tree 977c58ae586df892c090f0ec8d964e3dfcb81351
parent 615e8de5e6ca288b6ad27c685170483865d795ce
author rniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1579222029 +0000
committer rniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1579222029 +0000

REGRESSION (r251110): Crash on https://developer.apple.com/tutorials/swiftui/creating-and-combining-views
https://bugs.webkit.org/show_bug.cgi?id=206337

Reviewed by Geoffrey Garen.

Source/WebCore:

The crash was caused by RadioButtonGroups::hasCheckedButton getting called by RadioInputType's
matchesIndeterminatePseudoClass during a style update which happens before the input element had a chance
to register itself with RadioButtonGroups in HTMLInputElement::didFinishInsertingNode.

This happens, in particular, when didFinishInsertingNode of other nodes that appear before the input element
executes arbitrary author scripts or otherwise update the style.

Test: fast/forms/match-pseudo-on-radio-before-finalizing-tree-insertion-crash.html

* dom/RadioButtonGroups.cpp:
(WebCore::RadioButtonGroups::hasCheckedButton const):

LayoutTests:

Added a regression test. The test crashes on trunk and causes an infinite loop before r251110.

* fast/forms/match-pseudo-on-radio-before-finalizing-tree-insertion-crash-expected.txt: Added.
* fast/forms/match-pseudo-on-radio-before-finalizing-tree-insertion-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@254722 268f45cc-cd09-0410-ab3c-d52691b4dbfc