Bug 193351 - Release assert when removing element with a map element in the shadow tree
Summary: Release assert when removing element with a map element in the shadow tree
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: DOM (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2019-01-11 07:10 PST by Antti Koivisto
Modified: 2019-01-11 23:40 PST (History)
7 users (show)

See Also:

Attachments
patch (3.78 KB, patch)
2019-01-11 07:22 PST, Antti Koivisto 		no flags Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Antti Koivisto 2019-01-11 07:10:37 PST 
(lldb) bt
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BREAKPOINT (code=EXC_I386_BPT, subcode=0x0)
  * frame #0: 0x000000010b242cb3 WebCore`WTFCrashWithInfo((null)=81, (null)="./dom/TreeScopeOrderedMap.cpp", (null)="void WebCore::TreeScopeOrderedMap::remove(const WTF::AtomicStringImpl &, WebCore::Element &)", (null)=139) at Assertions.h:559 [opt]
    frame #1: 0x000000010bf8465e WebCore`WebCore::TreeScopeOrderedMap::remove(this=0x00000001de412fe0, key=<unavailable>, element=0x00000001de9abf90) at TreeScopeOrderedMap.cpp:81 [opt]
    frame #2: 0x000000010c0c3dc3 WebCore`WebCore::HTMLMapElement::removedFromAncestor(this=0x00000001de9abf90, removalType=(disconnectedFromDocument = true, treeScopeChanged = false), oldParentOfRemovedTree=0x00000001de3befa0) at HTMLMapElement.cpp:129 [opt]
    frame #3: 0x000000010bebbf85 WebCore`WebCore::notifyNodeRemovedFromDocument(oldParentOfRemovedTree=0x00000001de3befa0, treeScopeChange=DidNotChange, node=0x00000001de9abf90) at ContainerNodeAlgorithms.cpp:114 [opt]
    frame #4: 0x000000010bebbfc6 WebCore`WebCore::notifyNodeRemovedFromDocument(oldParentOfRemovedTree=0x00000001de3befa0, treeScopeChange=DidNotChange, node=0x00000001de95bf40) at ContainerNodeAlgorithms.cpp:121 [opt]
    frame #5: 0x000000010bebc032 WebCore`WebCore::notifyNodeRemovedFromDocument(oldParentOfRemovedTree=0x00000001de3befa0, treeScopeChange=Changed, node=0x00000001de438fa0) at ContainerNodeAlgorithms.cpp:129 [opt]
    frame #6: 0x000000010beb8788 WebCore`WebCore::ContainerNode::removeChild(WebCore::Node&) [inlined] WebCore::notifyChildNodeRemoved(oldParentOfRemovedTree=<unavailable>, child=<unavailable>) at ContainerNodeAlgorithms.cpp:161 [opt]
    frame #7: 0x000000010beb875e WebCore`WebCore::ContainerNode::removeChild(WebCore::Node&) at ContainerNode.cpp:168 [opt]
    frame #8: 0x000000010beb8704 WebCore`WebCore::ContainerNode::removeChild(this=0x00000001de3befa0, oldChild=0x00000001de438fa0) at ContainerNode.cpp:571 [opt]
    frame #9: 0x000000010bf418c0 WebCore`WebCore::Node::remove(this=<unavailable>) at Node.cpp:625 [opt]
Comment 1 Antti Koivisto 2019-01-11 07:11:01 PST 
<rdar://problem/47208807>
Comment 2 Antti Koivisto 2019-01-11 07:22:01 PST 
Created attachment 358894 [details]
patch
Comment 3 WebKit Commit Bot 2019-01-11 14:38:31 PST 
Comment on attachment 358894 [details]
patch

Clearing flags on attachment: 358894

Committed r239877: <https://trac.webkit.org/changeset/239877>
Comment 4 WebKit Commit Bot 2019-01-11 14:38:32 PST 
All reviewed patches have been landed.  Closing bug.