Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 4f359a0df3734d9b3081fc937eb10563241c448f
https://github.com/WebKit/WebKit/commit/4f359a0df3734d9b3081fc937eb10563241c448f
Author: Anne van Kesteren <[email protected]>
Date: 2026-05-30 (Sat, 30 May 2026)
Changed paths:
A
LayoutTests/fast/forms/select/base/option-checkmark-content-change-crash-expected.txt
A
LayoutTests/fast/forms/select/base/option-checkmark-content-change-crash.html
M Source/WebCore/rendering/updating/RenderTreeBuilderFormControls.cpp
Log Message:
-----------
Crash when recreating option::checkmark
https://bugs.webkit.org/show_bug.cgi?id=315835
rdar://178153707
Reviewed by Tim Nguyen.
RenderTreeBuilder::FormControls::updateAfterDescendants passes
renderer.firstChild() as beforeChild when calling updatePseudoElement for
<option> elements, so the ::checkmark is inserted as the first child. After
the first update the existing ::checkmark is the first child, so when its
content changes (e.g., via option:not(:checked)::checkmark { content: "." })
updatePseudoElement destroys it and then re-attaches a fresh pseudo using the
now-dangling beforeChild, crashing in RenderTreeBuilder::Block::attach.
Advance beforeChild to the existing pseudo's nextSibling before destroying
it, so the replacement is attached in the same logical position.
Test: fast/forms/select/base/option-checkmark-content-change-crash.html
Canonical link: https://commits.webkit.org/314208@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
