Skip to content

script: Do not consider a node an ancestor of itself in Node::is_ancestor_of#42263

Merged
mrobinson merged 1 commit intoservo:mainfrom
mrobinson:is-ancestor-of
Jan 31, 2026
Merged

script: Do not consider a node an ancestor of itself in Node::is_ancestor_of#42263
mrobinson merged 1 commit intoservo:mainfrom
mrobinson:is-ancestor-of

Conversation

@mrobinson
Copy link
Copy Markdown
Member

This change fixes a crash in options collections due to the fact that a
<select> element was being considered an ancestor of itself. This
regression likely introduced in #40776.

This change also fills in the specification text for
HTMLOptionCollect::Add.

Testing: This change adds a WPT crash test.
Fixes: #41080.

…estor_of`

This change fixes a crash in options collections due to the fact that a
`<select>` element was being considered an ancestor of itself. This
regression likely introduced in servo#40776.

This change also fills in the specification text for
`HTMLOptionCollect::Add`.

Signed-off-by: Martin Robinson <mrobinson@igalia.com>
@servo-wpt-sync
Copy link
Copy Markdown
Collaborator

🤖 Opened new upstream WPT pull request (web-platform-tests/wpt#57466) with upstreamable changes.

@servo-highfive servo-highfive removed the S-awaiting-review There is new code that needs to be reviewed. label Jan 31, 2026
@mrobinson mrobinson added this pull request to the merge queue Jan 31, 2026
@servo-highfive servo-highfive added the S-awaiting-merge The PR is in the process of compiling and running tests on the automated CI. label Jan 31, 2026
Merged via the queue into servo:main with commit 1900ebc Jan 31, 2026
32 checks passed
@mrobinson mrobinson deleted the is-ancestor-of branch January 31, 2026 10:55
@servo-highfive servo-highfive removed the S-awaiting-merge The PR is in the process of compiling and running tests on the automated CI. label Jan 31, 2026
@mrobinson
Copy link
Copy Markdown
Member Author

I neglected to mention in the PR description that I audited the other callers of is_ancestor_of and there were 3-4. Two were used in in this <select> logic. The others seemed to explicitly handle the node equality case ahead of time.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

panic: called Option::unwrap() on a None value (thread Script#1, at components/script/dom/html/htmloptionscollection.rs:224)

4 participants