Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: c1865f07b6052e2f287d1b24ca6564a79699ec47
https://github.com/WebKit/WebKit/commit/c1865f07b6052e2f287d1b24ca6564a79699ec47
Author: Kristian Monsen <[email protected]>
Date: 2026-09-28 (Mon, 28 Sep 2026)
Changed paths:
A
LayoutTests/fast/forms/select/listbox-keydown-change-event-destroys-renderer-crash-expected.txt
A
LayoutTests/fast/forms/select/listbox-keydown-change-event-destroys-renderer-crash.html
M LayoutTests/platform/ios/TestExpectations
M Source/WebCore/html/HTMLSelectElement.cpp
Log Message:
-----------
REGRESSION(268926@main): Crash in
HTMLSelectElement::listBoxDefaultEventHandler() when a change event handler
destroys the select's renderer
https://bugs.webkit.org/show_bug.cgi?id=325437
rdar://186262031
Reviewed by Chris Dumez and Zak Ridouh.
The renderer pointer no longer outlives the event dispatch. The writing mode is
read inside an immediately-invoked lambda,
so the CheckedPtr is destroyed two lines later;
scrollToRevealElementAtListIndex() re-fetches renderer() at the point of
use, as the code did before 268926@main; and defaultEventHandler() null-checks
without retaining a pointer, which restores
the scoping that 274132@main had and 306549@main dropped. Nothing now holds a
renderer across listBoxOnChange(), so a
handler that destroys it leaves no stale reference behind.
The test is skipped on iOS, where HTMLSelectElement::usesMenuList() is
unconditionally true and there is therefore no
list box event handling to exercise.
Test:
fast/forms/select/listbox-keydown-change-event-destroys-renderer-crash.html
*
LayoutTests/fast/forms/select/listbox-keydown-change-event-destroys-renderer-crash-expected.txt:
Added.
*
LayoutTests/fast/forms/select/listbox-keydown-change-event-destroys-renderer-crash.html:
Added.
* LayoutTests/platform/ios/TestExpectations:
* Source/WebCore/html/HTMLSelectElement.cpp:
(WebCore::HTMLSelectElement::listBoxDefaultEventHandler):
(WebCore::HTMLSelectElement::defaultEventHandler):
Canonical link: https://commits.webkit.org/322111@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
