Branch: refs/heads/webkitglib/2.50
Home: https://github.com/WebKit/WebKit
Commit: 6d8963c9a27d2c350b503b5c9734614b50f7a163
https://github.com/WebKit/WebKit/commit/6d8963c9a27d2c350b503b5c9734614b50f7a163
Author: Ryosuke Niwa <[email protected]>
Date: 2025-11-10 (Mon, 10 Nov 2025)
Changed paths:
M Source/WebCore/html/HTMLFormElement.cpp
Log Message:
-----------
Cherry-pick 301470@main (985b9fb1a2eb).
https://bugs.webkit.org/show_bug.cgi?id=300682
Crash in WebCore::addInvalidElementToAncestorFromInsertionPoint
https://bugs.webkit.org/show_bug.cgi?id=300682
Reviewed by Chris Dumez.
The crash was caused by HTMLInputElement::formWillBeDestroyed trying to
remove itself
from the radio button group in HTMLInputElement::willChangeForm(). This in
turn causes
RadioButtonGroup::remove to update the validity for all radio buttons in
the group.
However, some of those other radio buttons may no longer have a parent in
which case
we would do a nullptr dereference and crash.
Fixed the bug by explicitly clearing RadioButtonGroups in HTMLFormElement's
destructor.
No new tests since we don't have a reproduction.
* Source/WebCore/dom/RadioButtonGroups.cpp:
(WebCore::RadioButtonGroups::clear):
* Source/WebCore/dom/RadioButtonGroups.h:
* Source/WebCore/html/HTMLFormElement.cpp:
(WebCore::HTMLFormElement::~HTMLFormElement):
Canonical link: https://commits.webkit.org/301470@main
Canonical link: https://commits.webkit.org/298234.236@webkitglib/2.50
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
