Bug 190620

Summary:

[Datalist] fast/forms/datalist/datalist-child-validation.html crashes with a debug assertion in isValidFormControlElement()

Product:

WebKit

Reporter:

Wenson Hsieh <wenson_hsieh>

Component:

Forms

Assignee:

Wenson Hsieh <wenson_hsieh>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

bdakin, cdumez, commit-queue, jlewis3, jonlee, realdawei, rniwa, ryanhaddad, thorton, tsavell, webkit-bug-importer, wenson_hsieh

Priority:

Keywords:

InRadar

Version:

WebKit Nightly Build

Hardware:

Unspecified

OS:

Unspecified

Attachments:

Description	Flags
Patch	rniwa: review+
Rebase on trunk	none

Description Wenson Hsieh 2018-10-16 08:40:26 PDT

Specifically, ASSERT(m_isValid == isValid());

When removing a form control element from a datalist, it seems we don't do the necessary bookkeeping to ensure that validity/willValidate is up to date.

Comment 1 Radar WebKit Bug Importer 2018-10-16 08:41:03 PDT Comment hidden (obsolete)

<rdar://problem/45307057>

Comment 2 Wenson Hsieh 2018-10-16 09:06:53 PDT Comment hidden (obsolete)

(In reply to Radar WebKit Bug Importer from comment #1)
> <rdar://problem/45307057>

Never mind, found a much earlier dupe: <rdar://problem/19226679>

Comment 3 Wenson Hsieh 2018-10-22 03:53:54 PDT

Created attachment 352884 [details]
Patch

Comment 4 Jon Lee 2019-03-01 16:10:35 PST

someone should review this...?

Comment 5 Jon Lee 2019-03-01 16:10:47 PST

rdar://problem/19226679

Comment 6 Wenson Hsieh 2019-03-01 20:21:28 PST

Created attachment 363403 [details]
Rebase on trunk

Comment 7 WebKit Commit Bot 2019-03-01 22:09:36 PST

Comment on attachment 363403 [details]
Rebase on trunk

Clearing flags on attachment: 363403

Committed r242309: <https://trac.webkit.org/changeset/242309>