diff --git a/Libraries/LibWeb/HTML/HTMLFormElement.cpp b/Libraries/LibWeb/HTML/HTMLFormElement.cpp index 3849c18e24a..26e0c67d105 100644 --- a/Libraries/LibWeb/HTML/HTMLFormElement.cpp +++ b/Libraries/LibWeb/HTML/HTMLFormElement.cpp @@ -317,7 +317,8 @@ void HTMLFormElement::reset_form() // 2. If reset is true, then invoke the reset algorithm of each resettable element whose form owner is form. if (reset) { - for (auto element : m_associated_elements) { + GC::RootVector> associated_elements_copy(heap(), m_associated_elements); + for (auto element : associated_elements_copy) { VERIFY(is(*element)); auto& form_associated_element = dynamic_cast(*element); if (form_associated_element.is_resettable()) diff --git a/Tests/LibWeb/Crash/HTML/reset-form-iteration.html b/Tests/LibWeb/Crash/HTML/reset-form-iteration.html new file mode 100644 index 00000000000..41ac9b109e5 --- /dev/null +++ b/Tests/LibWeb/Crash/HTML/reset-form-iteration.html @@ -0,0 +1,4 @@ +
+