haikuwebkit/LayoutTests/fast/dom/remove-id-form-associated-e...

This tests removing the id from an element when there is a form associated element observing the same ID. WebKit should not crash.

PASS
Null pointer crash in DocumentOrderedMap::getElementById via FormAssociatedElement::findAssociatedForm https://bugs.webkit.org/show_bug.cgi?id=192392 Reviewed by Dean Jackson. Source/WebCore: The crash was caused by FormAssociatedElement::findAssociatedForm invoking DocumentOrderedMap::getElementById and de-referencing nullptr Attribute* via IdTargetObserver before Element::attributeChanged had updated ElementData::m_idForStyleResolution. Fixed it by updating m_idForStyleResolution before invoking IdTargetObservers. Test: fast/dom/remove-id-form-associated-elemet-id-observer-crash.html * dom/Element.cpp: (WebCore::Element::attributeChanged): Fixed the bug. LayoutTests: Added a regression test. * fast/dom/remove-id-form-associated-elemet-id-observer-crash-expected.txt: Added. * fast/dom/remove-id-form-associated-elemet-id-observer-crash.html: Added. Canonical link: https://commits.webkit.org/207043@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@238912 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2018-12-05 23:06:49 +00:00			`This tests removing the id from an element when there is a form associated element observing the same ID. WebKit should not crash.`

			`PASS`