Branch: refs/heads/webkitglib/2.50
Home: https://github.com/WebKit/WebKit
Commit: 21efe28c5d6ad95acc277e555db2edfa510e3669
https://github.com/WebKit/WebKit/commit/21efe28c5d6ad95acc277e555db2edfa510e3669
Author: Ryosuke Niwa <[email protected]>
Date: 2025-10-14 (Tue, 14 Oct 2025)
Changed paths:
M Source/WebCore/dom/RadioButtonGroups.cpp
M Source/WebCore/dom/RadioButtonGroups.h
M Source/WebCore/html/HTMLFormElement.cpp
Log Message:
-----------
Cherry-pick 301470@main (985b9fb1a2eb).
https://bugs.webkit.org/show_bug.cgi?id=300682
Crash in WebCore::addInvalidElementToAncestorFromInsertionPoint
https://bugs.webkit.org/show_bug.cgi?id=300682
Reviewed by Chris Dumez.
The crash was caused by HTMLInputElement::formWillBeDestroyed trying to
remove itself
from the radio button group in HTMLInputElement::willChangeForm(). This in
turn causes
RadioButtonGroup::remove to update the validity for all radio buttons in
the group.
However, some of those other radio buttons may no longer have a parent in
which case
we would do a nullptr dereference and crash.
Fixed the bug by explicitly clearing RadioButtonGroups in HTMLFormElement's
destructor.
No new tests since we don't have a reproduction.
* Source/WebCore/dom/RadioButtonGroups.cpp:
(WebCore::RadioButtonGroups::clear):
* Source/WebCore/dom/RadioButtonGroups.h:
* Source/WebCore/html/HTMLFormElement.cpp:
(WebCore::HTMLFormElement::~HTMLFormElement):
Canonical link: https://commits.webkit.org/301470@main
Canonical link: https://commits.webkit.org/298234.197@webkitglib/2.50
Commit: 18434b4f402064dc68344f3d57fd79dcac972949
https://github.com/WebKit/WebKit/commit/18434b4f402064dc68344f3d57fd79dcac972949
Author: Adrian Perez de Castro <[email protected]>
Date: 2025-10-14 (Tue, 14 Oct 2025)
Changed paths:
M Source/WebCore/loader/ImageLoader.cpp
M Source/WebKit/WebProcess/WebPage/WebPage.cpp
Log Message:
-----------
Unreviewed non-unified build fix
* Source/WebCore/loader/ImageLoader.cpp: Add missing include.
* Source/WebKit/WebProcess/WebPage/WebPage.cpp: Ditto.
Canonical link: https://commits.webkit.org/298234.198@webkitglib/2.50
Compare: https://github.com/WebKit/WebKit/compare/8adb5acfcbbc...18434b4f4020
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
