Title: [295436] trunk/Source/WebCore/html/HTMLInputElement.cpp
- Revision
- 295436
- Author
- [email protected]
- Date
- 2022-06-09 14:36:44 -0700 (Thu, 09 Jun 2022)
Log Message
Fix invalid isInShadowRoot flag during input element removal
https://bugs.webkit.org/show_bug.cgi?id=241470
Reviewed by Ryosuke Niwa.
Style invalidation of input elements might rely on whether the element
is in the shadow tree, but during node removal the isInShadowRoot flag
might not be up-to-date. Ensure that the flag is updated by
letting Node::removedFromAncestor() be called up first in the
HTMLInputNode::removedFromAncestor() implementation, before
doing anything else with the node post-removal.
* Source/WebCore/html/HTMLInputElement.cpp:
(WebCore::HTMLInputElement::removedFromAncestor):
Canonical link: https://commits.webkit.org/251442@main
Modified Paths
Diff
Modified: trunk/Source/WebCore/html/HTMLInputElement.cpp (295435 => 295436)
--- trunk/Source/WebCore/html/HTMLInputElement.cpp 2022-06-09 21:34:27 UTC (rev 295435)
+++ trunk/Source/WebCore/html/HTMLInputElement.cpp 2022-06-09 21:36:44 UTC (rev 295436)
@@ -1585,6 +1585,7 @@
void HTMLInputElement::removedFromAncestor(RemovalType removalType, ContainerNode& oldParentOfRemovedTree)
{
+ HTMLTextFormControlElement::removedFromAncestor(removalType, oldParentOfRemovedTree);
if (removalType.treeScopeChanged && isRadioButton())
oldParentOfRemovedTree.treeScope().radioButtonGroups().removeButton(*this);
if (removalType.disconnectedFromDocument && !form())
@@ -1593,7 +1594,6 @@
document().removeElementWithPendingUserAgentShadowTreeUpdate(*this);
m_hasPendingUserAgentShadowTreeUpdate = false;
}
- HTMLTextFormControlElement::removedFromAncestor(removalType, oldParentOfRemovedTree);
ASSERT(!isConnected());
if (removalType.disconnectedFromDocument && !form() && isRadioButton())
updateValidity();
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
