247412 2022-11-03 00:00:35 -0700 Assertion failure in TreeScopeOrderedMap::add by TreeScope::addElementByName 2022-11-03 12:35:26 -0700 1 1 1 Unclassified WebKit DOM WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=244398 InRadar P2 Normal --- 1 rniwa rniwa bfulgham webkit-bug-importer oldest_to_newest 1910004 0 rniwa 2022-11-03 00:00:35 -0700 e.g. ASSERTION FAILED: !entry.registeredElements.contains(&element) dom/TreeScopeOrderedMap.cpp(63) : void WebCore::TreeScopeOrderedMap::add(const WTF::AtomStringImpl &, WebCore::Element &, const WebCore::TreeScope &) 1 0x4e264cde9 WTFCrash 2 0x4e264ce09 WTFCrashWithSecurityImplication 3 0x4fbe3aff1 WebCore::TreeScopeOrderedMap::add(WTF::AtomStringImpl const&, WebCore::Element&, WebCore::TreeScope const&) 4 0x4fbe3b4a1 WebCore::TreeScope::addElementByName(WTF::AtomStringImpl const&, WebCore::Element&) 5 0x4fbc9d1ea WebCore::Element::insertedIntoAncestor(WebCore::Node::InsertionType, WebCore::ContainerNode&) 6 0x4fc090ad4 WebCore::HTMLElement::insertedIntoAncestor(WebCore::Node::InsertionType, WebCore::ContainerNode&) 7 0x4fbb7eb21 WebCore::notifyNodeInsertedIntoDocument(WebCore::ContainerNode&, WebCore::Node&, WebCore::TreeScopeChange, WTF::Vector<WTF::Ref<WebCore::Node, WTF::RawPtrTraits<WebCore::Node> >, 11ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&) 8 0x4fbb7e908 WebCore::notifyChildNodeInserted(WebCore::ContainerNode&, WebCore::Node&, WTF::Vector<WTF::Ref<WebCore::Node, WTF::RawPtrTraits<WebCore::Node> >, 11ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&) 9 0x4fbb65966 void WebCore::executeNodeInsertionWithScriptAssertion<WebCore::ContainerNode::appendChildWithoutPreInsertionValidityCheck(WebCore::Node&)::$_4>(WebCore::ContainerNode&, WebCore::Node&, WebCore::Node*, WebCore::ContainerNode::ChildChange::Source, WebCore::ReplacedAllChildren, WebCore::ContainerNode::appendChildWithoutPreInsertionValidityCheck(WebCore::Node&)::$_4) 10 0x4fbb62e88 WebCore::ContainerNode::appendChildWithoutPreInsertionValidityCheck(WebCore::Node&) 11 0x4fbb6278a WebCore::ContainerNode::insertBefore(WebCore::Node&, WebCore::Node*) 12 0x4fbd6e33e WebCore::Node::after(WTF::FixedVector<std::__1::variant<WTF::RefPtr<WebCore::Node, WTF::RawPtrTraits<WebCore::Node>, WTF::DefaultRefDerefTraits<WebCore::Node> >, WTF::String> >&&) 13 0x4f91c507f WebCore::jsElementPrototypeFunction_afterBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSElement*)::'lambda'()::operator()() const 14 0x4f91c4fb1 JSC::JSValue WebCore::toJS<WebCore::IDLUndefined, WebCore::jsElementPrototypeFunction_afterBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSElement*)::'lambda'()>(JSC::JSGlobalObject&, JSC::ThrowScope&, WebCore::jsElementPrototypeFunction_afterBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSElement*)::'lambda'()&&) 15 0x4f91c4f3f WebCore::jsElementPrototypeFunction_afterBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSElement*) 16 0x4f91c4cfe long long WebCore::IDLOperation<WebCore::JSElement>::call<&(WebCore::jsElementPrototypeFunction_afterBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSElement*)), (WebCore::CastedThisErrorBehavior)0>(JSC::JSGlobalObject&, JSC::CallFrame&, char const*) 17 0x4f91b4064 WebCore::jsElementPrototypeFunction_after(JSC::JSGlobalObject*, JSC::CallFrame*) 1910005 1 webkit-bug-importer 2022-11-03 00:00:50 -0700 <rdar://problem/101898183> 1910006 2 rniwa 2022-11-03 00:01:41 -0700 <rdar://101897430> 1910007 3 463377 rniwa 2022-11-03 00:03:44 -0700 Created attachment 463377 Test 1910008 4 rniwa 2022-11-03 00:10:53 -0700 Luckily, there is no security implication here despite of the assertion since CachedHTMLCollection<HTMLCollectionClass, traversalType>::namedItem returns early when the input string is empty. 1910009 5 rniwa 2022-11-03 00:23:31 -0700 Pull request: https://github.com/WebKit/WebKit/pull/6077 1910154 6 ews-feeder 2022-11-03 12:35:24 -0700 Committed 256286@main (6231b9849576): <https://commits.webkit.org/256286@main> Reviewed commits have been landed. Closing PR #6077 and removing active labels. 463377 2022-11-03 00:03:44 -0700 2022-11-03 00:03:44 -0700 Test bug247412.html text/html 334 rniwa PCFET0NUWVBFIGh0bWw+CjxzY3JpcHQ+CmlmICh3aW5kb3cudGVzdFJ1bm5lcikKICAgIHRlc3RS dW5uZXIuZHVtcEFzVGV4dCgpOwoKZnVuY3Rpb24gcnVuKCkgewogICAgY29udGFpbmVyLmFwcGVu ZENoaWxkKG5hbWVkRWxlbWVudCk7CiAgICBkb2N1bWVudC5ib2R5LmlubmVySFRNTCA9ICc8cD5U aGlzIHRlc3QgcGFzc2VzIGlmIFdlYktpdCBkb2VzIG5vdCBoaXQgYW55IGRlYnVnIGFzc2VydGlv bnMuPC9wPjxwPlBBU1M8L3A+JzsKfQo8L3NjcmlwdD4KPGJvZHkgb25sb2FkPXJ1bigpPgo8ZGl2 IGlkPSJjb250YWluZXIiPgo8aW1nIGlkPSJuYW1lZEVsZW1lbnQiIG5hbWU9IiI+Cg==