Changeset 295436 in webkit

Timestamp:

Jun 9, 2022, 2:36:44 PM (4 years ago)

Author:

Claudio Saavedra

Message:

Fix invalid isInShadowRoot flag during input element removal
​https://bugs.webkit.org/show_bug.cgi?id=241470

Reviewed by Ryosuke Niwa.

Style invalidation of input elements might rely on whether the element
is in the shadow tree, but during node removal the isInShadowRoot flag
might not be up-to-date. Ensure that the flag is updated by
letting Node::removedFromAncestor() be called up first in the
HTMLInputNode::removedFromAncestor() implementation, before
doing anything else with the node post-removal.

• Source/WebCore/html/HTMLInputElement.cpp:

(WebCore::HTMLInputElement::removedFromAncestor):

Canonical link: ​https://commits.webkit.org/251442@main

File:

• trunk/Source/WebCore/html/HTMLInputElement.cpp (modified) (2 diffs)

trunk/Source/WebCore/html/HTMLInputElement.cpp

@@ -1586 +1586 @@
 void HTMLInputElement::removedFromAncestor(RemovalType removalType, ContainerNode& oldParentOfRemovedTree)
 {
+    HTMLTextFormControlElement::removedFromAncestor(removalType, oldParentOfRemovedTree);
     if (removalType.treeScopeChanged && isRadioButton())
         oldParentOfRemovedTree.treeScope().radioButtonGroups().removeButton(*this);
@@ -1594 +1595 @@
         m_hasPendingUserAgentShadowTreeUpdate = false;
     }
-    HTMLTextFormControlElement::removedFromAncestor(removalType, oldParentOfRemovedTree);
     ASSERT(!isConnected());
     if (removalType.disconnectedFromDocument && !form() && isRadioButton())