← WebKit — 2026-W41
bb5913e37d019186e368a72dbde122306da9d75d Implement moving steps for optgroup and hr
severity medium
class UAF
confidence 0.5
signal score 11.06
Source/WebCore/html
Primitive: stale HTMLHRElement/HTMLOptGroupElement m_ownerSelect after an atomic DOM move
Triage note: Adds movingSteps() to HTMLHRElement and HTMLOptGroupElement so m_ownerSelect is refreshed (via findOwnerSelect) and both old/new selects recalc list items when the element is atomically moved; previously moves bypassed insertion/removal steps, leaving a stale owner-select pointer. Fixes a stale-pointer/correctness bug but exploitability as memory-safety is unconfirmed from the diff and it is gated behind htmlEnhancedSelectParsingEnabled.
Triage note: Adds movingSteps() to HTMLHRElement and HTMLOptGroupElement so m_ownerSelect is refreshed (via findOwnerSelect) and both old/new selects recalc list items when the element is atomically moved; previously moves bypassed insertion/removal steps, leaving a stale owner-select pointer. Fixes a stale-pointer/correctness bug but exploitability as memory-safety is unconfirmed from the diff and it is gated behind htmlEnhancedSelectParsingEnabled.
Structural signals: smartptr_member_added (+6.47), null_guard (+2.59), area:Source/WebCore/html (+2.0)
Commit message
Implement moving steps for optgroup and hr
https://bugs.webkit.org/show_bug.cgi?id=326810
Reviewed by Ryosuke Niwa.
HTMLOptGroupElement and HTMLHRElement keep a pointer to their owner select, which is set in
insertionSteps() and cleared in removingSteps().
Neither had moving steps, so after a moveBefore() the pointer kept referring to the old select.
That left a stale optgroup label rendered outside a select, and hit the owner select assertion in removingSteps() when the element was later removed.
This adds moving steps to both, matching HTMLOptionElement, they update the owner select and
recalculate the list items of the old and new selects.
The optgroup also invalidates its shadow tree so its label updates.
Tests: imported/w3c/web-platform-tests/dom/nodes/moveBefore/moveBefore-optgroup-crash.html
imported/w3c/web-platform-tests/dom/nodes/moveBefore/moveBefore-optgroup.html
imported/w3c/web-platform-tests/dom/nodes/moveBefore/moveBefore-select-hr-crash.html
* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/moveBefore-optgroup-crash.html: Added.
* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/moveBefore-optgroup-expected.txt: Added.
* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/moveBefore-optgroup.html: Added.
* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/moveBefore-select-hr-crash.html: Added.
* Source/WebCore/html/HTMLHRElement.cpp:
(WebCore::HTMLHRElement::movingSteps):
* Source/WebCore/html/HTMLHRElement.h:
* Source/WebCore/html/HTMLOptGroupElement.cpp:
(WebCore::HTMLOptGroupElement::movingSteps):
* Source/WebCore/html/HTMLOptGroupElement.h:
Canonical link: https://commits.webkit.org/323397@main
Before / after
Loading diff…
On This Page