ImageStyleValue stored GC-managed request, stylesheet, and animation
timer references as strong GC::Ptr fields even though image style values
are refcounted objects. When such a style value outlives the GC object
that normally visits it, those fields can keep stale pointers after GC
collects the referents. On Steam this allowed a stale image resource
request to be read as unrelated image data, making carousel SVG arrows
render at the wrong size.
Store these back references as GC::Weak instead. Reachable style values
still use live requests, stylesheets, and timers normally, but detached
values observe null after the GC collects the referent and can reload or
skip the now-dead association instead of dereferencing reused GC memory.
Keep a local timer handle while installing the timeout callback so setup
does not rely on the weak member.
With the image style values no longer hiding strong GC edges, remove the
obsolete IGNORE_GC annotation from CSSStyleSheet's pending image list.
The resolution is always absolutized at style computation time so we can
just use `Resolution::from_style_value` and select the image once in
`load_any_resources` since the layout node won't change the result.
ImageSetStyleValue::set_style_sheet() previously stored the style sheet
on itself but didn't propagate to its candidate images. As a result,
candidates were never registered as pending image resources, so their
fetches didn't start until layout time and didn't delay the document's
load event.
This caused css-image-set-background-type.html to be flaky: under
load, the screenshot could be captured before the selected SVG
candidate had finished decoding, producing an empty box instead of
the expected color.
Propagate set_style_sheet() to each candidate image whose type()
filter does not exclude it, mirroring StyleValueList and
ShorthandStyleValue. The candidates now register themselves as
pending so SharedResourceRequest's load event delayer correctly
delays the load event until decoding completes.
Add an abstract image style value for image-set() and parse both the
standard and -webkit-prefixed spellings through the existing <image>
value path. The parser accepts URL and string image candidates,
optional resolution descriptors, and type() filters.
Track attr-taint through substituted component values so image-set()
candidates using attr()-derived URL-producing tokens are rejected when
resolved for URL-using properties.
Update the relevant WPT baselines now that image-set() parsing is
supported in additional value contexts.
