PatchGap
← WebKit — 2026-W38

bdc3067a395f3e7d9fe0b4550950297afc5ddf03  Number input does not fire a beforeinput event when stepped via arrow keys or spin buttons

severity medium class UAF confidence 0.6 signal score 8.3 Source/WebCore/html patch-now
view commit ↗
Primitive: dangling CheckedPtr to a RenderBox freed by JS run during spin-button mouse handling
Triage note: SpinButtonElement::defaultEventHandler now nulls the CheckedPtr `box` before focusAndSelectSpinButtonOwner()/doStepAction() run author JS that can detach the node (comment: 'Release the CheckedPtr first so it isn't left dangling if the renderer dies'), and stops the repeating timer if renderer() is gone; the beforeinput dispatch in stepUpFromRenderer adds a matching frame-detach guard.
Structural signals: smartptr_member_added (+3.0), msg_medium (+2.0), area:Source/WebCore/html (+2.0), surgical (+1.3)

Commit message

Number input does not fire a beforeinput event when stepped via arrow keys or spin buttons
https://bugs.webkit.org/show_bug.cgi?id=324060
rdar://187294318

Reviewed by Wenson Hsieh and Ryosuke Niwa.

User-driven stepping of a number input (arrow keys or the spin button) mutated
the value and fired input/change without first firing a cancelable beforeinput
event, unlike other editing operations. This meant pages could neither observe
nor cancel the step, and the event order was "input, change" instead of
"beforeinput, input, change".

Dispatch a cancelable beforeinput from InputType::stepUpFromRenderer(), the
user-driven entry point, before any value mutation. Programmatic
stepUp()/stepDown() go through applyStep() directly and stay silent. If the
event is default-prevented, or its handler tears down the element or its frame,
bail out without changing the value or firing input/change.

Firing script from stepUpFromRenderer() surfaced two latent crashes in the spin
button path when the handler removes the element's frame, both fixed here:

- SpinButtonElement::defaultEventHandler() held a CheckedPtr to the render box
  across doStepAction(). Destroying the renderer from the handler left that
  CheckedPtr dangling, crashing on scope exit. Release it before the reentrant
  calls.

- The repeating timer is started before doStepAction(); once the frame is gone
  the mouseup that would stop it bails at the null render-box check, leaving a
  live timer firing against a torn-down tree. Stop it if the renderer is gone
  after doStepAction().

Covered by the imported input-events WPT for arrow-key and spin-button stepping
on number inputs (base ordering, prevent-default, and delete-document), whose
FAIL baselines now switched as they now pass.

* LayoutTests/imported/w3c/web-platform-tests/input-events/input-events-arrow-key-on-number-input-delete-document-expected.txt: Progression
* LayoutTests/imported/w3c/web-platform-tests/input-events/input-events-arrow-key-on-number-input-expected.txt: Ditto
* LayoutTests/imported/w3c/web-platform-tests/input-events/input-events-arrow-key-on-number-input-prevent-default-expected.txt: Ditto
* LayoutTests/imported/w3c/web-platform-tests/input-events/input-events-spin-button-click-on-number-input-delete-document-expected.txt: Ditto
* LayoutTests/imported/w3c/web-platform-tests/input-events/input-events-spin-button-click-on-number-input-expected.txt: Ditto
* LayoutTests/imported/w3c/web-platform-tests/input-events/input-events-spin-button-click-on-number-input-prevent-default-expected.txt: Ditto
* Source/WebCore/html/InputType.cpp:
(WebCore::InputType::stepUpFromRenderer):
* Source/WebCore/html/shadow/SpinButtonElement.cpp:
(WebCore::SpinButtonElement::defaultEventHandler):

Canonical link: https://commits.webkit.org/321214@main

Before / after

Loading diff…
On This Page