haikuwebkit/LayoutTests/fast/forms/radio-input-in-shadow-root-...

17 lines
581 B
HTML
Raw Permalink Normal View History

Crash when setting HTMLInputElement.checked for a disconnected radio button in a shadow root https://bugs.webkit.org/show_bug.cgi?id=204208 <rdar://problem/57045830> Reviewed by Tim Horton. Source/WebCore: r251110 refactored logic in RadioButtonGroup::updateCheckedState, such that it assumes that m_nameToGroupMap always contains an entry for the given input element's name. Prior to r251110, it would bail if m_nameToGroupMap didn't exist. In this particular case, a named input element is added to a shadow root that is disconnected from the document. This means that in HTMLInputElement::didFinishInsertingNode(), we will avoid adding the element to the radio button group, even though it has a tree scope due to the `isConnected()` check. Later, when we try to set the `checked` attribute, we invoke updateCheckedState which sees that we have a tree scope and assumes that we must have previously added the input element to the radio button map; this leads to a nullptr deref, as the map is empty. Thus, to fix this, we change the `isConnected()` check to `isInTreeScope()`. Test: fast/forms/radio-input-in-shadow-root-crash.html * html/HTMLInputElement.cpp: (WebCore::HTMLInputElement::didFinishInsertingNode): LayoutTests: Adds a new layout test to verify that we don't crash in this scenario. * fast/forms/radio-input-in-shadow-root-crash-expected.txt: Added. * fast/forms/radio-input-in-shadow-root-crash.html: Added. 2019-11-07 Youenn Fablet <youenn@apple.com> Update libwebrtc to M78 https://bugs.webkit.org/show_bug.cgi?id=203897 Reviewed by Eric Carlson. * webrtc/simulcast-h264.html: Update test to remove rid information from answer. Canonical link: https://commits.webkit.org/217518@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@252478 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2019-11-15 03:26:51 +00:00
<!DOCTYPE html>
<html>
<body>
<script src="../../resources/js-test.js"></script>
<input type="radio" name="foo" />
<script>
description("This test checks that the checked attribute can be set on a disconnected radio button inside a shadow root. This test passes if it does not crash.");
input = document.querySelector("input")
const container = document.createElement("div");
container.attachShadow({ mode: "open" }).appendChild(input);
input.checked = true;
shouldBeTrue("input.checked");
</script>
</body>
</html>