Bug 179158 - REGRESSION(r224053): Crash in WebCore::Node::moveTreeToNewScope
Summary: REGRESSION(r224053): Crash in WebCore::Node::moveTreeToNewScope
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: DOM (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Ryosuke Niwa
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2017-11-01 23:48 PDT by Ryosuke Niwa
Modified: 2017-11-15 12:26 PST (History)
8 users (show)

See Also:


Attachments
Fixes the bug (7.31 KB, patch)
2017-11-01 23:51 PDT, Ryosuke Niwa
no flags Details | Formatted Diff | Diff
Fixes the bug (1.52 KB, patch)
2017-11-01 23:56 PDT, Ryosuke Niwa
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Ryosuke Niwa 2017-11-01 23:48:58 PDT
We need to RELEASE_ASSERT_WITH_SECURITY_IMPLICATION before calling decrementReferencingNodeCount.

<rdar://problem/35217605>
Comment 1 Ryosuke Niwa 2017-11-01 23:51:28 PDT
Created attachment 325689 [details]
Fixes the bug
Comment 2 Ryosuke Niwa 2017-11-01 23:56:24 PDT
Created attachment 325692 [details]
Fixes the bug
Comment 3 WebKit Commit Bot 2017-11-02 01:58:50 PDT
Comment on attachment 325692 [details]
Fixes the bug

Clearing flags on attachment: 325692

Committed r224325: <https://trac.webkit.org/changeset/224325>
Comment 4 WebKit Commit Bot 2017-11-02 01:58:51 PDT
All reviewed patches have been landed.  Closing bug.
Comment 5 Radar WebKit Bug Importer 2017-11-15 12:26:53 PST
<rdar://problem/35567549>