RESOLVED FIXED 179158
REGRESSION(r224053): Crash in WebCore::Node::moveTreeToNewScope 
https://bugs.webkit.org/show_bug.cgi?id=179158
Summary REGRESSION(r224053): Crash in WebCore::Node::moveTreeToNewScope
Ryosuke Niwa
Reported 2017-11-01 23:48:58 PDT
We need to RELEASE_ASSERT_WITH_SECURITY_IMPLICATION before calling decrementReferencingNodeCount. <rdar://problem/35217605>
Attachments
Fixes the bug (7.31 KB, patch)
2017-11-01 23:51 PDT, Ryosuke Niwa 		no flags
DetailsFormatted DiffDiff
Fixes the bug (1.52 KB, patch)
2017-11-01 23:56 PDT, Ryosuke Niwa 		no flags
DetailsFormatted DiffDiff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.
Ryosuke Niwa
Comment 1 2017-11-01 23:51:28 PDT
Created attachment 325689 [details] Fixes the bug
Ryosuke Niwa
Comment 2 2017-11-01 23:56:24 PDT
Created attachment 325692 [details] Fixes the bug
WebKit Commit Bot
Comment 3 2017-11-02 01:58:50 PDT
Comment on attachment 325692 [details] Fixes the bug Clearing flags on attachment: 325692 Committed r224325: <https://trac.webkit.org/changeset/224325>
WebKit Commit Bot
Comment 4 2017-11-02 01:58:51 PDT
All reviewed patches have been landed. Closing bug.
Radar WebKit Bug Importer
Comment 5 2017-11-15 12:26:53 PST
<rdar://problem/35567549>
Note You need to log in before you can comment on or make changes to this bug.