Bug 88299 – A style in an older shadow subtree causes assert when composing with <shadow/>

• Status: RESOLVED
• Resolution: FIXED
• Component: DOM

[Takashi Sakamoto]

The following is stack trace:

ASSERTION FAILED: !attached()
third_party/WebKit/Source/WebCore/dom/Node.cpp(1312) : virtual void WebCore::Node::attach()
1   0x75f580
2   0x7b8e3a
3   0x6cc6cd
4   0x6ca3a6
5   0x735b9f
6   0x10aa4a9
7   0x6cc6cd
8   0x6ca3a6
9   0x735b9f
10  0x6cbdcd
11  0x6c9e4d
12  0x152d71c
13  0x7adbe3
14  0x1c43873
15  0xca5fb9
16  0xca9b53
17  0xca8054
18  0xca5cbe
19  0xee172c
20  0xee4450
21  0x24ed9850618e
[20163:20163:1570975979892:ERROR:process_util_posix.cc(143)] Received signal 11
        base::debug::StackTrace::StackTrace() [0x87993e]
        base::(anonymous namespace)::StackDumpSignalHandler() [0x839a01]
        0x7f306becbaf0
        WebCore::Node::attach() [0x75f58a]
        WebCore::Text::attach() [0x7b8e3a]
        WebCore::ContainerNode::attachChildren() [0x6cc6cd]
        WebCore::ContainerNode::attach() [0x6ca3a6]
        WebCore::Element::attach() [0x735b9f]
        WebCore::InsertionPoint::attach() [0x10aa4a9]
        WebCore::ContainerNode::attachChildren() [0x6cc6cd]
        WebCore::ContainerNode::attach() [0x6ca3a6]
        WebCore::Element::attach() [0x735b9f]
        WebCore::updateTreeAfterInsertion() [0x6cbdcd]
        WebCore::ContainerNode::appendChild() [0x6c9e4d]
        WebCore::replaceChildrenWithFragment() [0x152d71c]
        WebCore::ShadowRoot::setInnerHTML() [0x7adbe3]
        WebCore::ShadowRootV8Internal::innerHTMLAttrSetter() [0x1c43873]
        v8::internal::JSObject::SetPropertyWithCallback() [0xca5fb9]
        v8::internal::JSObject::SetPropertyForResult() [0xca9b53]
        v8::internal::JSReceiver::SetProperty() [0xca8054]
        v8::internal::JSReceiver::SetProperty() [0xca5cbe]
        v8::internal::StoreIC::Store() [0xee172c]
        v8::internal::StoreIC_Miss() [0xee4450]
        0x24ed9850618e

[Takashi Sakamoto]

Created attachment 145960 [details]
repro

[Hajime Morrita]

Created attachment 146199 [details]
Patch

[Hajime Morrita]

Dimitri, could you take a look?
takak@ caught this slip-out from the last refactoring.

[Hajime Morrita]

s/takak@/tasak@/

[Dimitri Glazkov (Google)]

Comment on attachment 146199 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=146199&action=review

> Source/WebCore/ChangeLog:3
> +        A style in an older shadow subtree causes assert when composing with <shadow/>

Really minor nit: don't use XML self-closing tag syntax. We're not in XML-land :)

[Hajime Morrita]

(In reply to comment #5)
> 
> Really minor nit: don't use XML self-closing tag syntax. We're not in XML-land :)
I admit that a part of my mind has been sticking at that era :-) Will fix.

[Hajime Morrita]

Created attachment 146445 [details]
Patch for landing

[WebKit Review Bot]

Comment on attachment 146445 [details]
Patch for landing

Clearing flags on attachment: 146445

Committed r119790: <http://trac.webkit.org/changeset/119790>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.