Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: bdc3067a395f3e7d9fe0b4550950297afc5ddf03
https://github.com/WebKit/WebKit/commit/bdc3067a395f3e7d9fe0b4550950297afc5ddf03
Author: Ahmad Saleem <[email protected]>
Date: 2026-09-15 (Tue, 15 Sep 2026)
Changed paths:
M
LayoutTests/imported/w3c/web-platform-tests/input-events/input-events-arrow-key-on-number-input-delete-document-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/input-events/input-events-arrow-key-on-number-input-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/input-events/input-events-arrow-key-on-number-input-prevent-default-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/input-events/input-events-spin-button-click-on-number-input-delete-document-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/input-events/input-events-spin-button-click-on-number-input-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/input-events/input-events-spin-button-click-on-number-input-prevent-default-expected.txt
M Source/WebCore/html/InputType.cpp
M Source/WebCore/html/shadow/SpinButtonElement.cpp
Log Message:
-----------
Number input does not fire a beforeinput event when stepped via arrow keys or
spin buttons
https://bugs.webkit.org/show_bug.cgi?id=324060
rdar://187294318
Reviewed by Wenson Hsieh and Ryosuke Niwa.
User-driven stepping of a number input (arrow keys or the spin button) mutated
the value and fired input/change without first firing a cancelable beforeinput
event, unlike other editing operations. This meant pages could neither observe
nor cancel the step, and the event order was "input, change" instead of
"beforeinput, input, change".
Dispatch a cancelable beforeinput from InputType::stepUpFromRenderer(), the
user-driven entry point, before any value mutation. Programmatic
stepUp()/stepDown() go through applyStep() directly and stay silent. If the
event is default-prevented, or its handler tears down the element or its frame,
bail out without changing the value or firing input/change.
Firing script from stepUpFromRenderer() surfaced two latent crashes in the spin
button path when the handler removes the element's frame, both fixed here:
- SpinButtonElement::defaultEventHandler() held a CheckedPtr to the render box
across doStepAction(). Destroying the renderer from the handler left that
CheckedPtr dangling, crashing on scope exit. Release it before the reentrant
calls.
- The repeating timer is started before doStepAction(); once the frame is gone
the mouseup that would stop it bails at the null render-box check, leaving a
live timer firing against a torn-down tree. Stop it if the renderer is gone
after doStepAction().
Covered by the imported input-events WPT for arrow-key and spin-button stepping
on number inputs (base ordering, prevent-default, and delete-document), whose
FAIL baselines now switched as they now pass.
*
LayoutTests/imported/w3c/web-platform-tests/input-events/input-events-arrow-key-on-number-input-delete-document-expected.txt:
Progression
*
LayoutTests/imported/w3c/web-platform-tests/input-events/input-events-arrow-key-on-number-input-expected.txt:
Ditto
*
LayoutTests/imported/w3c/web-platform-tests/input-events/input-events-arrow-key-on-number-input-prevent-default-expected.txt:
Ditto
*
LayoutTests/imported/w3c/web-platform-tests/input-events/input-events-spin-button-click-on-number-input-delete-document-expected.txt:
Ditto
*
LayoutTests/imported/w3c/web-platform-tests/input-events/input-events-spin-button-click-on-number-input-expected.txt:
Ditto
*
LayoutTests/imported/w3c/web-platform-tests/input-events/input-events-spin-button-click-on-number-input-prevent-default-expected.txt:
Ditto
* Source/WebCore/html/InputType.cpp:
(WebCore::InputType::stepUpFromRenderer):
* Source/WebCore/html/shadow/SpinButtonElement.cpp:
(WebCore::SpinButtonElement::defaultEventHandler):
Canonical link: https://commits.webkit.org/321214@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
