[Webkit-unassigned] [Bug 210353] Null ptr Deref in RadioButtonGroups::updateCheckedState

Fri Apr 10 13:52:40 PDT 2020

https://bugs.webkit.org/show_bug.cgi?id=210353

--- Comment #4 from Wenson Hsieh <wenson_hsieh at apple.com> ---
Comment on attachment 396118
  --> https://bugs.webkit.org/attachment.cgi?id=396118
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=396118&action=review

> LayoutTests/fast/forms/input-element-default-checked-setter-crash.html:16
> +<meta id="meta1"> </meta>

I don’t think this meta tag is necessary to reproduce this crash.

Here’s a slightly simpler version of this test case:

<!DOCTYPE html>
<html>
<body>
<p>This test passes if there is no crash</p>
<div id="container">
    <iframe id="frame"></iframe>
    <input id="input" name=" " type="radio">
</div>
<script>
if (window.testRunner)
    testRunner.dumpAsText();
frame.onload = () => input.defaultChecked = true;
document.body.appendChild(container);
</script>
</body>
</html>

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20200410/80a008d0/attachment.htm>