Fix nested <option> traversals

Multiple crashes were occurring due to inconsistencies between option traversals. OptionList was not considering nested <option>s to be associated with the select. However, HTMLOptionElement::InsertedInto and HTMLOptionElement::OwnerSelectElement were considering nested <option>s to be associated with selects. This patch makes the traversals consistent by disallowing nested <option>s from creating associations with <select> elements. Fixed: 376786406 Change-Id: Ia6e4cc7d028033885b452efe03687638446350ab Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5990895 Commit-Queue: Joey Arhar <[email protected]> Reviewed-by: David Baron <[email protected]> Cr-Commit-Position: refs/heads/main@{#1379764}
web-platform-tests · Nov 7, 2024 · db9eb64 · db9eb64
1 parent 20be6ba
commit db9eb64
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 3 deletions.
diff --git a/html/semantics/forms/the-select-element/customizable-select/nested-options.tenative.html b/html/semantics/forms/the-select-element/customizable-select/nested-options.tenative.html
@@ -2,6 +2,7 @@
 <link rel=author href="mailto:[email protected]">
 <link rel=help href="https://bugs.chromium.org/p/chromium/issues/detail?id=1422275">
 <link rel=help href="https://chromium-review.googlesource.com/c/chromium/src/+/5441435/1#message-cd8841d92a672a0276ab536dfaf3a20e93d5e6e3">
+<link rel=help href="https://issues.chromium.org/issues/376786406">
 <script src="/resources/testharness.js"></script>
 <script src="/resources/testharnessreport.js"></script>
 <script src="/resources/testdriver.js"></script>
@@ -34,10 +35,9 @@
 o1.appendChild(o2);
 
 test(() => {
-  assert_equals(select.options.length, 2, 'select.options.length');
+  assert_equals(select.options.length, 1, 'select.options.length');
   assert_equals(select.options[0], o1, 'select.options[0]');
-  assert_equals(select.options[1], o2, 'select.options[1]');
-}, 'Nested <options> should be listed in <select> IDLs.');
+}, 'Nested <options> not should be listed in <select> IDLs.');
 
 promise_test(async () => {
   await test_driver.bless();

diff --git a/.../semantics/forms/the-select-element/customizable-select/selected-option-parser-crash.html b/.../semantics/forms/the-select-element/customizable-select/selected-option-parser-crash.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<select disabled>
+  <option id=one selected>one</option>
+  <option id=two disabled>two
+    <table><div><div</table>
+  </option>
+  <option id=three selected>three</option>
+</select>