Text gets clobbered when assigning to input.defaultValue

josepharhar · webkit-commit-queue · commit 83d05ee86ea8 · 2020-11-06T20:17:03.000Z
https://bugs.webkit.org/show_bug.cgi?id=217156 Patch by Joey Arhar <jarhar@chromium.org> on 2020-11-06 Reviewed by Darin Adler. This fixes a bug where script assigning to the defaultValue property of a number or email input causes the text the user entered into the input to be clobbered when it doesn't perfectly match the sanitized string returned by the .value property. Test: LayoutTests/fast/forms/defaultValue-clobbering.html * html/HTMLInputElement.cpp: (WebCore::HTMLInputElement::parseAttribute): Canonical link: https://commits.webkit.org/231323@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@269528 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/LayoutTests/fast/forms/defaultValue-clobbering-expected.txt b/LayoutTests/fast/forms/defaultValue-clobbering-expected.txt
@@ -0,0 +1,8 @@
+PASS numberinput.value == "12" is true
+PASS numberinput.value == "" is true
+PASS numberinput.validity.valid is false
+PASS numberinput.validity.valid is false
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/fast/forms/defaultValue-clobbering.html b/LayoutTests/fast/forms/defaultValue-clobbering.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<script src="../../resources/js-test-pre.js"></script>
+<input type=number id=numberinput>
+<script>
+numberinput.focus();
+eventSender.keyDown('1');
+eventSender.keyDown('2');
+shouldBeTrue('numberinput.value == "12"');
+eventSender.keyDown('e');
+shouldBeTrue('numberinput.value == ""');
+
+shouldBeFalse('numberinput.validity.valid');
+numberinput.defaultValue = '12345';
+shouldBeFalse('numberinput.validity.valid');
+</script>
+<script src="../../resources/js-test-post.js"></script>
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
@@ -1,3 +1,20 @@
+2020-11-06  Joey Arhar  <jarhar@chromium.org>
+
+        Text gets clobbered when assigning to input.defaultValue
+        https://bugs.webkit.org/show_bug.cgi?id=217156
+
+        Reviewed by Darin Adler.
+
+        This fixes a bug where script assigning to the defaultValue property
+        of a number or email input causes the text the user entered into the
+        input to be clobbered when it doesn't perfectly match the sanitized
+        string returned by the .value property.
+
+        Test: LayoutTests/fast/forms/defaultValue-clobbering.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseAttribute):
+
 2020-11-06  Antoine Quint  <graouts@webkit.org>
 
         Accelerated animations of individual transform properties should apply rotate before scale
diff --git a/Source/WebCore/html/HTMLInputElement.cpp b/Source/WebCore/html/HTMLInputElement.cpp
@@ -764,8 +764,8 @@ void HTMLInputElement::parseAttribute(const QualifiedName& name, const AtomStrin
         if (!hasDirtyValue()) {
             updatePlaceholderVisibility();
             invalidateStyleForSubtree();
+            setFormControlValueMatchesRenderer(false);
         }
-        setFormControlValueMatchesRenderer(false);
         updateValidity();
         m_valueAttributeWasUpdatedAfterParsing = !m_parsingInProgress;
     } else if (name == checkedAttr) {
