213611 2020-06-25 11:23:47 -0700 ASSERTION FAILED: (it != m_map.end()) in TreeScopeOrderedMap::remove 2020-06-26 09:44:37 -0700 1 1 1 Unclassified WebKit Images WebKit Nightly Build All All RESOLVED FIXED InRadar P2 Normal --- 1 shihchieh_lee shihchieh_lee cdumez changseok esprehn+autocc ews-watchlist ggaren gyuyoung.kim mjs rwlbuis oldest_to_newest 1666100 0 shihchieh_lee 2020-06-25 11:23:47 -0700 0 com.apple.JavaScriptCore 0x0000000115e611be WTFCrash + 14 (Assertions.cpp:293) 1 com.apple.JavaScriptCore 0x0000000115e611ce WTFCrashWithSecurityImplication + 14 2 com.apple.WebCore 0x000000013cb07316 WebCore::TreeScopeOrderedMap::remove(WTF::AtomStringImpl const&, WebCore::Element&) + 694 (TreeScopeOrderedMap.cpp:81) 3 com.apple.WebCore 0x000000013d06ff1e WebCore::HTMLDocument::removeDocumentNamedItem(WTF::AtomStringImpl const&, WebCore::Element&) + 46 (HTMLDocument.cpp:171) 4 com.apple.WebCore 0x000000013c77fe2f WebCore::Element::updateIdForDocument(WebCore::HTMLDocument&, WTF::AtomString const&, WTF::AtomString const&, WebCore::Element::HTMLDocumentNamedItemMapsUpdatingCondition) + 687 (Element.cpp:4079) 5 com.apple.WebCore 0x000000013c780946 WebCore::Element::removedFromAncestor(WebCore::Node::RemovalType, WebCore::ContainerNode&) + 1430 (Element.cpp:2208) 6 com.apple.WebCore 0x000000013d1050e8 WebCore::HTMLImageElement::removedFromAncestor(WebCore::Node::RemovalType, WebCore::ContainerNode&) + 1160 (HTMLImageElement.cpp:463) 7 com.apple.WebCore 0x000000013c4e97f4 WebCore::notifyNodeRemovedFromDocument(WebCore::ContainerNode&, WebCore::TreeScopeChange, WebCore::Node&) + 1076 (ContainerNodeAlgorithms.cpp:116) 8 com.apple.WebCore 0x000000013c4e92ed WebCore::notifyChildNodeRemoved(WebCore::ContainerNode&, WebCore::Node&) + 445 (ContainerNodeAlgorithms.cpp:161) 9 com.apple.WebCore 0x000000013c4def8d WebCore::ContainerNode::removeNodeWithScriptAssertion(WebCore::Node&, WebCore::ContainerNode::ChildChangeSource) + 1533 (ContainerNode.cpp:169) 10 com.apple.WebCore 0x000000013c4ddd89 WebCore::ContainerNode::removeChild(WebCore::Node&) + 681 (ContainerNode.cpp:577) 11 com.apple.WebCore 0x000000013c950873 WebCore::Node::remove() + 115 (Node.cpp:629) 12 com.apple.WebCore 0x0000000137478fd0 WebCore::jsElementPrototypeFunctionRemoveBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSElement*, JSC::ThrowScope&) + 448 (JSElement.cpp:4742) 1666101 1 shihchieh_lee 2020-06-25 11:25:33 -0700 <rdar::/64493506> 1666102 2 shihchieh_lee 2020-06-25 11:25:48 -0700 <rdar://64493506> 1666171 3 shihchieh_lee 2020-06-25 12:40:37 -0700 Test case: <body><image id=img name=""></image> <script> img.name = "new name"; img.remove(); </script> Cause of the crash: 1. Initially image element has an empty name so image's ID is not added to document's named item hash map. This is a behavior change after https://bugs.webkit.org/show_bug.cgi?id=212473. 2. Next we change image's name attribute in the script and add image's name to document's named item hash map. However, image's ID is still not added[1]. 3. When we remove the image element, we try to remove image's ID from named item hash map because its name attribute is not empty. Since the ID was never added, it triggers the assertion in TreeScopeOrderedMap::remove(). Note: [1] The reason we do not add image's ID in step #2: Function HTMLImageElement::parseAttribute() is called multiple times in the test to check for valid name attribute and to add image's ID to document's named item. Once a valid name attribute is found, the function does not attempt to add ID anymore. However, this part of code was not changed in bug 212473. We still consider empty name a valid attribute. Therefore, the first time HTMLImageElement::parseAttribute() is called when image has an empty name attribute, the function set a flag that denotes a valid name is found, and therefore ignore subsequent name changes. Although the empty name is considered valid, image's ID was still not added to named item the first time, since another condition was not matched -- the node was not inserted when parseAttribute() is called at the first time. 1666182 4 402798 shihchieh_lee 2020-06-25 13:06:05 -0700 Created attachment 402798 Patch 1666189 5 402798 ggaren 2020-06-25 13:21:11 -0700 Comment on attachment 402798 Patch r=me 1666489 6 ews-feeder 2020-06-26 09:44:36 -0700 Committed r263564: <https://trac.webkit.org/changeset/263564> All reviewed patches have been landed. Closing bug and clearing flags on attachment 402798. 402798 2020-06-25 13:06:05 -0700 2020-06-26 09:44:36 -0700 Patch bug-213611-20200625130604.patch text/plain 3914 shihchieh_lee U3VidmVyc2lvbiBSZXZpc2lvbjogMjYzMzgwCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggYjc5OTUzN2JmMTBjMjQ4 ZTI3ZDA3MDM4MWJhODE3YTg2ZGE2OWY5Yi4uYzkwZWY0ZTk2YTAzOGQ5ZDcwMTdhM2U3ZWI2ZTM5 Y2JhYmQ2Nzc3MiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDIxIEBACisyMDIwLTA2LTI1ICBKYWNr IExlZSAgPHNoaWhjaGllaF9sZWVAYXBwbGUuY29tPgorCisgICAgICAgIEFTU0VSVElPTiBGQUlM RUQ6IChpdCAhPSBtX21hcC5lbmQoKSkgaW4gVHJlZVNjb3BlT3JkZXJlZE1hcDo6cmVtb3ZlCisg ICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yMTM2MTEKKyAg ICAgICAgPHJkYXI6Ly9wcm9ibGVtLzY0NDkzNTA2PgorCisgICAgICAgIFJldmlld2VkIGJ5IE5P Qk9EWSAoT09QUyEpLgorCisgICAgICAgIEluIGZ1bmN0aW9uIEhUTUxJbWFnZUVsZW1lbnQ6OnBh cnNlQXR0cmlidXRlKCksIGVtcHR5IG5hbWUgYXR0cmlidXRlIGlzIGNvbnNpZGVyZWQgdmFsaWQK KyAgICAgICAgd2hpY2ggbWFrZXMgdGhlIGZ1bmN0aW9uIHNraXAgaGFuZGxpbmcgb2Ygc3Vic2Vx dWVudCBuYW1lIGNoYW5nZXMuIE1vZGlmaWVkIHRoZSBjaGVjayBvZiAKKyAgICAgICAgbmFtZSBh dHRyaWJ1dGUgc28gb25seSBub24tZW1wdHkgbmFtZSBpcyBjb25zaWRlcmVkIHZhbGlkLiBUaGlz IGNvZGUgY2hhbmdlIGlzIHRvIG1hdGNoCisgICAgICAgIDxodHRwczovL3RyYWMud2Via2l0Lm9y Zy9jaGFuZ2VzZXQvMjYyMzYwPi4KKworICAgICAgICBUZXN0OiBmYXN0L2ltYWdlcy9pbWctY2hh bmdlLW5hbWUtYXNzZXJ0Lmh0bWwKKworICAgICAgICAqIGh0bWwvSFRNTEltYWdlRWxlbWVudC5j cHA6CisgICAgICAgIChXZWJDb3JlOjpIVE1MSW1hZ2VFbGVtZW50OjpwYXJzZUF0dHJpYnV0ZSk6 CisKIDIwMjAtMDYtMjIgIEFuZHJlcyBHb256YWxleiAgPGFuZHJlc2dfMjJAYXBwbGUuY29tPgog CiAgICAgICAgIEFYSXNvbGF0ZWRUcmVlOjpnZW5lcmF0ZVN1YnRyZWUgc2hvdWxkIHByb3Blcmx5 IGFzc2lnbiB0aGUgZ2VuZXJhdGVkIHN1YnRyZWUgdG8gaXRzIHBhcmVudCBub2RlLgpkaWZmIC0t Z2l0IGEvU291cmNlL1dlYkNvcmUvaHRtbC9IVE1MSW1hZ2VFbGVtZW50LmNwcCBiL1NvdXJjZS9X ZWJDb3JlL2h0bWwvSFRNTEltYWdlRWxlbWVudC5jcHAKaW5kZXggZDg5N2RiMmI2Njc1ZWY5ZGEw ODVhYzQyODU2Y2Q1ODE1MjhlOTgzZi4uZDEzYjY1YzczYjM3NmIyNjJjNzhiZmZlYzA3MmI5OWFh YjdlNWE4MyAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvaHRtbC9IVE1MSW1hZ2VFbGVtZW50 LmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9odG1sL0hUTUxJbWFnZUVsZW1lbnQuY3BwCkBAIC0y OTUsNyArMjk1LDcgQEAgdm9pZCBIVE1MSW1hZ2VFbGVtZW50OjpwYXJzZUF0dHJpYnV0ZShjb25z dCBRdWFsaWZpZWROYW1lJiBuYW1lLCBjb25zdCBBdG9tU3RyaW4KICAgICAgICAgICAgIGxvYWRE ZWZlcnJlZEltYWdlKCk7CiAgICAgfSBlbHNlIHsKICAgICAgICAgaWYgKG5hbWUgPT0gbmFtZUF0 dHIpIHsKLSAgICAgICAgICAgIGJvb2wgd2lsbEhhdmVOYW1lID0gIXZhbHVlLmlzTnVsbCgpOwor ICAgICAgICAgICAgYm9vbCB3aWxsSGF2ZU5hbWUgPSAhdmFsdWUuaXNFbXB0eSgpOwogICAgICAg ICAgICAgaWYgKG1faGFkTmFtZUJlZm9yZUF0dHJpYnV0ZUNoYW5nZWQgIT0gd2lsbEhhdmVOYW1l ICYmIGlzQ29ubmVjdGVkKCkgJiYgIWlzSW5TaGFkb3dUcmVlKCkgJiYgaXM8SFRNTERvY3VtZW50 Pihkb2N1bWVudCgpKSkgewogICAgICAgICAgICAgICAgIEhUTUxEb2N1bWVudCYgZG9jdW1lbnQg PSBkb3duY2FzdDxIVE1MRG9jdW1lbnQ+KHRoaXMtPmRvY3VtZW50KCkpOwogICAgICAgICAgICAg ICAgIGNvbnN0IEF0b21TdHJpbmcmIGlkID0gZ2V0SWRBdHRyaWJ1dGUoKTsKZGlmZiAtLWdpdCBh L0xheW91dFRlc3RzL0NoYW5nZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxvZwppbmRleCBmYzUz MWFiZmU5NGIzODRkY2JmOGU4OWNkN2ZjMWZjNjhjMDViY2I4Li5lOWI4ZTc4ZTBlMWY4NDIyYzg2 OWZkMGI2MmNhYjMzYTZmNmRiMzdjIDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cK KysrIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTYgQEAKKzIwMjAtMDYtMjUg IEphY2sgTGVlICA8c2hpaGNoaWVoX2xlZUBhcHBsZS5jb20+CisKKyAgICAgICAgQVNTRVJUSU9O IEZBSUxFRDogKGl0ICE9IG1fbWFwLmVuZCgpKSBpbiBUcmVlU2NvcGVPcmRlcmVkTWFwOjpyZW1v dmUKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIxMzYx MQorICAgICAgICA8cmRhcjovL3Byb2JsZW0vNjQ0OTM1MDY+CisKKyAgICAgICAgUmV2aWV3ZWQg YnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgQWRkZWQgYSByZWdyZXNzaW9uIHRlc3QgZm9y IHRoZSBjcmFzaC4KKworICAgICAgICAqIGZhc3QvaW1hZ2VzL2ltZy1jaGFuZ2UtbmFtZS1hc3Nl cnQtZXhwZWN0ZWQudHh0OiBBZGRlZC4KKyAgICAgICAgKiBmYXN0L2ltYWdlcy9pbWctY2hhbmdl LW5hbWUtYXNzZXJ0Lmh0bWw6IEFkZGVkLgorCiAyMDIwLTA2LTIyICBGdWppaSBIaXJvbm9yaSAg PEhpcm9ub3JpLkZ1amlpQHNvbnkuY29tPgogCiAgICAgICAgIFtXaW5dIGZhc3QvZG9tL1dpbmRv dy9hbGVydC13aXRoLXVubWF0Y2hlZC11dGYxNi1zdXJyb2dhdGUtc2hvdWxkLW5vdC1jcmFzaC5o dG1sIGlzIGZhaWxpbmcKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2Zhc3QvaW1hZ2VzL2ltZy1j aGFuZ2UtbmFtZS1hc3NlcnQtZXhwZWN0ZWQudHh0IGIvTGF5b3V0VGVzdHMvZmFzdC9pbWFnZXMv aW1nLWNoYW5nZS1uYW1lLWFzc2VydC1leHBlY3RlZC50eHQKbmV3IGZpbGUgbW9kZSAxMDA2NDQK aW5kZXggMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMC4uYTY1Zjk4OTYw MjljYzIyZGI2NDg1YWZhNDVmMDg2ODRjYTcxZmRjMgotLS0gL2Rldi9udWxsCisrKyBiL0xheW91 dFRlc3RzL2Zhc3QvaW1hZ2VzL2ltZy1jaGFuZ2UtbmFtZS1hc3NlcnQtZXhwZWN0ZWQudHh0CkBA IC0wLDAgKzEgQEAKKyJUZXN0cyBjaGFuZ2luZyBuYW1lIG9mIGFuIGltYWdlIGVsZW1lbnQuIFRo ZSB0ZXN0IHBhc3NlcyBpZiBXZWJLaXQgZG9lc24ndCBjcmFzaCBvciBoaXQgYW4gc3NlcnRpb24u IgpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvZmFzdC9pbWFnZXMvaW1nLWNoYW5nZS1uYW1lLWFz c2VydC5odG1sIGIvTGF5b3V0VGVzdHMvZmFzdC9pbWFnZXMvaW1nLWNoYW5nZS1uYW1lLWFzc2Vy dC5odG1sCm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAuLjdlYWQ4NzcyN2Y0ZWNiNGRjMzNmNDdiZjUzNGZkMjY5NDUwYTI2 ZWQKLS0tIC9kZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0cy9mYXN0L2ltYWdlcy9pbWctY2hhbmdl LW5hbWUtYXNzZXJ0Lmh0bWwKQEAgLTAsMCArMSw4IEBACis8Ym9keT48aW1hZ2UgaWQ9aW1nIG5h bWU9IiI+PC9pbWFnZT48c3Bhbj4iVGVzdHMgY2hhbmdpbmcgbmFtZSBvZiBhbiBpbWFnZSBlbGVt ZW50LiBUaGUgdGVzdCBwYXNzZXMgaWYgV2ViS2l0IGRvZXNuJ3QgY3Jhc2ggb3IgaGl0IGFuIHNz ZXJ0aW9uLiI8L3NwYW4+Cis8c2NyaXB0PgorICAgIGlmICh3aW5kb3cudGVzdFJ1bm5lcikKKyAg ICAgICAgdGVzdFJ1bm5lci5kdW1wQXNUZXh0KCk7CisgICAgCisgICAgaW1nLm5hbWUgPSAibmV3 IG5hbWUiOworICAgIGltZy5yZW1vdmUoKTsKKzwvc2NyaXB0Pgo=