[webkit-reviews] review granted: [Bug 190252] Regression(r236779): Crash when changing the input element type from inside an 'input' event listener : [Attachment 351602] Patch

[bugzilla-daemon at webkit.org]

Alex Christensen <achristensen at apple.com> has granted Chris Dumez
<cdumez at apple.com>'s request for review:
Bug 190252: Regression(r236779): Crash when changing the input element type
from inside an 'input' event listener
https://bugs.webkit.org/show_bug.cgi?id=190252

Attachment 351602: Patch

https://bugs.webkit.org/attachment.cgi?id=351602&action=review




--- Comment #8 from Alex Christensen <achristensen at apple.com> ---
Comment on attachment 351602
  --> https://bugs.webkit.org/attachment.cgi?id=351602
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=351602&action=review

> Source/WebCore/html/BaseCheckableInputType.cpp:134
> +    if (auto* element = this->element())
> +	   element->dispatchFormControlChangeEvent();

It seems like this is a general JavaScript re-entry problem.  Maybe this should
be done on the next runloop iteration?