Bug 305457

Summary:

[iOS 26.1] <select> element menu dismiss may crash

Product:

WebKit

Reporter:

rhythm <rhythmkay>

Component:

Forms

Assignee:

Nobody <webkit-unassigned>

Status:

RESOLVED DUPLICATE

Severity:

Critical

CC:

cdumez, wenson_hsieh

Priority:

Version:

Safari 26

Hardware:

iPhone / iPad

OS:

iOS 26

Attachments:

Description	Flags
crash log	none

rhythm

Reported 2026-01-14 00:05:52 PST

Created attachment 478005 [details] crash log Our app has recently experienced serious crashes. The change introduced in ‘https://bugs.webkit.org/show_bug.cgi?id=299822’ may cause a crash on iOS 26.1 or later. It appears that ’elementContext‘ becomes nil before the function ‘WebCore::ElementContext::isSameElement(const WebCore::ElementContext&)’ is called. This crash can be frequently reproduced on certain websites, such as: ‘https://static.jnb.icbc.com.cn/ICBC/ICBCCOIN/roccentry.html’

Attachments
crash log (4.28 KB, text/plain) 2026-01-14 00:05 PST, rhythm	no flags	Details
View All Add attachment proposed patch, testcase, etc.

Alexey Proskuryakov

Comment 1 2026-01-14 11:23:40 PST

Thank you for the report! I couldn't easily reproduce with this website (probably because loading it is not enough, and some action is needed), but this looks exactly the same as bug 303917. *** This bug has been marked as a duplicate of bug 303917 ***

Note You need to log in before you can comment on or make changes to this bug.