← WebKit — 2026-W39
1bc64daa8a1b39ad93e31f8eaf239794e5d29ea3 appearance: base-select list box behavior
severity medium
class LogicError
confidence 0.35
signal score 8.42
Source/WebCore/html
Primitive: stale-option / null-renderer reentrancy in HTMLSelectElement::pickOrToggleOption after author script runs
Triage note: Large base-appearance <select> feature refactor that also adds guards in pickOrToggleOption (option.ownerSelectElement() != this, option.isDisabledFormControl(), !renderer()) because 'Callers run script before getting here, which may have moved the option elsewhere' / 'taken the renderer away, which updateListBoxSelection() needs'. Defensive hardening against reentrancy-induced stale state bundled inside feature work; no demonstrated exploit primitive in this diff.
Triage note: Large base-appearance <select> feature refactor that also adds guards in pickOrToggleOption (option.ownerSelectElement() != this, option.isDisabledFormControl(), !renderer()) because 'Callers run script before getting here, which may have moved the option elsewhere' / 'taken the renderer away, which updateListBoxSelection() needs'. Defensive hardening against reentrancy-induced stale state bundled inside feature work; no demonstrated exploit primitive in this diff.
Structural signals: smartptr_member_added (+6.47), null_guard (+1.95), area:Source/WebCore/html (+2.0), large_churn (-2.0)
Commit message
appearance: base-select list box behavior
https://bugs.webkit.org/show_bug.cgi?id=325136
Reviewed by Tim Nguyen.
This adds behavior to base list boxes so they become usable. You can toggle
options by clicking, using the arrow keys to move between the options, use
type-ahead, and various other keys.
For now these base list boxes behave differently from native list boxes, but
this might change. In particular for iOS family and macOS we have not settled
on a design.
We also changed base dropdown box type-ahead to no longer respect untrusted
keypresses while aligning that code with the new base list box code. That was
never intended to work.
Tests: fast/forms/select/base/select-listbox.html
fast/forms/select/base/select-multiple-picker.html
Canonical link: https://commits.webkit.org/321896@main
Before / after
Loading diff…
On This Page