Bug 179158

Summary: REGRESSION(r224053): Crash in WebCore::Node::moveTreeToNewScope
Product: WebKit Reporter: Ryosuke Niwa <rniwa>
Component: DOMAssignee: Ryosuke Niwa <rniwa>
Status: RESOLVED FIXED    
Severity: Normal CC: buildbot, cdumez, commit-queue, dbates, esprehn+autocc, kangil.han, koivisto, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Fixes the bug
none
Fixes the bug none

Ryosuke Niwa
Reported 2017-11-01 23:48:58 PDT
We need to RELEASE_ASSERT_WITH_SECURITY_IMPLICATION before calling decrementReferencingNodeCount. <rdar://problem/35217605>
Attachments
Fixes the bug (7.31 KB, patch)
2017-11-01 23:51 PDT, Ryosuke Niwa 		no flags
DetailsFormatted DiffDiff
Fixes the bug (1.52 KB, patch)
2017-11-01 23:56 PDT, Ryosuke Niwa 		no flags
DetailsFormatted DiffDiff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.
Ryosuke Niwa
Comment 1 2017-11-01 23:51:28 PDT
Created attachment 325689 [details] Fixes the bug
Ryosuke Niwa
Comment 2 2017-11-01 23:56:24 PDT
Created attachment 325692 [details] Fixes the bug
WebKit Commit Bot
Comment 3 2017-11-02 01:58:50 PDT
Comment on attachment 325692 [details] Fixes the bug Clearing flags on attachment: 325692 Committed r224325: <https://trac.webkit.org/changeset/224325>
WebKit Commit Bot
Comment 4 2017-11-02 01:58:51 PDT
All reviewed patches have been landed. Closing bug.
Radar WebKit Bug Importer
Comment 5 2017-11-15 12:26:53 PST
<rdar://problem/35567549>
Note You need to log in before you can comment on or make changes to this bug.