fix crash occurs when the focus element is adopted (#36608)

fix crash occurs when the focus element is adopted.

Testing: wpt dom/nodes/insertion-removing-steps/blur-event.window.html
not crash

Fixes:  #36607 #32972

---------

Signed-off-by: kongbai1996 <1782765876@qq.com>
This commit is contained in:
Fuguo 2025-04-30 03:04:22 +08:00 committed by GitHub
parent b6a89ae408
commit bab788f5d5
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 45 additions and 3 deletions

View file

@ -1180,7 +1180,9 @@ impl Document {
let node = elem.upcast::<Node>();
elem.set_focus_state(false);
// FIXME: pass appropriate relatedTarget
self.fire_focus_event(FocusEventType::Blur, node, None, can_gc);
if node.is_connected() {
self.fire_focus_event(FocusEventType::Blur, node, None, can_gc);
}
// Notify the embedder to hide the input method.
if elem.input_method_type().is_some() {

View file

@ -7459,6 +7459,15 @@
}
}
},
"focus": {
"focus-element-crash.html": [
"27df1c0b13081827685fa96e0cba2f7b9b03c89a",
[
null,
{}
]
]
},
"fullscreen": {
"crashtests": {
"backdrop-list-item.html": [

View file

@ -1,2 +0,0 @@
[blur-event.window.html]
expected: CRASH

View file

@ -0,0 +1,33 @@
<!DOCTYPE html>
<html>
<meta charset="utf-8">
<meta name="assert" content="focus element adopted or remounted shouldn't crash.">
<body>
<!--focus element remounted test case-->
<audio onloadstart="select.focus()" src=""></audio>
<iframe id="iframe"></iframe>
<table id="table">
<td>
<select id="select" onblur=";"></select>
</td>
</table>
<script>
window.addEventListener("load", _ => iframe.appendChild(table));
</script>
<!--focus element adopted test case-->
<input id="username" type="text" placeholder="username">
<input id="password" type="text" placeholder="password">
</body>
<script>
let search = document.getElementById("search");
let username = document.getElementById("username");
username.focus();
window.onload = () => document.adoptNode(username);
username.addEventListener("blur", function (e) {
document.body.append(`event:${e.type} fire.`)
});
</script>
</html>