185493 2018-05-09 14:46:16 -0700 Release assert in TreeScopeOrderedMap::remove via HTMLImageElement::removedFromAncestor 2018-05-09 17:08:42 -0700 1 1 1 Unclassified WebKit DOM WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 rniwa rniwa bfulgham cdumez esprehn+autocc ews-watchlist gyuyoung.kim koivisto zalan oldest_to_newest 1422499 0 rniwa 2018-05-09 14:46:16 -0700 e.g. ASSERTION FAILED: entry.registeredElements.remove(&element) ./dom/TreeScopeOrderedMap.cpp(84) : void WebCore::TreeScopeOrderedMap::remove(const WTF::AtomicStringImpl &, WebCore::Element &) 1 0x6477df959 WTFCrash 2 0x6477df979 WTFCrashWithSecurityImplication 3 0x639fc81f8 WebCore::TreeScopeOrderedMap::remove(WTF::AtomicStringImpl const&, WebCore::Element&) 4 0x639fc996d WebCore::TreeScope::removeImageElementByUsemap(WTF::AtomicStringImpl const&, WebCore::HTMLImageElement&) 5 0x63a1c9ef4 WebCore::HTMLImageElement::removedFromAncestor(WebCore::Node::RemovalType, WebCore::ContainerNode&) 6 0x639daa3cb WebCore::notifyNodeRemovedFromDocument(WebCore::ContainerNode&, WebCore::TreeScopeChange, WebCore::Node&) 7 0x639daa498 WebCore::notifyNodeRemovedFromDocument(WebCore::ContainerNode&, WebCore::TreeScopeChange, WebCore::Node&) 8 0x639daa2b1 WebCore::notifyChildNodeRemoved(WebCore::ContainerNode&, WebCore::Node&) 9 0x639da6879 WebCore::ContainerNode::removeNodeWithScriptAssertion(WebCore::Node&, WebCore::ContainerNode::ChildChangeSource) 10 0x639da619e WebCore::ContainerNode::removeChild(WebCore::Node&) 11 0x63a090b0e WebCore::ReplacementFragment::removeNode(WebCore::Node&) 12 0x63a090543 WebCore::ReplacementFragment::removeUnrenderedNodes(WebCore::Node*) 13 0x63a08ff05 WebCore::ReplacementFragment::ReplacementFragment(WebCore::Document&, WebCore::DocumentFragment*, WebCore::VisibleSelection const&) 14 0x63a09085d WebCore::ReplacementFragment::ReplacementFragment(WebCore::Document&, WebCore::DocumentFragment*, WebCore::VisibleSelection const&) 15 0x63a093bfc WebCore::ReplaceSelectionCommand::ensureReplacementFragment() 16 0x63a093a19 WebCore::ReplaceSelectionCommand::willApplyCommand() 17 0x639ffaef6 WebCore::CompositeEditCommand::apply() <rdar://problem/38362600> 1422503 1 340034 rniwa 2018-05-09 14:49:55 -0700 Created attachment 340034 Fixes the bug 1422509 2 340034 bfulgham 2018-05-09 14:52:53 -0700 Comment on attachment 340034 Fixes the bug r=me 1422570 3 rniwa 2018-05-09 17:08:42 -0700 Committed r231621: <https://trac.webkit.org/changeset/231621> 340034 2018-05-09 14:49:55 -0700 2018-05-09 14:52:53 -0700 Fixes the bug bug-185493-20180509144954.patch text/plain 4872 rniwa SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDIzMTU5NikKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDIwIEBACisyMDE4LTA1LTA5ICBSeW9zdWtl IE5pd2EgIDxybml3YUB3ZWJraXQub3JnPgorCisgICAgICAgIFJlbGVhc2UgYXNzZXJ0IGluIFRy ZWVTY29wZU9yZGVyZWRNYXA6OnJlbW92ZSB2aWEgSFRNTEltYWdlRWxlbWVudDo6cmVtb3ZlZEZy b21BbmNlc3RvcgorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/ aWQ9MTg1NDkzCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAg ICAgRml4ZWQgdGhlIGJ1ZyB0aGF0IEhUTUxJbWFnZUVsZW1lbnQ6OnJlbW92ZWRGcm9tQW5jZXN0 b3IgYW5kIEhUTUxNYXBFbGVtZW50OjpyZW1vdmVkRnJvbUFuY2VzdG9yCisgICAgICAgIHdlcmUg Y2FsbGluZyByZW1vdmVJbWFnZUVsZW1lbnRCeVVzZW1hcCBvbiB0aGUgZG9jdW1lbnQgaW5zdGVh ZCBvZiB0aGUgc2hhZG93IHRyZWUgZnJvbSB3aGljaCBpdCB3YXMgcmVtb3ZlZC4KKworICAgICAg ICBUZXN0OiBmYXN0L2ltYWdlcy9pbWFnZW1hcC1pbi1zaGFkb3ctdHJlZS1yZW1vdmVkLmh0bWwK KworICAgICAgICAqIGh0bWwvSFRNTEltYWdlRWxlbWVudC5jcHA6CisgICAgICAgIChXZWJDb3Jl OjpIVE1MSW1hZ2VFbGVtZW50OjpyZW1vdmVkRnJvbUFuY2VzdG9yKToKKyAgICAgICAgKiBodG1s L0hUTUxNYXBFbGVtZW50LmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OkhUTUxNYXBFbGVtZW50Ojpy ZW1vdmVkRnJvbUFuY2VzdG9yKToKKwogMjAxOC0wNS0wOSAgSnVzdGluIEZhbiAgPGp1c3Rpbl9m YW5AYXBwbGUuY29tPgogCiAgICAgICAgIEhvb2tlZCB1cCBBU1RDIHN1cHBvcnQgaW4gV2ViR0w7 IHJlcXVpcmVzIE9wZW5HTCBFUyAzIGNvbnRleHQgdG8gd29yay4gCkluZGV4OiBTb3VyY2UvV2Vi Q29yZS9odG1sL0hUTUxJbWFnZUVsZW1lbnQuY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XZWJD b3JlL2h0bWwvSFRNTEltYWdlRWxlbWVudC5jcHAJKHJldmlzaW9uIDIzMTU3OSkKKysrIFNvdXJj ZS9XZWJDb3JlL2h0bWwvSFRNTEltYWdlRWxlbWVudC5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTM0 Miw3ICszNDIsNyBAQCB2b2lkIEhUTUxJbWFnZUVsZW1lbnQ6OnJlbW92ZWRGcm9tQW5jZXN0CiAg ICAgICAgIG1fZm9ybS0+cmVtb3ZlSW1nRWxlbWVudCh0aGlzKTsKIAogICAgIGlmIChyZW1vdmFs VHlwZS5kaXNjb25uZWN0ZWRGcm9tRG9jdW1lbnQgJiYgIW1fcGFyc2VkVXNlbWFwLmlzTnVsbCgp KQotICAgICAgICB0cmVlU2NvcGUoKS5yZW1vdmVJbWFnZUVsZW1lbnRCeVVzZW1hcCgqbV9wYXJz ZWRVc2VtYXAuaW1wbCgpLCAqdGhpcyk7CisgICAgICAgIG9sZFBhcmVudE9mUmVtb3ZlZFRyZWUu dHJlZVNjb3BlKCkucmVtb3ZlSW1hZ2VFbGVtZW50QnlVc2VtYXAoKm1fcGFyc2VkVXNlbWFwLmlt cGwoKSwgKnRoaXMpOwogCiAgICAgaWYgKGlzPEhUTUxQaWN0dXJlRWxlbWVudD4ocGFyZW50Tm9k ZSgpKSkKICAgICAgICAgc2V0UGljdHVyZUVsZW1lbnQobnVsbHB0cik7CkluZGV4OiBTb3VyY2Uv V2ViQ29yZS9odG1sL0hUTUxNYXBFbGVtZW50LmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9odG1sL0hUTUxNYXBFbGVtZW50LmNwcAkocmV2aXNpb24gMjMxNTc5KQorKysgU291cmNl L1dlYkNvcmUvaHRtbC9IVE1MTWFwRWxlbWVudC5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTEyNiw3 ICsxMjYsNyBAQCBOb2RlOjpJbnNlcnRlZEludG9BbmNlc3RvclJlc3VsdCBIVE1MTWFwCiB2b2lk IEhUTUxNYXBFbGVtZW50OjpyZW1vdmVkRnJvbUFuY2VzdG9yKFJlbW92YWxUeXBlIHJlbW92YWxU eXBlLCBDb250YWluZXJOb2RlJiBvbGRQYXJlbnRPZlJlbW92ZWRUcmVlKQogewogICAgIGlmIChy ZW1vdmFsVHlwZS5kaXNjb25uZWN0ZWRGcm9tRG9jdW1lbnQpCi0gICAgICAgIHRyZWVTY29wZSgp LnJlbW92ZUltYWdlTWFwKCp0aGlzKTsKKyAgICAgICAgb2xkUGFyZW50T2ZSZW1vdmVkVHJlZS50 cmVlU2NvcGUoKS5yZW1vdmVJbWFnZU1hcCgqdGhpcyk7CiAgICAgSFRNTEVsZW1lbnQ6OnJlbW92 ZWRGcm9tQW5jZXN0b3IocmVtb3ZhbFR5cGUsIG9sZFBhcmVudE9mUmVtb3ZlZFRyZWUpOwogfQog CkluZGV4OiBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMv Q2hhbmdlTG9nCShyZXZpc2lvbiAyMzE1NzkpCisrKyBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cJKHdv cmtpbmcgY29weSkKQEAgLTEsMyArMSwxNSBAQAorMjAxOC0wNS0wOSAgUnlvc3VrZSBOaXdhICA8 cm5pd2FAd2Via2l0Lm9yZz4KKworICAgICAgICBSZWxlYXNlIGFzc2VydCBpbiBUcmVlU2NvcGVP cmRlcmVkTWFwOjpyZW1vdmUgdmlhIEhUTUxJbWFnZUVsZW1lbnQ6OnJlbW92ZWRGcm9tQW5jZXN0 b3IKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE4NTQ5 MworCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEFkZGVk IGEgcmVncmVzc2lvbiB0ZXN0LgorCisgICAgICAgICogZmFzdC9pbWFnZXMvaW1hZ2VtYXAtaW4t c2hhZG93LXRyZWUtcmVtb3ZlZC1leHBlY3RlZC50eHQ6IEFkZGVkLgorICAgICAgICAqIGZhc3Qv aW1hZ2VzL2ltYWdlbWFwLWluLXNoYWRvdy10cmVlLXJlbW92ZWQuaHRtbDogQWRkZWQuCisKIDIw MTgtMDUtMDkgIFlvdWVubiBGYWJsZXQgIDx5b3Vlbm5AYXBwbGUuY29tPgogCiAgICAgICAgIFVu Zmxha2Ugc29tZSBhZGRpdGlvbmFsIEFwcENhY2hlIHRlc3RzCkluZGV4OiBMYXlvdXRUZXN0cy9m YXN0L2ltYWdlcy9pbWFnZW1hcC1pbi1zaGFkb3ctdHJlZS1yZW1vdmVkLWV4cGVjdGVkLnR4dAo9 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9mYXN0L2ltYWdlcy9pbWFnZW1hcC1pbi1zaGFkb3ct dHJlZS1yZW1vdmVkLWV4cGVjdGVkLnR4dAkobm9uZXhpc3RlbnQpCisrKyBMYXlvdXRUZXN0cy9m YXN0L2ltYWdlcy9pbWFnZW1hcC1pbi1zaGFkb3ctdHJlZS1yZW1vdmVkLWV4cGVjdGVkLnR4dAko d29ya2luZyBjb3B5KQpAQCAtMCwwICsxLDQgQEAKK1RoaXMgdGVzdHMgcmVtb3ZpbmcgYW4gaW1h Z2UgbWFwIGFyZWEgaW5zaWRlIGEgc2hhZG93IHRyZWUuIFdlYktpdCBzaG91bGQgbm90IGhpdCBh bnkgYXNzZXJ0aW9ucy4KKworUEFTUworCkluZGV4OiBMYXlvdXRUZXN0cy9mYXN0L2ltYWdlcy9p bWFnZW1hcC1pbi1zaGFkb3ctdHJlZS1yZW1vdmVkLmh0bWwKPT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0 VGVzdHMvZmFzdC9pbWFnZXMvaW1hZ2VtYXAtaW4tc2hhZG93LXRyZWUtcmVtb3ZlZC5odG1sCShu b25leGlzdGVudCkKKysrIExheW91dFRlc3RzL2Zhc3QvaW1hZ2VzL2ltYWdlbWFwLWluLXNoYWRv dy10cmVlLXJlbW92ZWQuaHRtbAkod29ya2luZyBjb3B5KQpAQCAtMCwwICsxLDM1IEBACis8IURP Q1RZUEUgaHRtbD4KKzxodG1sPgorPGJvZHk+Cis8c2NyaXB0IHNyYz0iLi4vLi4vcmVzb3VyY2Vz L3VpLWhlbHBlci5qcyI+PC9zY3JpcHQ+Cis8cD5UaGlzIHRlc3RzIHJlbW92aW5nIGFuIGltYWdl IG1hcCBhcmVhIGluc2lkZSBhIHNoYWRvdyB0cmVlLiBXZWJLaXQgc2hvdWxkIG5vdCBoaXQgYW55 IGFzc2VydGlvbnMuPC9wPgorPGRpdiBpZD0icmVzdWx0Ij48L2Rpdj4KKzxzY3JpcHQ+CisKK2lm ICh3aW5kb3cudGVzdFJ1bm5lcikKKyAgICB0ZXN0UnVubmVyLmR1bXBBc1RleHQoKTsKKworY29u c3QgaG9zdCA9IGRvY3VtZW50LmNyZWF0ZUVsZW1lbnQoJ2RpdicpOworZG9jdW1lbnQuYm9keS5h cHBlbmRDaGlsZChob3N0KTsKKworY29uc3Qgc2hhZG93Um9vdCA9IGhvc3QuYXR0YWNoU2hhZG93 KHttb2RlOiAnY2xvc2VkJ30pOworc2hhZG93Um9vdC5pbm5lckhUTUwgPSBgPGRpdj48L2Rpdj5g OworCitjb25zdCBjb250YWluZXIgPSBkb2N1bWVudC5jcmVhdGVFbGVtZW50KCdkaXYnKTsKK2Rv Y3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQoY29udGFpbmVyKTsKK2NvbnRhaW5lci5pbm5lckhUTUwg PSBgPGltZyBzcmM9InJlc291cmNlcy9ncmVlbi00MDB4NDAwLnBuZyIgd2lkdGg9IjQwMCIgaGVp Z2h0PSI0MDAiIHVzZW1hcD0iI2ltYWdlbWFwIiBvbmxvYWQ9InN0YXJ0VGVzdCgpIj4KKzxtYXAg bmFtZT0iaW1hZ2VtYXAiPgorICAgIDxhcmVhIGlkPSJhcmVhIiBzaGFwZT0icmVjdCIgY29vcmRz PSIwLDAsMjAwLDIwMCIgaHJlZj0iIyIgdGFiaW5kZXg9IjAiPgorPC9tYXA+YDsKKworZnVuY3Rp b24gc3RhcnRUZXN0KCkKK3sKKyAgICBzaGFkb3dSb290LmZpcnN0Q2hpbGQuYXBwZW5kQ2hpbGQo Y29udGFpbmVyKTsKKyAgICBjb250YWluZXIucmVtb3ZlKCk7CisgICAgZG9jdW1lbnQuZ2V0RWxl bWVudEJ5SWQoJ3Jlc3VsdCcpLnRleHRDb250ZW50ID0gJ1BBU1MnOworfQorCis8L3NjcmlwdD4K KzwvYm9keT4KKzwvaGVhZD4KKzwvaHRtbD4K