232112 2021-10-21 15:30:13 -0700 RELEASE_ASSERT(result) under FormSubmission::create() 2021-10-21 17:10:16 -0700 1 1 1 Unclassified WebKit Forms WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 232117 1 cdumez cdumez achristensen cdumez changseok darin esprehn+autocc ews-watchlist ggaren gyuyoung.kim mifenton sam webkit-bug-importer wenson_hsieh youennf oldest_to_newest 1807402 0 cdumez 2021-10-21 15:30:13 -0700 RELEASE_ASSERT(result) under FormSubmission::create(): Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 JavaScriptCore 0x132e93e7e WTFCrash + 14 1 WebCore 0x14dd8da1b WTFCrashWithInfo(int, char const*, char const*, int) + 27 (Assertions.h:732) 2 WebCore 0x1519376d0 WebCore::FormSubmission::create(WebCore::HTMLFormElement&, WebCore::HTMLFormControlElement*, WebCore::FormSubmission::Attributes const&, WebCore::Event*, WebCore::LockHistory, WebCore::FormSubmissionTrigger) + 1616 (FormSubmission.cpp:216) 3 WebCore 0x1512381f5 WebCore::HTMLFormElement::submit(WebCore::Event*, bool, bool, WebCore::FormSubmissionTrigger, WebCore::HTMLFormControlElement*) + 389 (HTMLFormElement.cpp:401) 4 WebCore 0x1512383af WebCore::HTMLFormElement::submitFromJavaScript() + 63 (HTMLFormElement.cpp:314) 5 WebCore 0x14e9cbd18 WebCore::jsHTMLFormElementPrototypeFunction_submitBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSHTMLFormElement*)::'lambda'()::operator()() const + 24 (JSHTMLFormElement.cpp:630) 6 WebCore 0x14e9cbced JSC::JSValue WebCore::toJS<WebCore::IDLUndefined, WebCore::jsHTMLFormElementPrototypeFunction_submitBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSHTMLFormElement*)::'lambda'()>(JSC::JSGlobalObject&, JSC::ThrowScope&, WebCore::jsHTMLFormElementPrototypeFunction_submitBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSHTMLFormElement*)::'lambda'()&&) + 29 (JSDOMConvertBase.h:165) 7 WebCore 0x14e9cbc51 WebCore::jsHTMLFormElementPrototypeFunction_submitBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSHTMLFormElement*) + 193 (JSHTMLFormElement.cpp:630) 8 WebCore 0x14e9cbb5d long long WebCore::IDLOperation<WebCore::JSHTMLFormElement>::call<&(WebCore::jsHTMLFormElementPrototypeFunction_submitBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSHTMLFormElement*)), (WebCore::CastedThisErrorBehavior)0>(JSC::JSGlobalObject&, JSC::CallFrame&, char const*) + 685 (JSDOMOperation.h:63) 9 WebCore 0x14e9cb7e4 WebCore::jsHTMLFormElementPrototypeFunction_submit(JSC::JSGlobalObject*, JSC::CallFrame*) + 36 (JSHTMLFormElement.cpp:635) 10 ??? 0x2e8f49a011d8 ??? 11 JavaScriptCore 0x1334d3449 llint_entry + 145535 (LowLevelInterpreter.asm:1177) 12 JavaScriptCore 0x1334af8d0 vmEntryToJavaScript + 289 (LowLevelInterpreter64.asm:316) 13 JavaScriptCore 0x13437d8d5 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 229 (JITCodeInlines.h:42) 14 JavaScriptCore 0x13437e093 JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 1811 (Interpreter.cpp:963) 15 JavaScriptCore 0x13473dd7a JSC::call(JSC::JSGlobalObject*, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 218 (CallData.cpp:57) 16 JavaScriptCore 0x13473de5d JSC::call(JSC::JSGlobalObject*, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) + 205 (CallData.cpp:64) 17 JavaScriptCore 0x13473e11d JSC::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) + 125 (CallData.cpp:85) 18 WebCore 0x1506d0c3c WebCore::JSExecState::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) + 108 (JSExecState.h:73) 19 WebCore 0x1506eff3f WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext&, WebCore::Event&) + 2191 (JSEventListener.cpp:186) 20 WebCore 0x150e7faee WebCore::EventTarget::innerInvokeEventListeners(WebCore::Event&, WTF::Vector<WTF::RefPtr<WebCore::RegisteredEventListener, WTF::RawPtrTraits<WebCore::RegisteredEventListener>, WTF::DefaultRefDerefTraits<WebCore::RegisteredEventListener> >, 1ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>, WebCore::EventTarget::EventInvokePhase) + 1022 (EventTarget.cpp:344) 21 WebCore 0x150e7f576 WebCore::EventTarget::fireEventListeners(WebCore::Event&, WebCore::EventTarget::EventInvokePhase) + 342 (EventTarget.cpp:276) 22 WebCore 0x150e5bad9 WebCore::EventContext::handleLocalEvents(WebCore::Event&, WebCore::EventTarget::EventInvokePhase) const + 889 (EventContext.cpp:95) 23 WebCore 0x150e76886 WebCore::dispatchEventInDOM(WebCore::Event&, WebCore::EventPath const&) + 374 (EventDispatcher.cpp:107) 24 WebCore 0x150e760af WebCore::EventDispatcher::dispatchEvent(WebCore::Node&, WebCore::Event&) + 1087 (EventDispatcher.cpp:188) 25 WebCore 0x150efb67d WebCore::Node::dispatchEvent(WebCore::Event&) + 29 (Node.cpp:2384) 26 WebCore 0x15123bfa0 WebCore::HTMLFormElement::constructEntryList(WTF::Ref<WebCore::DOMFormData, WTF::RawPtrTraits<WebCore::DOMFormData> >&&, WTF::Vector<std::__1::pair<WTF::String, WTF::String>, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>*, WebCore::HTMLFormElement::IsMultipartForm) + 736 (HTMLFormElement.cpp:988) 27 WebCore 0x151191606 WebCore::DOMFormData::create(WebCore::HTMLFormElement*) + 150 (DOMFormData.cpp:51) 28 WebCore 0x14e4f65cb WebCore::JSDOMConstructor<WebCore::JSDOMFormData>::construct(JSC::JSGlobalObject*, JSC::CallFrame*) + 715 (JSDOMFormData.cpp:124) 1807408 1 442077 cdumez 2021-10-21 15:41:54 -0700 Created attachment 442077 Patch 1807431 2 442077 ggaren 2021-10-21 16:44:03 -0700 Comment on attachment 442077 Patch r=me 1807452 3 ews-feeder 2021-10-21 17:09:42 -0700 Committed r284656 (243376@main): <https://commits.webkit.org/243376@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 442077. 1807454 4 webkit-bug-importer 2021-10-21 17:10:16 -0700 <rdar://problem/84529237> 442077 2021-10-21 15:41:54 -0700 2021-10-21 17:09:44 -0700 Patch bug-232112-20211021154153.patch text/plain 4691 cdumez U3VidmVyc2lvbiBSZXZpc2lvbjogMjg0NjMxCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggMTJlMTJlN2E2NWMyOTcw ZjMwYzkzOGZhMDU3ZWQ5OWVlOTNhY2M4NC4uZWJmMTkyMTRkYTVmNzg4OGM5MGRjNWYzMGVkNTc0 NzVkYjI0Y2IzOSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDI1IEBACisyMDIxLTEwLTIxICBDaHJp cyBEdW1leiAgPGNkdW1lekBhcHBsZS5jb20+CisKKyAgICAgICAgUkVMRUFTRV9BU1NFUlQocmVz dWx0KSB1bmRlciBGb3JtU3VibWlzc2lvbjo6Y3JlYXRlKCkKKyAgICAgICAgaHR0cHM6Ly9idWdz LndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIzMjExMgorCisgICAgICAgIFJldmlld2VkIGJ5 IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIGZvcm0uc3VibWl0KCkgc2hvdWxkIGVhcmx5IHJl dHVybiBpZiB0aGUgZm9ybSdzIHxjb25zdHJ1Y3RpbmcgZW50cnkgbGlzdHwgZmxhZyBpcyB0cnVl LCBhcyBwZXI6CisgICAgICAgIC0gaHR0cHM6Ly9odG1sLnNwZWMud2hhdHdnLm9yZy9tdWx0aXBh Z2UvZm9ybS1jb250cm9sLWluZnJhc3RydWN0dXJlLmh0bWwjY29uY2VwdC1mb3JtLXN1Ym1pdCAo U3RlcCAyKQorCisgICAgICAgIFdlIHdlcmUgbWlzc2luZyB0aGlzIGNoZWNrLiBBcyBhIHJlc3Vs dCwgd2Ugd291bGQgY2FsbCBGb3JtU3VibWlzc2lvbjo6Y3JlYXRlKCksIHdoaWNoIHdvdWxkIGNh bGwKKyAgICAgICAgZm9ybS5jb25zdHJ1Y3RFbnRyeUxpc3QoKS4gVGhpcyB3b3VsZCBlbmQgdXAg cmV0dXJuaW5nIGFuIHVuZXhwZWN0ZWQgbnVsbHB0ciBiZWNhdXNlIHRoZQorICAgICAgICBmb3Jt J3MgfGNvbnN0cnVjdGluZyBlbnRyeSBsaXN0fCBmbGFnIGlzIHNldCBhbmQgd2Ugd291bGQgaGl0 IHRoZSBgUkVMRUFTRV9BU1NFUlQocmVzdWx0KWAgaW4KKyAgICAgICAgRm9ybVN1Ym1pc3Npb246 OmNyZWF0ZSgpLgorCisgICAgICAgIFRlc3Q6IGZhc3QvZm9ybXMvc3VibWl0LWZvcm0taW5zaWRl LWZvcm1kYXRhLWV2ZW50Lmh0bWwKKworICAgICAgICAqIGh0bWwvSFRNTEZvcm1FbGVtZW50LmNw cDoKKyAgICAgICAgKFdlYkNvcmU6OkhUTUxGb3JtRWxlbWVudDo6c3VibWl0KToKKyAgICAgICAg KiBsb2FkZXIvRm9ybVN1Ym1pc3Npb24uY3BwOgorICAgICAgICAoV2ViQ29yZTo6Rm9ybVN1Ym1p c3Npb246OmNyZWF0ZSk6CisKIDIwMjEtMTAtMTkgIERhcmluIEFkbGVyICA8ZGFyaW5AYXBwbGUu Y29tPgogCiAgICAgICAgIFtDb2NvYV0gTWVyZ2UgYW5kIHNpbXBsaWZ5IHRoZSBuc0NvbG9yIGZh bWlseSBvZiBmdW5jdGlvbnMKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL2h0bWwvSFRNTEZv cm1FbGVtZW50LmNwcCBiL1NvdXJjZS9XZWJDb3JlL2h0bWwvSFRNTEZvcm1FbGVtZW50LmNwcApp bmRleCAyM2U0OWFhM2QxOTQ5MTQ2ZGVlYWY3YTJkNmNmY2Q0Y2EyMThhYjU2Li40NDVkNGFhNDQ3 ZDEyOWE1Mzg2ODYzYmVmODBlYjc4ZjZmNmMzNWVlIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29y ZS9odG1sL0hUTUxGb3JtRWxlbWVudC5jcHAKKysrIGIvU291cmNlL1dlYkNvcmUvaHRtbC9IVE1M Rm9ybUVsZW1lbnQuY3BwCkBAIC0zNzgsNiArMzc4LDkgQEAgdm9pZCBIVE1MRm9ybUVsZW1lbnQ6 OnN1Ym1pdChFdmVudCogZXZlbnQsIGJvb2wgYWN0aXZhdGVTdWJtaXRCdXR0b24sIGJvb2wgcHJv Y2UKICAgICBpZiAoIWlzQ29ubmVjdGVkKCkpCiAgICAgICAgIHJldHVybjsKIAorICAgIGlmICht X2lzQ29uc3RydWN0aW5nRW50cnlMaXN0KQorICAgICAgICByZXR1cm47CisKICAgICBSZWZQdHI8 RnJhbWVWaWV3PiB2aWV3ID0gZG9jdW1lbnQoKS52aWV3KCk7CiAgICAgUmVmUHRyPEZyYW1lPiBm cmFtZSA9IGRvY3VtZW50KCkuZnJhbWUoKTsKICAgICBpZiAoIXZpZXcgfHwgIWZyYW1lKQpkaWZm IC0tZ2l0IGEvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCmlu ZGV4IDkzOWJmNTI3MmQyM2U0YzgwNTRlNjYwZDY3NWExODRhOTM3ZmMwMTEuLmY4NDcyYzE5ZGI3 NDk3NmMwN2NjNjI0N2E3ZjFiN2JjMDlkNzYzYmMgMTAwNjQ0Ci0tLSBhL0xheW91dFRlc3RzL0No YW5nZUxvZworKysgYi9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxNSBAQAorMjAy MS0xMC0yMSAgQ2hyaXMgRHVtZXogIDxjZHVtZXpAYXBwbGUuY29tPgorCisgICAgICAgIFJFTEVB U0VfQVNTRVJUKHJlc3VsdCkgdW5kZXIgRm9ybVN1Ym1pc3Npb246OmNyZWF0ZSgpCisgICAgICAg IGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yMzIxMTIKKworICAgICAg ICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBBZGQgbGF5b3V0IHRlc3Qg Y292ZXJhZ2UuCisKKyAgICAgICAgKiBmYXN0L2Zvcm1zL3N1Ym1pdC1mb3JtLWluc2lkZS1mb3Jt ZGF0YS1ldmVudC1leHBlY3RlZC50eHQ6IEFkZGVkLgorICAgICAgICAqIGZhc3QvZm9ybXMvc3Vi bWl0LWZvcm0taW5zaWRlLWZvcm1kYXRhLWV2ZW50Lmh0bWw6IEFkZGVkLgorCiAyMDIxLTEwLTIx ICBLYXRlIENoZW5leSAgPGthdGhlcmluZV9jaGVuZXlAYXBwbGUuY29tPgogCiAgICAgICAgIGh0 dHAvdGVzdHMvcmVzb3VyY2VMb2FkU3RhdGlzdGljcy93ZWJzaXRlLWRhdGEtcmVtb3ZhbC1mb3It c2l0ZS1uYXZpZ2F0ZWQtdG8td2l0aC1saW5rLWRlY29yYXRpb24uaHRtbCBpcyBhIGZsYWt5IHRp bWVvdXQKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2Zhc3QvZm9ybXMvc3VibWl0LWZvcm0taW5z aWRlLWZvcm1kYXRhLWV2ZW50LWV4cGVjdGVkLnR4dCBiL0xheW91dFRlc3RzL2Zhc3QvZm9ybXMv c3VibWl0LWZvcm0taW5zaWRlLWZvcm1kYXRhLWV2ZW50LWV4cGVjdGVkLnR4dApuZXcgZmlsZSBt b2RlIDEwMDY0NAppbmRleCAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw Li4xNzYzODMzZDZhMzExYzE0ODRhY2Y4NGJlMzkyZjI3M2VjMDNiMjdlCi0tLSAvZGV2L251bGwK KysrIGIvTGF5b3V0VGVzdHMvZmFzdC9mb3Jtcy9zdWJtaXQtZm9ybS1pbnNpZGUtZm9ybWRhdGEt ZXZlbnQtZXhwZWN0ZWQudHh0CkBAIC0wLDAgKzEsMTIgQEAKK1Rlc3RzIHN1Ym1pdHRpbmcgdGhl IGZvcm0gYWdhaW4gZnJvbSBpbnNpZGUgdGhlIGZvcm1kYXRhIGV2ZW50LgorCitPbiBzdWNjZXNz LCB5b3Ugd2lsbCBzZWUgYSBzZXJpZXMgb2YgIlBBU1MiIG1lc3NhZ2VzLCBmb2xsb3dlZCBieSAi VEVTVCBDT01QTEVURSIuCisKKworUEFTUyBjb3VudGVyIGlzIDEKK1BBU1MgY291bnRlciBpcyAy CitQQVNTIFRoZSBmcmFtZSB3YXMgbmF2aWdhdGVkCitQQVNTIHN1Y2Nlc3NmdWxseVBhcnNlZCBp cyB0cnVlCisKK1RFU1QgQ09NUExFVEUKKwpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvZmFzdC9m b3Jtcy9zdWJtaXQtZm9ybS1pbnNpZGUtZm9ybWRhdGEtZXZlbnQuaHRtbCBiL0xheW91dFRlc3Rz L2Zhc3QvZm9ybXMvc3VibWl0LWZvcm0taW5zaWRlLWZvcm1kYXRhLWV2ZW50Lmh0bWwKbmV3IGZp bGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMC4uY2JiOWVlYjFhZTVjZDk2NWQ2YzZmOTQzNGVmYTE4OTY3NjA3Yjc0ZQotLS0gL2Rldi9u dWxsCisrKyBiL0xheW91dFRlc3RzL2Zhc3QvZm9ybXMvc3VibWl0LWZvcm0taW5zaWRlLWZvcm1k YXRhLWV2ZW50Lmh0bWwKQEAgLTAsMCArMSwzMiBAQAorPERPQ1RZUEUgaHRtbD4KKzxodG1sPgor PGJvZHk+Cis8c2NyaXB0IHNyYz0iLi4vLi4vcmVzb3VyY2VzL2pzLXRlc3QuanMiPjwvc2NyaXB0 PgorPHNjcmlwdD4KK2Rlc2NyaXB0aW9uKCJUZXN0cyBzdWJtaXR0aW5nIHRoZSBmb3JtIGFnYWlu IGZyb20gaW5zaWRlIHRoZSBmb3JtZGF0YSBldmVudC4iKTsKK2pzVGVzdElzQXN5bmMgPSB0cnVl OworCitvbmxvYWQgPSAoKSA9PiB7CisgICAgbGV0IGZvcm0gPSBkb2N1bWVudC5nZXRFbGVtZW50 QnlJZCgidGVzdEZvcm0iKTsKKyAgICBsZXQgZnJhbWUgPSBkb2N1bWVudC5nZXRFbGVtZW50QnlJ ZCgidGVzdEZyYW1lIik7CisgICAgZnJhbWUub25sb2FkID0gKCkgPT4geworICAgICAgICB0ZXN0 UGFzc2VkKCJUaGUgZnJhbWUgd2FzIG5hdmlnYXRlZCIpOworICAgICAgICBmaW5pc2hKU1Rlc3Qo KTsKKyAgICB9OworICAgIGNvdW50ZXIgPSAwOworICAgIGZvcm0uYWRkRXZlbnRMaXN0ZW5lcign Zm9ybWRhdGEnLCBlID0+IHsKKyAgICAgICAgKytjb3VudGVyOworICAgICAgICBmb3JtLnN1Ym1p dCgpOworICAgIH0pOworICAgIGZvcm0uc3VibWl0KCk7CisgICAgc2hvdWxkQmUoImNvdW50ZXIi LCAiMSIpOworICAgIG5ldyBGb3JtRGF0YShmb3JtKTsKKyAgICBzaG91bGRCZSgiY291bnRlciIs ICIyIik7Cit9Cis8L3NjcmlwdD4KKzxpZnJhbWUgaWQ9InRlc3RGcmFtZSIgbmFtZT0idGVzdEZy YW1lIiBzdHlsZT0iZGlzcGxheTpub25lIj48L2lmcmFtZT4KKzxmb3JtIGlkPSJ0ZXN0Rm9ybSIg YWN0aW9uPSJyZXNvdXJjZXMvdGVzdC50eHQiIHRhcmdldD0idGVzdEZyYW1lIiBzdHlsZT0iZGlz cGxheTpub25lIj4KKyAgICA8aW5wdXQgbmFtZT0iZm9vIiB2YWx1ZT0iYmFyIj4KKzxmb3JtPgor PC9ib2R5PgorPC9odG1sPgo=