cached_name_atoms_document_identity = document_identity;
+        m_cached_name_atoms_generation = atom_generation;
         return m_cached_declared_name_atoms.span();
     }
 
@@ -121,6 +123,7 @@ class WEB_API CustomPropertyData : public RefCounted<CustomPropertyData> {
     size_t m_declared_count { 0 };
     u64 m_identity { 0 };
     mutable FlatPtr m_cached_name_atoms_document_identity { NumericLimits<FlatPtr>::max() };
+    mutable u64 m_cached_name_atoms_generation { 0 };
     mutable Vector<StyleAtomID> m_cached_declared_name_atoms;
     mutable FlatPtr m_cached_inheritable_document_identity { NumericLimits<FlatPtr>::max() };
     mutable size_t m_cached_inheritable_generation { NumericLimits<size_t>::max() };

diff --git a/Libraries/LibWeb/CSS/StyleComputer.cpp b/Libraries/LibWeb/CSS/StyleComputer.cpp
@@ -151,7 +151,45 @@ StyleComputer::StyleComputer(DOM::Document& document)
 {
 }
 
-StyleComputer::~StyleComputer() = default;
+void StyleComputer::finalize()
+{
+    Base::finalize();
+    clear_style_sharing_cache();
+}
+
+void StyleComputer::clear_style_sharing_cache() const
+{
+    for (auto const& bucket : m_style_sharing_cache) {
+        for (auto const& entry : bucket.value) {
+            if (entry.explicitly_inherited_non_inherited_property && !!entry.parent_style_record_identity)
+                unpin_style_record(entry.parent_style_record_identity);
+            if (entry.style_record_identity.has_value())
+                unpin_style_record(*entry.style_record_identity);
+        }
+    }
+    m_style_sharing_cache.clear();
+    m_style_sharing_cache_entry_count = 0;
+}
+
+void StyleComputer::prepare_for_style_engine_transaction() const
+{
+    ++m_style_sharing_transaction_generation;
+    if (m_style_sharing_cache_entry_count > maximum_persistent_style_sharing_entries)
+        clear_style_sharing_cache();
+    m_computed_style_invalidation_cache.clear();
+    m_style_engine_cascade_input_cache.clear();
+    m_inherited_style_group_swaps.clear();
+    sweep_custom_property_environments();
+}
+
+void StyleComputer::drop_style_sharing_cache() const
+{
+    clear_style_sharing_cache();
+    m_computed_style_invalidation_cache.clear();
+    m_style_engine_cascade_input_cache.clear();
+    m_inherited_style_group_swaps.clear();
+    sweep_custom_property_environments();
+}
 
 ComputedStyleRecordView StyleComputer::computed_style_record_view(StyleRecordID style_record_identity) const
 {
@@ -160,8 +198,8 @@ ComputedStyleRecordView StyleComputer::computed_style_record_view(StyleRecordID
     auto view = m_style_engine.style_record_view(style_record_identity);
     if (!view.present)
         return {};
-    if (view.animation_overlay_identity != 0)
-        pin_style_record(style_record_identity);
+    pin_style_record(style_record_identity);
+    ++m_computed_style_record_view_pin_count;
     return ComputedStyleRecordView { view, *this, style_record_identity };
 }
 
@@ -175,18 +213,12 @@ void const* StyleComputer::style_record_payloads(StyleRecordID style_record_iden
 void StyleComputer::pin_style_record(StyleRecordID style_record_identity) const
 {
     VERIFY(style_record_identity);
-    static constexpr u64 animation_overlay_tag = 1ull << 63;
-    if ((style_record_identity.value() & animation_overlay_tag) == 0)
-        return;
     const_cast<StyleComputer&>(*this).m_style_engine.pin_style_record(style_record_identity);
 }
 
 void StyleComputer::unpin_style_record(StyleRecordID style_record_identity) const
 {
     VERIFY(style_record_identity);
-    static constexpr u64 animation_overlay_tag = 1ull << 63;
-    if ((style_record_identity.value() & animation_overlay_tag) == 0)
-        return;
     const_cast<StyleComputer&>(*this).m_style_engine.unpin_style_record(style_record_identity);
 }
 
@@ -203,6 +235,7 @@ void StyleComputer::unregister_style_node(StyleNodeID style_node_id)
 {
     if (style_node_id != 0 && style_node_id.value() < m_style_nodes.size()) {
         m_style_nodes[style_node_id.value()] = nullptr;
+        m_style_engine.cancel_preallocated_style_node(style_node_id);
         m_style_engine.consume_recorded_element_style_input_change(style_node_id);
     }
 }
@@ -228,6 +261,14 @@ void StyleComputer::prepare_elements_for_style_computation()
     }
 }
 
+void StyleComputer::for_each_style_node(Function<void(DOM::Element&)> callback) const
+{
+    for (auto element : m_style_nodes) {
+        if (element)
+            callback(*element);
+    }
+}
+
 void StyleComputer::visit_edges(Visitor& visitor)
 {
     Base::visit_edges(visitor);
@@ -2408,7 +2449,9 @@ static Vector<StyleProperty> collect_presentational_hint_properties(DOM::Abstrac
     // Which properties a hint decides is a fact about the element, and this is the one place that
     // knows it: mapping the attributes needs the element fully built, and for a table cell it needs
     // the table's computed style, so it cannot be done when the element arrives.
-    record_element_presentational_hint_properties(element, properties);
+    if (element.presentational_hint_properties_need_publication(properties)
+        && record_element_presentational_hint_properties(element, properties))
+        element.did_publish_presentational_hint_properties(properties);
     return properties;
 }
 
@@ -3625,8 +3668,8 @@ StyleEngine::StyleRecordDelta StyleComputer::publish_computed_style_inputs(DOM::
 {
     auto publication = record_computed_style_inputs(Optional<DOM::AbstractElement> { abstract_element }, values, abstract_element.element().style_node_id());
     if (!abstract_element.pseudo_element().has_value()) {
-        if (auto* record = abstract_element.element().style_input_record(); record && record->bind_next_published_style) {
-            record->computed_style_record = publication.new_style_record;
+        if (auto* record = abstract_element.element().style_input_record()) {
+            record->computed_style_record = record->bind_next_published_style ? publication.new_style_record : StyleRecordID {};
             record->bind_next_published_style = false;
         }
     }
@@ -3725,6 +3768,8 @@ NonnullRefPtr<ComputedValues const> StyleComputer::materialize_style_record(DOM:
             auto& entry = bucket->last();
             VERIFY(entry.values.ptr() == values.ptr());
             VERIFY(entry.custom_property_data.ptr() == abstract_element.custom_property_data().ptr());
+            VERIFY(!entry.style_record_identity.has_value());
+            pin_style_record(publication.new_style_record);
             entry.style_record_identity = publication.new_style_record;
         }
         if (style_record_delta.has_value())
@@ -3749,8 +3794,8 @@ NonnullRefPtr<ComputedValues const> StyleComputer::materialize_style_record(DOM:
             inherited_group_swap_eligible);
         if (!!publication.new_style_record) {
             if (!abstract_element.pseudo_element().has_value()) {
-                if (auto* record = abstract_element.element().style_input_record(); record && record->bind_next_published_style) {
-                    record->computed_style_record = publication.new_style_record;
+                if (auto* record = abstract_element.element().style_input_record()) {
+                    record->computed_style_record = record->bind_next_published_style ? publication.new_style_record : StyleRecordID {};
                     record->bind_next_published_style = false;
                 }
             }
@@ -3833,6 +3878,8 @@ NonnullRefPtr<ComputedValues const> StyleComputer::build_and_share_computed_valu
                 pinned_style_input_values = element.style_input_record()->pinned_values;
                 cascade_declares_custom_properties = element.style_input_record()->cascade_declares_custom_properties;
             }
+            if (sharing.explicitly_inherited_non_inherited_property && !!sharing.parent_style_record_identity)
+                pin_style_record(sharing.parent_style_record_identity);
             m_style_sharing_cache.ensure(key_hash).append({
                 .key = move(sharing.key),
                 .pinned_parent_groups = move(sharing.pinned_parent_groups),
@@ -3883,6 +3930,8 @@ RefPtr<ComputedValues const> StyleComputer::compute_pseudo_element_style_if_need
             auto& entry = bucket->last();
             VERIFY(entry.values.ptr() == values.ptr());
             VERIFY(entry.custom_property_data.ptr() == abstract_element.custom_property_data().ptr());
+            VERIFY(!entry.style_record_identity.has_value());
+            pin_style_record(publication.new_style_record);
             entry.style_record_identity = publication.new_style_record;
         }
         if (style_record_delta.has_value())
@@ -4743,8 +4792,7 @@ RefPtr<ComputedStyleWorkingSet> StyleComputer::compute_style_impl(DOM::AbstractE
     auto materialize_style_record_view = [&](StyleEngine::StyleRecordView const& view, StyleRecordID identity) -> OwnPtr<ComputedStyleRecordView> {
         if (!view.present)
             return {};
-        if (view.animation_overlay_identity != 0)
-            pin_style_record(identity);
+        pin_style_record(identity);
         return make<ComputedStyleRecordView>(view, *this, identity);
     };
     inheritance_parent_style = materialize_style_record_view(inheritance_parent_style_record, inheritance_parent_style_record_identity);

diff --git a/Libraries/LibWeb/CSS/StyleComputer.h b/Libraries/LibWeb/CSS/StyleComputer.h
@@ -47,6 +47,8 @@ class WEB_API StyleComputer final : public GC::Cell {
     GC_DECLARE_ALLOCATOR(StyleComputer);
 
 public:
+    static constexpr bool OVERRIDES_FINALIZE = true;
+
     static void for_each_property_expanding_shorthands(PropertyID, StyleValue const&, Function<void(PropertyID, StyleValue const&)> const& set_longhand_property);
     static NonnullRefPtr<StyleValue const> get_non_animated_inherit_value(PropertyID, DOM::AbstractElement);
     struct AnimatedInheritValue {
@@ -58,7 +60,7 @@ class WEB_API StyleComputer final : public GC::Cell {
     static Optional<Utf16String> user_agent_style_sheet_source(Utf16View name);
 
     explicit StyleComputer(DOM::Document&);
-    ~StyleComputer();
+    virtual ~StyleComputer() override = default;
 
     DOM::Document& document() { return m_document; }
     DOM::Document const& document() const { return m_document; }
@@ -100,30 +102,10 @@ class WEB_API StyleComputer final : public GC::Cell {
 
     // Drop caches whose keys contain inputs that are stable only within one engine transaction.
     // Style sharing has a self-validating key and survives ordinary transaction boundaries.
-    void prepare_for_style_engine_transaction() const
-    {
-        ++m_style_sharing_transaction_generation;
-        if (m_style_sharing_cache_entry_count > maximum_persistent_style_sharing_entries) {
-            m_style_sharing_cache.clear();
-            m_style_sharing_cache_entry_count = 0;
-            sweep_custom_property_environments();
-        }
-        m_computed_style_invalidation_cache.clear();
-        m_style_engine_cascade_input_cache.clear();
-        m_inherited_style_group_swaps.clear();
-        m_custom_property_environments.clear();
-    }
+    void prepare_for_style_engine_transaction() const;
 
     // Forget every style one element computed on another's behalf. See m_style_sharing_cache.
-    void drop_style_sharing_cache() const
-    {
-        m_style_sharing_cache.clear();
-        m_style_sharing_cache_entry_count = 0;
-        m_computed_style_invalidation_cache.clear();
-        m_style_engine_cascade_input_cache.clear();
-        m_inherited_style_group_swaps.clear();
-        sweep_custom_property_environments();
-    }
+    void drop_style_sharing_cache() const;
 
     struct ComputedStyleInvalidation {
         RequiredInvalidationAfterStyleChange invalidation;
@@ -150,6 +132,7 @@ class WEB_API StyleComputer final : public GC::Cell {
     [[nodiscard]] void const* style_record_payloads(StyleRecordID) const;
     void pin_style_record(StyleRecordID) const;
     void unpin_style_record(StyleRecordID) const;
+    [[nodiscard]] u64 computed_style_record_view_pin_count() const { return m_computed_style_record_view_pin_count; }
 
     // Two elements whose cascade declares the same custom properties against the same inherited
     // environment hold the same environment, so they are given one object rather than an object
@@ -211,6 +194,8 @@ class WEB_API StyleComputer final : public GC::Cell {
     void for_each_provisional_transition_effect(DOM::AbstractElement const&, Function<void(Animations::KeyframeEffect&)> const&) const;
 
 private:
+    virtual void finalize() override;
+
     virtual void visit_edges(Visitor&) override;
 
     [[nodiscard]] StyleEngine::StyleRecordDelta record_computed_style_inputs(Optional<DOM::AbstractElement>, ComputedValues const&, StyleNodeID style_node_id) const;
@@ -300,6 +285,7 @@ class WEB_API StyleComputer final : public GC::Cell {
     };
 
 private:
+    void clear_style_sharing_cache() const;
     [[nodiscard]] NonnullRefPtr<ComputedValues const> build_and_share_computed_values(NonnullRefPtr<ComputedStyleWorkingSet>, DOM::AbstractElement, StyleScope const&, StyleSharingCandidate&) const;
     [[nodiscard]] static Vector<GC::Ptr<DOM::ShadowRoot const>, 4> author_context_shadow_roots(DOM::AbstractElement);
 
@@ -352,6 +338,7 @@ class WEB_API StyleComputer final : public GC::Cell {
     void unregister_style_node(StyleNodeID style_node_id);
     [[nodiscard]] GC::Ptr<DOM::Element> element_for_style_node(StyleNodeID style_node_id) const;
     void prepare_elements_for_style_computation();
+    void for_each_style_node(Function<void(DOM::Element&)>) const;
 
     // Style scopes are numbered per document, with zero naming the document's own scope. A scope is
     // never reused, so a sheet detached with an identity that has been retired detaches nothing
@@ -551,6 +538,7 @@ class WEB_API StyleComputer final : public GC::Cell {
     CSSPixelRect m_viewport_rect;
 
     mutable StyleEngine m_style_engine;
+    mutable u64 m_computed_style_record_view_pin_count { 0 };
     Vector<GC::Ptr<DOM::Element>> m_style_nodes;
     TreeScopeID m_next_tree_scope;
     Vector<NonAuthorStyleSheet> m_non_author_style_sheets;