From b6a89ae40861b1ca0a15fb61f4e963955a992bda Mon Sep 17 00:00:00 2001 From: Taym Haddadi Date: Tue, 29 Apr 2025 20:59:50 +0200 Subject: [PATCH] Fix BorrowMutError crash in form reset (#36726) Fixes: #36724 Signed-off-by: Taym --- components/script/dom/htmlformelement.rs | 10 ++++++++-- tests/wpt/mozilla/meta/MANIFEST.json | 7 +++++++ tests/wpt/mozilla/tests/mozilla/form_reset-crash.html | 7 +++++++ 3 files changed, 22 insertions(+), 2 deletions(-) create mode 100644 tests/wpt/mozilla/tests/mozilla/form_reset-crash.html diff --git a/components/script/dom/htmlformelement.rs b/components/script/dom/htmlformelement.rs index ce6dcca66f3..2421b683bf7 100644 --- a/components/script/dom/htmlformelement.rs +++ b/components/script/dom/htmlformelement.rs @@ -1270,8 +1270,14 @@ impl HTMLFormElement { return; } - let controls = self.controls.borrow(); - for child in controls.iter() { + let controls: Vec<_> = self + .controls + .borrow() + .iter() + .map(|c| c.as_rooted()) + .collect(); + + for child in controls { let child = child.upcast::(); match child.type_id() { diff --git a/tests/wpt/mozilla/meta/MANIFEST.json b/tests/wpt/mozilla/meta/MANIFEST.json index d3a939eab57..4262fa5aca3 100644 --- a/tests/wpt/mozilla/meta/MANIFEST.json +++ b/tests/wpt/mozilla/meta/MANIFEST.json @@ -25,6 +25,13 @@ {} ] ], + "form_reset-crash.html": [ + "b23cbf6aefdef8231e2cc4cb0e6416195d5bdf71", + [ + null, + {} + ] + ], "global-enumerate-crash.html": [ "a77e79b1465bf7555340dd5e9bf94a4c8caa85f2", [ diff --git a/tests/wpt/mozilla/tests/mozilla/form_reset-crash.html b/tests/wpt/mozilla/tests/mozilla/form_reset-crash.html new file mode 100644 index 00000000000..b23cbf6aefd --- /dev/null +++ b/tests/wpt/mozilla/tests/mozilla/form_reset-crash.html @@ -0,0 +1,7 @@ + +
+ +
+