← WebKit Silent-Fix Report — 2026-W23
4f393fd202e3aae8e78552bb3dd8473b10fa7113 ASSERTION FAILED: it != m_querySelectorAllResults.end() - clearQuerySelectorAllResults() leaves stale per-node HasValidQuerySelectorAllResults bit
severity medium
class LogicError
confidence 0.55
WebCore DOM
Primitive: Stale HasValidQuerySelectorAllResults flag after cache cleared under memory pressure
Triage note: clearQuerySelectorAllResults() cleared the document's querySelectorAll result map but left each node's HasValidQuerySelectorAllResults flag set, so a later class mutation looked up a removed map entry (asserting in debug, inconsistent cache state in release). Fix clears the node flags when the cache is cleared.
Triage note: clearQuerySelectorAllResults() cleared the document's querySelectorAll result map but left each node's HasValidQuerySelectorAllResults flag set, so a later class mutation looked up a removed map entry (asserting in debug, inconsistent cache state in release). Fix clears the node flags when the cache is cleared.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…