Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: be08720593705c04826f1e0804581ea8aafb2748
https://github.com/WebKit/WebKit/commit/be08720593705c04826f1e0804581ea8aafb2748
Author: Aditya Keerthi <[email protected]>
Date: 2026-08-12 (Wed, 12 Aug 2026)
Changed paths:
A
LayoutTests/fast/forms/datalist/datalist-button-change-input-type-on-click-crash-expected.txt
A
LayoutTests/fast/forms/datalist/datalist-button-change-input-type-on-click-crash.html
M Source/WebCore/html/TextFieldInputType.cpp
M Source/WebCore/html/shadow/DataListButtonElement.cpp
M Source/WebCore/html/shadow/DataListButtonElement.h
Log Message:
-----------
[WebCore] Use-after-free in `DataListButtonElement::defaultEventHandler`
https://bugs.webkit.org/show_bug.cgi?id=313521
rdar://175672489
Reviewed by Ryosuke Niwa.
`DataListButtonElement` stores its owner as a raw `DataListButtonOwner&
m_owner`.
The only `DataListButtonOwner` is `TextFieldInputType`. When the type of the
owning input element is changed, `HTMLInputElement::updateType()` calls
`removeShadowSubtree()`. This will null out `m_dataListDropdownIndicator` but
does not clear the owner member in `DataListButtonElement`. Changing the type
inside a `click` listener results in the `TextFieldInputType` being freed while
event dispatch is in progress. Eventually,
`DataListButtonElement::defaultEventHandler()`
is called, calling `m_owner.dataListButtonElementWasClicked()` after `m_owner`
was already freed.
Fix storing the owner as a `WeakPtr` and by clearing it out in
`removeShadowSubtree()`. This matches the implementation of `SpinButtonElement`.
*
LayoutTests/fast/forms/datalist/datalist-button-change-input-type-on-click-crash-expected.txt:
Added.
*
LayoutTests/fast/forms/datalist/datalist-button-change-input-type-on-click-crash.html:
Added.
* Source/WebCore/html/TextFieldInputType.cpp:
(WebCore::TextFieldInputType::removeShadowSubtree):
* Source/WebCore/html/shadow/DataListButtonElement.cpp:
(WebCore::DataListButtonElement::defaultEventHandler):
* Source/WebCore/html/shadow/DataListButtonElement.h:
Originally-landed-as: [email protected] (1207b71f0518).
rdar://184744860
Canonical link: https://commits.webkit.org/319066@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
