Branch: refs/heads/webkitglib/2.48
Home: https://github.com/WebKit/WebKit
Commit: cd57eea2eb82c1620b9b885bbd966c5c54839be5
https://github.com/WebKit/WebKit/commit/cd57eea2eb82c1620b9b885bbd966c5c54839be5
Author: Ryosuke Niwa <[email protected]>
Date: 2025-10-14 (Tue, 14 Oct 2025)
Changed paths:
M Source/WebCore/dom/RadioButtonGroups.cpp
M Source/WebCore/dom/RadioButtonGroups.h
M Source/WebCore/html/HTMLFormElement.cpp
Log Message:
-----------
Cherry-pick 301470@main (985b9fb1a2eb).
https://bugs.webkit.org/show_bug.cgi?id=300682
Crash in WebCore::addInvalidElementToAncestorFromInsertionPoint
https://bugs.webkit.org/show_bug.cgi?id=300682
Reviewed by Chris Dumez.
The crash was caused by HTMLInputElement::formWillBeDestroyed trying to
remove itself
from the radio button group in HTMLInputElement::willChangeForm(). This in
turn causes
RadioButtonGroup::remove to update the validity for all radio buttons in
the group.
However, some of those other radio buttons may no longer have a parent in
which case
we would do a nullptr dereference and crash.
Fixed the bug by explicitly clearing RadioButtonGroups in HTMLFormElement's
destructor.
No new tests since we don't have a reproduction.
* Source/WebCore/dom/RadioButtonGroups.cpp:
(WebCore::RadioButtonGroups::clear):
* Source/WebCore/dom/RadioButtonGroups.h:
* Source/WebCore/html/HTMLFormElement.cpp:
(WebCore::HTMLFormElement::~HTMLFormElement):
Canonical link: https://commits.webkit.org/301470@main
Canonical link: https://commits.webkit.org/290945.410@webkitglib/2.48
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
