Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 985b9fb1a2eb5b24e9e66c629a253146c8a9db36
https://github.com/WebKit/WebKit/commit/985b9fb1a2eb5b24e9e66c629a253146c8a9db36
Author: Ryosuke Niwa <[email protected]>
Date: 2025-10-14 (Tue, 14 Oct 2025)
Changed paths:
M Source/WebCore/dom/RadioButtonGroups.cpp
M Source/WebCore/dom/RadioButtonGroups.h
M Source/WebCore/html/HTMLFormElement.cpp
Log Message:
-----------
Crash in WebCore::addInvalidElementToAncestorFromInsertionPoint
https://bugs.webkit.org/show_bug.cgi?id=300682
Reviewed by Chris Dumez.
The crash was caused by HTMLInputElement::formWillBeDestroyed trying to remove
itself
from the radio button group in HTMLInputElement::willChangeForm(). This in turn
causes
RadioButtonGroup::remove to update the validity for all radio buttons in the
group.
However, some of those other radio buttons may no longer have a parent in which
case
we would do a nullptr dereference and crash.
Fixed the bug by explicitly clearing RadioButtonGroups in HTMLFormElement's
destructor.
No new tests since we don't have a reproduction.
* Source/WebCore/dom/RadioButtonGroups.cpp:
(WebCore::RadioButtonGroups::clear):
* Source/WebCore/dom/RadioButtonGroups.h:
* Source/WebCore/html/HTMLFormElement.cpp:
(WebCore::HTMLFormElement::~HTMLFormElement):
Canonical link: https://commits.webkit.org/301470@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
