Bug 179158

Summary: REGRESSION(r224053): Crash in WebCore::Node::moveTreeToNewScope
Product: WebKit Reporter: Ryosuke Niwa <rniwa>
Component: DOMAssignee: Ryosuke Niwa <rniwa>
Status: RESOLVED FIXED    
Severity: Normal CC: buildbot, cdumez, commit-queue, dbates, esprehn+autocc, kangil.han, koivisto, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Fixes the bug
none
Fixes the bug none

Description Ryosuke Niwa 2017-11-01 23:48:58 PDT 
We need to RELEASE_ASSERT_WITH_SECURITY_IMPLICATION before calling decrementReferencingNodeCount.

<rdar://problem/35217605>
Comment 1 Ryosuke Niwa 2017-11-01 23:51:28 PDT 
Created attachment 325689 [details]
Fixes the bug
Comment 2 Ryosuke Niwa 2017-11-01 23:56:24 PDT 
Created attachment 325692 [details]
Fixes the bug
Comment 3 WebKit Commit Bot 2017-11-02 01:58:50 PDT 
Comment on attachment 325692 [details]
Fixes the bug

Clearing flags on attachment: 325692

Committed r224325: <https://trac.webkit.org/changeset/224325>
Comment 4 WebKit Commit Bot 2017-11-02 01:58:51 PDT 
All reviewed patches have been landed.  Closing bug.
Comment 5 Radar WebKit Bug Importer 2017-11-15 12:26:53 PST 
<rdar://problem/35567549>