Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 810f13a41f203822a3bab0e23374dcea46ad9531
https://github.com/WebKit/WebKit/commit/810f13a41f203822a3bab0e23374dcea46ad9531
Author: Anne van Kesteren <[email protected]>
Date: 2026-06-21 (Sun, 21 Jun 2026)
Changed paths:
A
LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-add-multiple-crash.html
A
LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-multiple-keydown-crash.html
A
LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-multiple-mousemove-crash.html
M Source/WebCore/html/HTMLSelectElement.cpp
Log Message:
-----------
REGRESSION(307136@main): crash adding multiple attribute to appearance: base
<select>
https://bugs.webkit.org/show_bug.cgi?id=317533
Reviewed by Tim Nguyen.
An appearance: base <select> uses a generic renderer. Setting a
multiple attribute makes it so that m_multiple is true, but the
renderer is still generic. This causes crashes in points that
unconditionally downcast to RenderListBox.
Now we no-op when casting fails.
Thanks to Keith Cirkel for mentioning this to me.
Tests:
imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-add-multiple-crash.html
imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-multiple-keydown-crash.html
imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-multiple-mousemove-crash.html
Upstream: https://github.com/web-platform-tests/wpt/pull/60774
Canonical link: https://commits.webkit.org/315575@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
