Skip to content
Permalink
Browse files
Fix invalid isInShadowRoot flag during input element removal
https://bugs.webkit.org/show_bug.cgi?id=241470

Reviewed by Ryosuke Niwa.

Style invalidation of input elements might rely on whether the element
is in the shadow tree, but during node removal the isInShadowRoot flag
might not be up-to-date. Ensure that the flag is updated by
letting Node::removedFromAncestor() be called up first in the
HTMLInputNode::removedFromAncestor() implementation, before
doing anything else with the node post-removal.

* Source/WebCore/html/HTMLInputElement.cpp:
(WebCore::HTMLInputElement::removedFromAncestor):

Canonical link: https://commits.webkit.org/251442@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@295436 268f45cc-cd09-0410-ab3c-d52691b4dbfc
  • Loading branch information
csaavedra committed Jun 9, 2022
1 parent 9638197 commit ce15efd51dda70b580b617b4d0ba1df630b746c8
Showing 1 changed file with 1 addition and 1 deletion.
@@ -1585,6 +1585,7 @@ void HTMLInputElement::didFinishInsertingNode()

void HTMLInputElement::removedFromAncestor(RemovalType removalType, ContainerNode& oldParentOfRemovedTree)
{
HTMLTextFormControlElement::removedFromAncestor(removalType, oldParentOfRemovedTree);
if (removalType.treeScopeChanged && isRadioButton())
oldParentOfRemovedTree.treeScope().radioButtonGroups().removeButton(*this);
if (removalType.disconnectedFromDocument && !form())
@@ -1593,7 +1594,6 @@ void HTMLInputElement::removedFromAncestor(RemovalType removalType, ContainerNod
document().removeElementWithPendingUserAgentShadowTreeUpdate(*this);
m_hasPendingUserAgentShadowTreeUpdate = false;
}
HTMLTextFormControlElement::removedFromAncestor(removalType, oldParentOfRemovedTree);
ASSERT(!isConnected());
if (removalType.disconnectedFromDocument && !form() && isRadioButton())
updateValidity();

0 comments on commit ce15efd

Please sign in to comment.