[Webkit-unassigned] [Bug 201289] New: <input type="file"> is not kept alive during file picker, if it gets GC'd file selection has no affect

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Wed Aug 28 23:56:04 PDT 2019


https://bugs.webkit.org/show_bug.cgi?id=201289

            Bug ID: 201289
           Summary: <input type="file"> is not kept alive during file
                    picker, if it gets GC'd file selection has no affect
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: Forms
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: joepeck at webkit.org
                CC: cdumez at apple.com, drousso at apple.com, rniwa at webkit.org,
                    wenson_hsieh at apple.com

A `<input type="file">` can get GC'd while the dialog is up if the element is not in the DOM.

When the Element is GC'd the FileChooser get's invalidated and the file selection gets dropped on the floor.

Should we try to guarantee the element is kept around while the picker is showing (at least not collected)? Note, Web Content has a workaround, but seems weird.

Test:
```
<button id="x">Click</button>
<script>
document.getElementById("x").addEventListener("click", () => {
    let inputElement = document.createElement("input");
    inputElement.type = "file";
    inputElement.multiple = true;
    inputElement.addEventListener("change", (event) => {
        alert('change');
    });
    inputElement.click();
});
</script>
```

Steps to reproduce:
1. Inspect test page
2. Click the button to show the File picker
3. While the file picker is showing trigger a Garbage Collection in Inspector's Console
4. Complete the file picker dialog with a file
  => Alert doesn't happen

Notes:
• I was able to reproduce the issue in Chrome once. Unable to try Firefox.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20190829/fc37b03b/attachment.html>


More information about the webkit-unassigned mailing list