Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 2bbc270ed64cf3f873a6e01455c305fa040e6b19
https://github.com/WebKit/WebKit/commit/2bbc270ed64cf3f873a6e01455c305fa040e6b19
Author: Kristian Monsen <[email protected]>
Date: 2026-09-12 (Sat, 12 Sep 2026)
Changed paths:
A
LayoutTests/fast/forms/select/base/picker-icon-table-column-crash-expected.txt
A LayoutTests/fast/forms/select/base/picker-icon-table-column-crash.html
M Source/WebCore/rendering/updating/RenderTreeBuilderFormControls.cpp
Log Message:
-----------
RenderTreeBuilder::FormControls::updatePseudoElement attaches a ::picker-icon
renderer to a RenderTableCol
https://bugs.webkit.org/show_bug.cgi?id=323585
rdar://185183091
Reviewed by Tim Nguyen.
RenderTreeBuilder::FormControls::updatePseudoElement() attaches the
::picker-icon and
::checkmark renderers to the form control's renderer without consulting
canHaveChildren() or isChildAllowed(), unlike every other renderer creation
path. A
<select> with appearance: base-select and display: table-column therefore gets
an
anonymous RenderBlockFlow under its RenderTableCol, breaking the invariant that
nextColumn() relies on when it hard-casts firstChild() with
downcast<RenderTableCol>().
Check both before attaching, which leaves firstChild() null so nextColumn()
falls
through to its already type-filtered sibling walk. Both are needed:
table-column is
rejected by canHaveChildren(), table-column-group by isChildAllowed(). The
checks sit
after the existing-renderer teardown, and before createContentRenderers() and
setPseudoElementRenderer(), so nothing stale is kept and the discarded renderer
is a
leaf with no pointer published to the parent. Not a regression from
307421@main: the
unguarded attach predates it in updateCheckmark() and is still reachable via
::checkmark with an author rule, but select::picker-icon applies to every base
appearance menulist <select>, so plain markup now reaches it.
Test: fast/forms/select/base/picker-icon-table-column-crash.html
*
LayoutTests/fast/forms/select/base/picker-icon-table-column-crash-expected.txt:
Added.
* LayoutTests/fast/forms/select/base/picker-icon-table-column-crash.html: Added.
* Source/WebCore/rendering/updating/RenderTreeBuilderFormControls.cpp:
(WebCore::RenderTreeBuilder::FormControls::updatePseudoElement):
Canonical link: https://commits.webkit.org/320996@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
