Bug 282814 – ASSERTION FAILED: m_start != m_end in WTF::Deque<WTF::String>::last() under WebCore::FragmentDirectiveParser::parseFragmentDirective

• Component: WebCore Misc.
• Status: RESOLVED FIXED

[Fujii Hironori]

ASSERTION FAILED: m_start != m_end in WTF::Deque<WTF::String>::last() under WebCore::FragmentDirectiveParser::parseFragmentDirective

1. Start your favorite WebKit based browser
2. Load https://webkit.org/#:~:text=prefix-
3. Crash

ASSERTION FAILED: m_start != m_end
C:\webkit\wb\WebKitBuild\Debug\WTF\Headers\wtf/Deque.h(86) : T &WTF::Deque<WTF::String>::last()
'WebKitNetworkProcess.exe' (Win32): Loaded 'C:\Windows\System32\msctf.dll'. 
1   00007FF821562C83 WTF::Deque<WTF::String,0>::last
2   00007FF8215622E1 WebCore::FragmentDirectiveParser::parseFragmentDirective
3   00007FF821561A96 WebCore::FragmentDirectiveParser::FragmentDirectiveParser
4   00007FF8222E6743 WebCore::LocalFrameView::scrollToFragment
5   00007FF8220387A6 WebCore::FrameLoader::scrollToFragmentWithParentBoundary
6   00007FF822036205 WebCore::FrameLoader::finishedParsing
7   00007FF821409BE8 WebCore::Document::finishedParsing
8   00007FF821B15BC9 WebCore::HTMLConstructionSite::finishedParsing
9   00007FF821B82C4F WebCore::HTMLTreeBuilder::finished
10  00007FF821B1FFD2 WebCore::HTMLDocumentParser::end
11  00007FF821B1E827 WebCore::HTMLDocumentParser::attemptToRunDeferredScriptsAndEnd
12  00007FF821B20621 WebCore::HTMLDocumentParser::notifyFinished
13  00007FF8215F5ADC WebCore::PendingScript::notifyClientFinished
14  00007FF8215F5B18 WebCore::PendingScript::notifyFinished
15  00007FF821598C9A WebCore::LoadableScript::notifyClientFinished
16  00007FF8215963F9 WebCore::LoadableNonModuleScriptBase::notifyFinished
17  00007FF82214FF60 WebCore::CachedResource::checkNotify
18  00007FF8221500E4 WebCore::CachedResource::finishLoading
19  00007FF822183990 WebCore::CachedScript::finishLoading
20  00007FF8220D061D WebCore::SubresourceLoader::didFinishLoading
21  00007FF82856259B WebKit::WebResourceLoader::didFinishResourceLoad
22  00007FF82720AFA0 IPC::callMemberFunction<WebKit::WebResourceLoader,WebKit::WebResourceLoader,void (WebCore::NetworkLoadMetrics &&),std::tuple<WebCore::NetworkLoadMetrics> >::<lambda_1>::operator()<WebCore::NetworkLoadMetrics>
23  00007FF82720AF5D std::invoke<`lambda at C:\webkit\wb\Source\WebKit\Platform\IPC\HandleMessage.h:132:9',WebCore::NetworkLoadMetrics>
24  00007FF82720AF3A std::_Apply_impl<`lambda at C:\webkit\wb\Source\WebKit\Platform\IPC\HandleMessage.h:132:9',std::tuple<WebCore::NetworkLoadMetrics>,0>
25  00007FF82720AF02 std::apply<`lambda at C:\webkit\wb\Source\WebKit\Platform\IPC\HandleMessage.h:132:9',std::tuple<WebCore::NetworkLoadMetrics> >
26  00007FF82720AEBF IPC::callMemberFunction<WebKit::WebResourceLoader,WebKit::WebResourceLoader,void (WebCore::NetworkLoadMetrics &&),std::tuple<WebCore::NetworkLoadMetrics> >
27  00007FF827207070 IPC::handleMessage<Messages::WebResourceLoader::DidFinishResourceLoad,IPC::Connection,WebKit::WebResourceLoader,WebKit::WebResourceLoader,void (WebCore::NetworkLoadMetrics &&)>
28  00007FF827205361 WebKit::WebResourceLoader::didReceiveMessage
29  00007FF82852F2FF WebKit::NetworkProcessConnection::dispatchMessage
30  00007FF8271FED77 WebKit::NetworkProcessConnection::didReceiveMessage
31  00007FF827BCC059 IPC::Connection::dispatchMessage
Exception thrown at 0x00007FF81B3D73C5 (JavaScriptCore.dll) in WebKitWebProcess.exe: 0xC0000005: Access violation writing location 0x00000000BBADBEEF.

[Radar WebKit Bug Importer]

<rdar://problem/139948387>

[Fujii Hironori]

Pull request: https://github.com/WebKit/WebKit/pull/36684

[EWS]

Committed 286654@main (31115c9484ff): <https://commits.webkit.org/286654@main>

Reviewed commits have been landed. Closing PR #36684 and removing active labels.

[Fujii Hironori]

Created attachment 473276 [details]
Patch