Ensure option_html_attributes does not modify the given option hashes

We can avoid creating extra hashes with #merge, and use #merge! instead.

2 files changed, 10 insertions, 1 deletions

diff --git a/actionpack/lib/action_view/helpers/form_options_helper.rb b/actionpack/lib/action_view/helpers/form_options_helper.rb
index 775993fe03..e4f4ebc7ff 100644
--- a/actionpack/lib/action_view/helpers/form_options_helper.rb
+++ b/actionpack/lib/action_view/helpers/form_options_helper.rb
@@ -709,7 +709,7 @@ module ActionView
       private
         def option_html_attributes(element)
           if Array === element
-            element.select { |e| Hash === e }.reduce({}, :merge)
+            element.select { |e| Hash === e }.reduce({}, :merge!)
           else
             {}
           end
diff --git a/actionpack/test/template/form_options_helper_test.rb b/actionpack/test/template/form_options_helper_test.rb
index e1ce5c5568..f908de865e 100644
--- a/actionpack/test/template/form_options_helper_test.rb
+++ b/actionpack/test/template/form_options_helper_test.rb
@@ -1193,6 +1193,15 @@ class FormOptionsHelperTest < ActionView::TestCase
     )
   end
 
+  def test_option_html_attributes_with_multiple_hashes_does_not_modify_them
+    options1 = { class: 'fancy' }
+    options2 = { onclick: "alert('Hello World');" }
+    option_html_attributes([ 'foo', 'bar', options1, options2 ])
+
+    assert_equal({ class: 'fancy' }, options1)
+    assert_equal({ onclick: "alert('Hello World');" }, options2)
+  end
+
   def test_grouped_collection_select
     @post = Post.new
     @post.origin = 'dk'