Bug 237977

Summary: ASSERTION FAILED: !m_invoking in CustomElementQueue::add() on tv.youtube.com
Product: WebKit Reporter: Simon Fraser (smfr) <simon.fraser>
Component: DOMAssignee: Ryosuke Niwa <rniwa>
Status: RESOLVED FIXED    
Severity: Normal CC: cdumez, jcraig, rniwa, simon.fraser, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Crash log none

Simon Fraser (smfr)
Reported 2022-03-16 13:03:58 PDT
Loading tv.youtube.com (logged in) quickly asserts here: ASSERTION FAILED: !m_invoking ./dom/CustomElementReactionQueue.cpp(247) : void WebCore::CustomElementQueue::add(WebCore::Element &) 1 0x538bc7ed9 WTFCrash 2 0x54cb6716b WTFCrashWithInfo(int, char const*, char const*, int) 3 0x54fdf181c WebCore::CustomElementQueue::add(WebCore::Element&) 4 0x54fdf0610 WebCore::CustomElementReactionQueue::enqueueElementOnAppropriateElementQueue(WebCore::Element&) 5 0x54fdf104a WebCore::CustomElementReactionQueue::enqueueAttributeChangedCallbackIfNeeded(WebCore::Element&, WebCore::QualifiedName const&, WTF::AtomString const&, WTF::AtomString const&) 6 0x54ff05301 WebCore::Element::attributeChanged(WebCore::QualifiedName const&, WTF::AtomString const&, WTF::AtomString const&, WebCore::Element::AttributeModificationReason) 7 0x55006a800 WebCore::StyledElement::attributeChanged(WebCore::QualifiedName const&, WTF::AtomString const&, WTF::AtomString const&, WebCore::Element::AttributeModificationReason) 8 0x54ff0bd14 WebCore::Element::didAddAttribute(WebCore::QualifiedName const&, WTF::AtomString const&) 9 0x54ff0bc70 WebCore::Element::addAttributeInternal(WebCore::QualifiedName const&, WTF::AtomString const&, WebCore::Element::SynchronizationOfLazyAttribute) 10 0x54ff0494c WebCore::Element::setAttributeInternal(unsigned int, WebCore::QualifiedName const&, WTF::AtomString const&, WebCore::Element::SynchronizationOfLazyAttribute) 11 0x54ff04d22 WebCore::Element::setAttributeWithoutSynchronization(WebCore::QualifiedName const&, WTF::AtomString const&) 12 0x54d758aa8 WebCore::setJSElement_ariaLabelSetter(JSC::JSGlobalObject&, WebCore::JSElement&, JSC::JSValue)::'lambda'()::operator()() const 13 0x54d758a3d void WebCore::invokeFunctorPropagatingExceptionIfNecessary<WebCore::setJSElement_ariaLabelSetter(JSC::JSGlobalObject&, WebCore::JSElement&, JSC::JSValue)::'lambda'()>(JSC::JSGlobalObject&, JSC::ThrowScope&, WebCore::setJSElement_ariaLabelSetter(JSC::JSGlobalObject&, WebCore::JSElement&, JSC::JSValue)::'lambda'()&&) 14 0x54d7589e6 WebCore::setJSElement_ariaLabelSetter(JSC::JSGlobalObject&, WebCore::JSElement&, JSC::JSValue) 15 0x54d691696 bool WebCore::IDLAttribute<WebCore::JSElement>::set<&(WebCore::setJSElement_ariaLabelSetter(JSC::JSGlobalObject&, WebCore::JSElement&, JSC::JSValue)), (WebCore::CastedThisErrorBehavior)0>(JSC::JSGlobalObject&, long long, long long, JSC::PropertyName) 16 0x54d691515 WebCore::setJSElement_ariaLabel(JSC::JSGlobalObject*, long long, long long, JSC::PropertyName) 17 0x53a7efd44 JSC::JSObject::putInlineSlow(JSC::JSGlobalObject*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) 18 0x53a7ef52c JSC::JSObject::putInlineForJSObject(JSC::JSCell*, JSC::JSGlobalObject*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) 19 0x539e1a631 JSC::JSCell::putInline(JSC::JSGlobalObject*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) 20 0x539e1b070 JSC::JSValue::putInline(JSC::JSGlobalObject*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) 21 0x53a32b820 llint_slow_path_put_by_id 22 0x539273507 llint_entry 23 0x53928aea7 llint_entry 24 0x53928bf4b llint_entry 25 0x53928aea7 llint_entry 26 0x53928aea7 llint_entry 27 0x241a848d0bdb 28 0x241a8482389b 29 0x241a848b0c21 30 0x241a84a9a396 31 0x241a84a9b852
Attachments
Crash log (131.92 KB, text/plain)
2022-03-16 13:05 PDT, Simon Fraser (smfr) 		no flags
Details
View All Add attachment proposed patch, testcase, etc.
Simon Fraser (smfr)
Comment 1 2022-03-16 13:05:09 PDT
Created attachment 454883 [details] Crash log
Simon Fraser (smfr)
Comment 2 2022-03-16 13:05:21 PDT
This is with trunk at r291330
Radar WebKit Bug Importer
Comment 3 2022-03-23 13:04:42 PDT
<rdar://problem/90718851>
Ryosuke Niwa
Comment 4 2022-07-02 15:18:54 PDT
I tried reproducing this assertion failure but couldn't.
Ryosuke Niwa
Comment 5 2022-07-15 23:14:12 PDT
Ah, I see the problem now. AriaAttributes are missing CEReactions!
Ryosuke Niwa
Comment 6 2022-07-16 00:06:59 PDT
Filed https://github.com/w3c/aria/issues/1767
Ryosuke Niwa
Comment 7 2022-07-16 01:16:40 PDT
Pull request: https://github.com/WebKit/WebKit/pull/2486
EWS
Comment 8 2022-07-17 15:28:29 PDT
Committed 252552@main (a0165aefca5b): <https://commits.webkit.org/252552@main> Reviewed commits have been landed. Closing PR #2486 and removing active labels.
Ryosuke Niwa
Comment 9 2022-07-17 21:36:49 PDT
*** Bug 231049 has been marked as a duplicate of this bug. ***
Note You need to log in before you can comment on or make changes to this bug.