mirrors/ladybird
1
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2025-01-22 09:12:13 -05:00
Code Issues Projects Releases Packages Wiki Activity

LibWeb: Iterate over a copy of associated form controls in form.reset()

Browse source 
DOM structure may change during reset algorithm invocation, which may
lead to form controls being unregistered.
This commit is contained in:
Andreas Kling 2025-01-21 13:48:16 +01:00 committed by Jelle Raaijmakers
parent 34a8f51eb8
commit a0b44ff5e7
Notes: github-actions[bot] 2025-01-21 16:03:52 +00:00 
Author: https://github.com/awesomekling
Commit: https://github.com/LadybirdBrowser/ladybird/commit/a0b44ff5e7d
Pull-request: https://github.com/LadybirdBrowser/ladybird/pull/3333
Reviewed-by: https://github.com/trflynn89
2 changed files with 6 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
Libraries/LibWeb/HTML/HTMLFormElement.cpp
View file

@ -317,7 +317,8 @@ void HTMLFormElement::reset_form()
// 2. If reset is true, then invoke the reset algorithm of each resettable element whose form owner is form. // 2. If reset is true, then invoke the reset algorithm of each resettable element whose form owner is form.
if (reset) { if (reset) {
for (auto element : m_associated_elements) { GC::RootVector<GC::Ref<HTMLElement>> associated_elements_copy(heap(), m_associated_elements);
for (auto element : associated_elements_copy) {
VERIFY(is<FormAssociatedElement>(*element)); VERIFY(is<FormAssociatedElement>(*element));
auto& form_associated_element = dynamic_cast<FormAssociatedElement&>(*element); auto& form_associated_element = dynamic_cast<FormAssociatedElement&>(*element);
if (form_associated_element.is_resettable()) if (form_associated_element.is_resettable())

4
Tests/LibWeb/Crash/HTML/reset-form-iteration.html Normal file
View file

@ -0,0 +1,4 @@
<form id="theForm"><output><input></output></form>
<script>
theForm.reset();
</script>