[Webkit-unassigned] [Bug 208244] New: Crash on iOS when modifying file input type inside change handler

Wed Feb 26 08:41:13 PST 2020

https://bugs.webkit.org/show_bug.cgi?id=208244

            Bug ID: 208244
           Summary: Crash on iOS when modifying file input type inside
                    change handler
           Product: WebKit
           Version: Safari 13
          Hardware: iPhone / iPad
                OS: iOS 13
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: DOM
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: davars at gmail.com

Created attachment 391747

  --> https://bugs.webkit.org/attachment.cgi?id=391747&action=review

Crash Report

This page occasionally crashes WebKit on my phone once a file is selected:

<!DOCTYPE html>
<html lang="en">

<head>
    <meta charset="utf-8">
    <title>upload test</title>
</head>

<body>
    <input type="file" id="file-input" />
    <script>
        const fileInput = document.querySelector('#file-input');
        fileInput.addEventListener('change', (evt) => {
            // from bootstrap-vue's form-file.js
            fileInput.type = '';
        });
    </script>
</body>

</html>

Crash report attached, top of the stack trace (for searchability): WebCore::FileInputType::filesChosen+ 17175144 (WTF::Vector<WebCore::FileChooserFileInfo, 0ul, WTF::CrashOnOverflow, 16ul> const&, WTF::String const&, WebCore::Icon*) + 744

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20200226/5c1b43d4/attachment.htm>