<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>166011</bug_id>
          
          <creation_ts>2016-12-18 04:35:56 -0800</creation_ts>
          <short_desc>ASSERTION FAILED: !isAnonymous() in WebCore::RenderMathMLOperator::updateTokenContent</short_desc>
          <delta_ts>2017-11-16 00:15:32 -0800</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>MathML</component>
          <version>WebKit Local Build</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          <blocked>116980</blocked>
    
    <blocked>160509</blocked>
          <everconfirmed>1</everconfirmed>
          <reporter name="Renata Hodovan">hodovan</reporter>
          <assigned_to name="Frédéric Wang Nélar">fred.wang</assigned_to>
          <cc>alex</cc>
    
    <cc>bdakin</cc>
    
    <cc>fred.wang</cc>
    
    <cc>webkit-bug-importer</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1261023</commentid>
    <comment_count>0</comment_count>
    <who name="Renata Hodovan">hodovan</who>
    <bug_when>2016-12-18 04:35:56 -0800</bug_when>
    <thetext>Load the attached test with debug WebKitTestRunner:

Checked version: f368f1d
OS: Darwin-15.6.0-x86_64-i386-64bit

&lt;math display=&quot;block&quot;&gt;&lt;mfenced&gt;&lt;mfrac&gt;

Backtrace:

ASSERTION FAILED: !isAnonymous()
WebKit/Source/WebCore/rendering/mathml/RenderMathMLOperator.cpp(257) : virtual void WebCore::RenderMathMLOperator::updateTokenContent()
1   0x118fc6c71 WTFCrash
2   0x122e34756 WebCore::RenderMathMLOperator::updateTokenContent()
3   0x121f0babd WebCore::MathMLStyle::updateStyleIfNeeded(WebCore::RenderObject*, bool, WebCore::MathMLElement::MathVariant)
4   0x121f0b2a7 WebCore::MathMLStyle::resolveMathMLStyle(WebCore::RenderObject*)
5   0x121f0ae9a WebCore::MathMLStyle::resolveMathMLStyleTree(WebCore::RenderObject*)
6   0x121ef7d03 WebCore::MathMLMathElement::didAttachRenderers()
7   0x12324d0af WebCore::RenderTreeUpdater::popParent()
8   0x12324b24f WebCore::RenderTreeUpdater::popParentsToDepth(unsigned int)
9   0x12324ac8a WebCore::RenderTreeUpdater::updateRenderTree(WebCore::ContainerNode&amp;)
10  0x12324a2bf WebCore::RenderTreeUpdater::commit(std::__1::unique_ptr&lt;WebCore::Style::Update, std::__1::default_delete&lt;WebCore::Style::Update&gt; &gt;)
11  0x11e77e3a9 WebCore::Document::recalcStyle(WebCore::Style::Change)
12  0x11e7688cb WebCore::Document::updateStyleIfNeeded()
13  0x11f55ed4f WebCore::HTMLEmbedElement::parseAttribute(WebCore::QualifiedName const&amp;, WTF::AtomicString const&amp;)
14  0x11eb54fd1 WebCore::Element::attributeChanged(WebCore::QualifiedName const&amp;, WTF::AtomicString const&amp;, WTF::AtomicString const&amp;, WebCore::Element::AttributeModificationReason)
15  0x123b44e4f WebCore::StyledElement::attributeChanged(WebCore::QualifiedName const&amp;, WTF::AtomicString const&amp;, WTF::AtomicString const&amp;, WebCore::Element::AttributeModificationReason)
16  0x11eb56963 WebCore::Element::parserSetAttributes(WTF::Vector&lt;WebCore::Attribute, 0ul, WTF::CrashOnOverflow, 16ul&gt; const&amp;)
17  0x11f493dad WebCore::setAttributes(WebCore::Element&amp;, WTF::Vector&lt;WebCore::Attribute, 0ul, WTF::CrashOnOverflow, 16ul&gt;&amp;, WebCore::ParserContentPolicy)
18  0x11f490656 WebCore::setAttributes(WebCore::Element&amp;, WebCore::AtomicHTMLToken&amp;, WebCore::ParserContentPolicy)
19  0x11f49393c WebCore::HTMLConstructionSite::createHTMLElementOrFindCustomElementInterface(WebCore::AtomicHTMLToken&amp;, WebCore::JSCustomElementInterface**)
20  0x11f492102 WebCore::HTMLConstructionSite::createHTMLElement(WebCore::AtomicHTMLToken&amp;)
21  0x11f493f1c WebCore::HTMLConstructionSite::insertSelfClosingHTMLElement(WebCore::AtomicHTMLToken&amp;&amp;)
22  0x11f7a496f WebCore::HTMLTreeBuilder::processStartTagForInBody(WebCore::AtomicHTMLToken&amp;&amp;)
23  0x11f79c511 WebCore::HTMLTreeBuilder::processStartTag(WebCore::AtomicHTMLToken&amp;&amp;)
24  0x11f79b265 WebCore::HTMLTreeBuilder::processToken(WebCore::AtomicHTMLToken&amp;&amp;)
25  0x11f79a069 WebCore::HTMLTreeBuilder::constructTree(WebCore::AtomicHTMLToken&amp;&amp;)
26  0x11f509cb8 WebCore::HTMLDocumentParser::constructTreeFromHTMLToken(WebCore::HTMLTokenizer::TokenPtr&amp;)
27  0x11f509a03 WebCore::HTMLDocumentParser::pumpTokenizerLoop(WebCore::HTMLDocumentParser::SynchronousMode, bool, WebCore::PumpSession&amp;)
28  0x11f5075e3 WebCore::HTMLDocumentParser::pumpTokenizer(WebCore::HTMLDocumentParser::SynchronousMode)
29  0x11f506fa0 WebCore::HTMLDocumentParser::pumpTokenizerIfPossible(WebCore::HTMLDocumentParser::SynchronousMode)
30  0x11f50b1dc WebCore::HTMLDocumentParser::append(WTF::RefPtr&lt;WTF::StringImpl&gt;&amp;&amp;)
31  0x11e65e74c WebCore::DecodedDataDocumentParser::appendBytes(WebCore::DocumentWriter&amp;, char const*, unsigned long)
ASAN:DEADLYSIGNAL
=================================================================
==41182==ERROR: AddressSanitizer: SEGV on unknown address 0x0000bbadbeef (pc 0x000118fc6ca9 bp 0x7fff509b3960 sp 0x7fff509b3950 T0)
    #0 0x118fc6ca8 in WTFCrash (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x2f81ca8)
    #1 0x122e34755 in WebCore::RenderMathMLOperator::updateTokenContent() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x5897755)
    #2 0x121f0babc in WebCore::MathMLStyle::updateStyleIfNeeded(WebCore::RenderObject*, bool, WebCore::MathMLElement::MathVariant) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x496eabc)
    #3 0x121f0b2a6 in WebCore::MathMLStyle::resolveMathMLStyle(WebCore::RenderObject*) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x496e2a6)
    #4 0x121f0ae99 in WebCore::MathMLStyle::resolveMathMLStyleTree(WebCore::RenderObject*) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x496de99)
    #5 0x121ef7d02 in WebCore::MathMLMathElement::didAttachRenderers() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x495ad02)
    #6 0x12324d0ae in WebCore::RenderTreeUpdater::popParent() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x5cb00ae)
    #7 0x12324b24e in WebCore::RenderTreeUpdater::popParentsToDepth(unsigned int) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x5cae24e)
    #8 0x12324ac89 in WebCore::RenderTreeUpdater::updateRenderTree(WebCore::ContainerNode&amp;) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x5cadc89)
    #9 0x12324a2be in WebCore::RenderTreeUpdater::commit(std::__1::unique_ptr&lt;WebCore::Style::Update, std::__1::default_delete&lt;WebCore::Style::Update&gt; &gt;) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x5cad2be)
    #10 0x11e77e3a8 in WebCore::Document::recalcStyle(WebCore::Style::Change) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x11e13a8)
    #11 0x11e7688ca in WebCore::Document::updateStyleIfNeeded() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x11cb8ca)
    #12 0x11f55ed4e in WebCore::HTMLEmbedElement::parseAttribute(WebCore::QualifiedName const&amp;, WTF::AtomicString const&amp;) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1fc1d4e)
    #13 0x11eb54fd0 in WebCore::Element::attributeChanged(WebCore::QualifiedName const&amp;, WTF::AtomicString const&amp;, WTF::AtomicString const&amp;, WebCore::Element::AttributeModificationReason) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x15b7fd0)
    #14 0x123b44e4e in WebCore::StyledElement::attributeChanged(WebCore::QualifiedName const&amp;, WTF::AtomicString const&amp;, WTF::AtomicString const&amp;, WebCore::Element::AttributeModificationReason) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x65a7e4e)
    #15 0x11eb56962 in WebCore::Element::parserSetAttributes(WTF::Vector&lt;WebCore::Attribute, 0ul, WTF::CrashOnOverflow, 16ul&gt; const&amp;) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x15b9962)
    #16 0x11f493dac in WebCore::setAttributes(WebCore::Element&amp;, WTF::Vector&lt;WebCore::Attribute, 0ul, WTF::CrashOnOverflow, 16ul&gt;&amp;, WebCore::ParserContentPolicy) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1ef6dac)
    #17 0x11f490655 in WebCore::setAttributes(WebCore::Element&amp;, WebCore::AtomicHTMLToken&amp;, WebCore::ParserContentPolicy) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1ef3655)
    #18 0x11f49393b in WebCore::HTMLConstructionSite::createHTMLElementOrFindCustomElementInterface(WebCore::AtomicHTMLToken&amp;, WebCore::JSCustomElementInterface**) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1ef693b)
    #19 0x11f492101 in WebCore::HTMLConstructionSite::createHTMLElement(WebCore::AtomicHTMLToken&amp;) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1ef5101)
    #20 0x11f493f1b in WebCore::HTMLConstructionSite::insertSelfClosingHTMLElement(WebCore::AtomicHTMLToken&amp;&amp;) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1ef6f1b)
    #21 0x11f7a496e in WebCore::HTMLTreeBuilder::processStartTagForInBody(WebCore::AtomicHTMLToken&amp;&amp;) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x220796e)
    #22 0x11f79c510 in WebCore::HTMLTreeBuilder::processStartTag(WebCore::AtomicHTMLToken&amp;&amp;) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x21ff510)
    #23 0x11f79b264 in WebCore::HTMLTreeBuilder::processToken(WebCore::AtomicHTMLToken&amp;&amp;) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x21fe264)
    #24 0x11f79a068 in WebCore::HTMLTreeBuilder::constructTree(WebCore::AtomicHTMLToken&amp;&amp;) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x21fd068)
    #25 0x11f509cb7 in WebCore::HTMLDocumentParser::constructTreeFromHTMLToken(WebCore::HTMLTokenizer::TokenPtr&amp;) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1f6ccb7)
    #26 0x11f509a02 in WebCore::HTMLDocumentParser::pumpTokenizerLoop(WebCore::HTMLDocumentParser::SynchronousMode, bool, WebCore::PumpSession&amp;) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1f6ca02)
    #27 0x11f5075e2 in WebCore::HTMLDocumentParser::pumpTokenizer(WebCore::HTMLDocumentParser::SynchronousMode) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1f6a5e2)
    #28 0x11f506f9f in WebCore::HTMLDocumentParser::pumpTokenizerIfPossible(WebCore::HTMLDocumentParser::SynchronousMode) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1f69f9f)
    #29 0x11f50b1db in WebCore::HTMLDocumentParser::append(WTF::RefPtr&lt;WTF::StringImpl&gt;&amp;&amp;) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1f6e1db)
    #30 0x11e65e74b in WebCore::DecodedDataDocumentParser::appendBytes(WebCore::DocumentWriter&amp;, char const*, unsigned long) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x10c174b)
    #31 0x11e988ab1 in WebCore::DocumentWriter::addData(char const*, unsigned long) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x13ebab1)
    #32 0x11e8cfff5 in WebCore::DocumentLoader::commitData(char const*, unsigned long) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1332ff5)
    #33 0x11038ae9d in WebKit::WebFrameLoaderClient::committedLoad(WebCore::DocumentLoader*, char const*, int) (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x112be9d)
    #34 0x11e8d5186 in WebCore::DocumentLoader::commitLoad(char const*, int) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1338186)
    #35 0x11e8d4eca in WebCore::DocumentLoader::dataReceived(char const*, int) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1337eca)
    #36 0x11e8d5568 in WebCore::DocumentLoader::dataReceived(WebCore::CachedResource&amp;, char const*, int) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1338568)
    #37 0x11db84f71 in WebCore::CachedRawResource::notifyClientsDataWasReceived(char const*, unsigned int) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x5e7f71)
    #38 0x11db84c20 in WebCore::CachedRawResource::addDataBuffer(WebCore::SharedBuffer&amp;) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x5e7c20)
    #39 0x123c9114a in WebCore::SubresourceLoader::didReceiveDataOrBuffer(char const*, int, WTF::RefPtr&lt;WebCore::SharedBuffer&gt;&amp;&amp;, long long, WebCore::DataPayloadType) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x66f414a)
    #40 0x123c90a80 in WebCore::SubresourceLoader::didReceiveData(char const*, unsigned int, long long, WebCore::DataPayloadType) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x66f3a80)
    #41 0x110d7ab3a in WebKit::WebResourceLoader::didReceiveData(IPC::DataReference const&amp;, long long) (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x1b1bb3a)
    #42 0x110d88ae3 in void IPC::callMemberFunctionImpl&lt;WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(IPC::DataReference const&amp;, long long), std::__1::tuple&lt;IPC::DataReference, long long&gt;, 0ul, 1ul&gt;(WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(IPC::DataReference const&amp;, long long), std::__1::tuple&lt;IPC::DataReference, long long&gt;&amp;&amp;, std::__1::integer_sequence&lt;unsigned long, 0ul, 1ul&gt;) (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x1b29ae3)
    #43 0x110d885e4 in void IPC::callMemberFunction&lt;WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(IPC::DataReference const&amp;, long long), std::__1::tuple&lt;IPC::DataReference, long long&gt;, std::__1::integer_sequence&lt;unsigned long, 0ul, 1ul&gt; &gt;(std::__1::tuple&lt;IPC::DataReference, long long&gt;&amp;&amp;, WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(IPC::DataReference const&amp;, long long)) (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x1b295e4)
    #44 0x110d85cf1 in void IPC::handleMessage&lt;Messages::WebResourceLoader::DidReceiveData, WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(IPC::DataReference const&amp;, long long)&gt;(IPC::Decoder&amp;, WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(IPC::DataReference const&amp;, long long)) (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x1b26cf1)
    #45 0x110d84280 in WebKit::WebResourceLoader::didReceiveWebResourceLoaderMessage(IPC::Connection&amp;, IPC::Decoder&amp;) (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x1b25280)
    #46 0x10fa24629 in WebKit::NetworkProcessConnection::didReceiveMessage(IPC::Connection&amp;, IPC::Decoder&amp;) (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x7c5629)
    #47 0x10f43830a in IPC::Connection::dispatchMessage(IPC::Decoder&amp;) (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x1d930a)
    #48 0x10f422184 in IPC::Connection::dispatchMessage(std::__1::unique_ptr&lt;IPC::Decoder, std::__1::default_delete&lt;IPC::Decoder&gt; &gt;) (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x1c3184)
    #49 0x10f438ff5 in IPC::Connection::dispatchOneMessage() (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x1d9ff5)
    #50 0x10f4495ac in IPC::Connection::enqueueIncomingMessage(std::__1::unique_ptr&lt;IPC::Decoder, std::__1::default_delete&lt;IPC::Decoder&gt; &gt;)::$_14::operator()() (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x1ea5ac)
    #51 0x10f4494d8 in WTF::Function&lt;void ()&gt;::CallableWrapper&lt;IPC::Connection::enqueueIncomingMessage(std::__1::unique_ptr&lt;IPC::Decoder, std::__1::default_delete&lt;IPC::Decoder&gt; &gt;)::$_14&gt;::call() (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x1ea4d8)
    #52 0x11904cb60 in WTF::Function&lt;void ()&gt;::operator()() const (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x3007b60)
    #53 0x11908f5b6 in WTF::RunLoop::performWork() (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x304a5b6)
    #54 0x119090781 in WTF::RunLoop::performWork(void*) (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x304b781)
    #55 0x7fff94efd7e0 in __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0xaa7e0)
    #56 0x7fff94edcf1b in __CFRunLoopDoSources0 (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0x89f1b)
    #57 0x7fff94edc43e in __CFRunLoopRun (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0x8943e)
    #58 0x7fff94edbe37 in CFRunLoopRunSpecific (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0x88e37)
    #59 0x7fff93297934 in RunCurrentEventLoopInMode (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox+0x30934)
    #60 0x7fff9329776e in ReceiveNextEventCommon (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox+0x3076e)
    #61 0x7fff932975ae in _BlockUntilNextEventMatchingListInModeWithFilter (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox+0x305ae)
    #62 0x7fff98137df5 in _DPSNextEvent (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit+0x48df5)
    #63 0x7fff98137225 in -[NSApplication _nextEventMatchingEventMask:untilDate:inMode:dequeue:] (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit+0x48225)
    #64 0x7fff9812bd7f in -[NSApplication run] (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit+0x3cd7f)
    #65 0x7fff980f5367 in NSApplicationMain (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit+0x6367)
    #66 0x7fff8beec193 in _xpc_objc_main (/usr/lib/system/libxpc.dylib+0x11193)
    #67 0x7fff8beeabbd in xpc_main (/usr/lib/system/libxpc.dylib+0xfbbd)
    #68 0x10f242f73 in main (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent.Development+0x100001f73)
    #69 0x7fff9ecd85ac in start (/usr/lib/system/libdyld.dylib+0x35ac)
    #70 0x0  (&lt;unknown module&gt;)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x2f81ca8) in WTFCrash
==41182==ABORTING
#CRASHED - com.apple.WebKit.WebContent.Development (pid 41182)</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1261024</commentid>
    <comment_count>1</comment_count>
      <attachid>297437</attachid>
    <who name="Renata Hodovan">hodovan</who>
    <bug_when>2016-12-18 04:35:58 -0800</bug_when>
    <thetext>Created attachment 297437
Test</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1371575</commentid>
    <comment_count>2</comment_count>
    <who name="Frédéric Wang Nélar">fred.wang</who>
    <bug_when>2017-11-14 14:22:05 -0800</bug_when>
    <thetext>We don&apos;t take into account displaystyle/mathvariant to render the anonymous mfenced operators, so we should just skip the updateTokenContent calls for them in WebCore::MathMLStyle::updateStyleIfNeeded.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1371759</commentid>
    <comment_count>3</comment_count>
      <attachid>326972</attachid>
    <who name="Frédéric Wang Nélar">fred.wang</who>
    <bug_when>2017-11-15 00:36:16 -0800</bug_when>
    <thetext>Created attachment 326972
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1372545</commentid>
    <comment_count>4</comment_count>
      <attachid>326972</attachid>
    <who name="Alejandro G. Castro">alex</who>
    <bug_when>2017-11-16 00:07:47 -0800</bug_when>
    <thetext>Comment on attachment 326972
Patch

LGTM</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1372547</commentid>
    <comment_count>5</comment_count>
    <who name="Frédéric Wang Nélar">fred.wang</who>
    <bug_when>2017-11-16 00:14:42 -0800</bug_when>
    <thetext>Committed r224910: &lt;https://trac.webkit.org/changeset/224910&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1372548</commentid>
    <comment_count>6</comment_count>
    <who name="Radar WebKit Bug Importer">webkit-bug-importer</who>
    <bug_when>2017-11-16 00:15:32 -0800</bug_when>
    <thetext>&lt;rdar://problem/35583121&gt;</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="0"
              isprivate="0"
          >
            <attachid>297437</attachid>
            <date>2016-12-18 04:35:58 -0800</date>
            <delta_ts>2016-12-18 04:35:58 -0800</delta_ts>
            <desc>Test</desc>
            <filename>test.html</filename>
            <type>application/octet-stream</type>
            <size>38</size>
            <attacher name="Renata Hodovan">hodovan</attacher>
            
              <data encoding="base64">PG1hdGggZGlzcGxheT0iYmxvY2siPjxtZmVuY2VkPjxtZnJhYz4=
</data>

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>326972</attachid>
            <date>2017-11-15 00:36:16 -0800</date>
            <delta_ts>2017-11-16 00:07:47 -0800</delta_ts>
            <desc>Patch</desc>
            <filename>bug-166011-20171115093615.patch</filename>
            <type>text/plain</type>
            <size>5087</size>
            <attacher name="Frédéric Wang Nélar">fred.wang</attacher>
            
              <data encoding="base64">U3VidmVyc2lvbiBSZXZpc2lvbjogMjI0ODE2CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D
aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggZGZmNDFhMTJjNDUxNWVi
MzZlYjM1OTdiMjVkNjg1MGY4MmRiNTA0ZS4uYThiMzYyNWM2N2FmNDMyMDQzYmU2NmE3NTQzNzQ3
N2JmNGZjZDhiYyAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv
dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDIyIEBACisyMDE3LTExLTE1ICBGcmVk
ZXJpYyBXYW5nICA8ZndhbmdAaWdhbGlhLmNvbT4KKworICAgICAgICBBU1NFUlRJT04gRkFJTEVE
OiAhaXNBbm9ueW1vdXMoKSBpbiBXZWJDb3JlOjpSZW5kZXJNYXRoTUxPcGVyYXRvcjo6dXBkYXRl
VG9rZW5Db250ZW50CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNn
aT9pZD0xNjYwMTEKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAg
ICAgICBSZW5kZXJNYXRoTUxGZW5jZWRPcGVyYXRvciBkb2VzIG5vdCBzdXBwb3J0IG1hdGh2YXJp
YW50IG9yIGRpc3BsYXlzdHlsZSB0cmFuc2Zvcm1zLiBUaGlzIGlzCisgICAgICAgIG9uZSBvZiBz
ZXZlcmFsIGlzc3VlcyBvZiB0aGUgbWZlbmNlZCBlbGVtZW50IChzZWUgYnVnIDE2MDUwOSkuIEhv
d2V2ZXIsCisgICAgICAgIE1hdGhNTFN0eWxlOjp1cGRhdGVTdHlsZUlmTmVlZGVkKCkgc3RpbGwg
dHJpZXMgdG8gdXNlIHRoZSBpbXBsZW1lbnRhdGlvbiBvZiB0aGUgcGFyZW50CisgICAgICAgIFJl
bmRlck1hdGhNTE9wZXJhdG9yIGNsYXNzLCB3aGljaCBvbmx5IHdvcmtzIGZvciBub24tYW5vbnlt
b3VzIG9wZXJhdG9ycy4gVGhpcyBwYXRjaCBza2lwcworICAgICAgICB0aGUgdXBkYXRlVG9rZW5D
b250ZW50KCkgY2FsbHMgZm9yIGFub255bW91cyBtZmVuY2VkIG9wZXJhdG9ycyBpbiBvcmRlciB0
byBhdm9pZCBBU1NFUlRJT04KKyAgICAgICAgZmFpbHVyZXMuCisKKyAgICAgICAgVGVzdDogbWF0
aG1sL21mZW5jZWQtZGlzcGxheXN0eWxlLWFuZC1tYXRodmFyaWFudC1jcmFzaC5odG1sCisKKyAg
ICAgICAgKiByZW5kZXJpbmcvbWF0aG1sL01hdGhNTFN0eWxlLmNwcDoKKyAgICAgICAgKFdlYkNv
cmU6Ok1hdGhNTFN0eWxlOjp1cGRhdGVTdHlsZUlmTmVlZGVkKTogU2tpcCBhbm9ueW1vdXMgdG9r
ZW4gZWxlbWVudHMuCisKIDIwMTctMTEtMTQgIFphbiBEb2JlcnNlayAgPHpkb2JlcnNla0BpZ2Fs
aWEuY29tPgogCiAgICAgICAgIFtDYWlyb10gTW92ZSBkcmF3TGluZXNGb3JUZXh0IG9wZXJhdGlv
biBmcm9tIEdyYXBoaWNzQ29udGV4dENhaXJvIHRvIENhaXJvT3BlcmF0aW9ucwpkaWZmIC0tZ2l0
IGEvU291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL21hdGhtbC9NYXRoTUxTdHlsZS5jcHAgYi9Tb3Vy
Y2UvV2ViQ29yZS9yZW5kZXJpbmcvbWF0aG1sL01hdGhNTFN0eWxlLmNwcAppbmRleCA2MTYyYWNi
YjkzZjczZWI1Zjk5NTczYmQxNWRjMWM2MzNkMTEzMTVkLi42MDAwZGE2Njg1NGQ3NWQwY2I3NzM1
NWQ1OGI4YjM2N2ZlMjFmMDg4IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcv
bWF0aG1sL01hdGhNTFN0eWxlLmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvbWF0
aG1sL01hdGhNTFN0eWxlLmNwcApAQCAtODAsMTUgKzgwLDE5IEBAIFJlbmRlck9iamVjdCogTWF0
aE1MU3R5bGU6OmdldE1hdGhNTFBhcmVudE5vZGUoUmVuZGVyT2JqZWN0KiByZW5kZXJlcikKIAog
dm9pZCBNYXRoTUxTdHlsZTo6dXBkYXRlU3R5bGVJZk5lZWRlZChSZW5kZXJPYmplY3QqIHJlbmRl
cmVyLCBib29sIG9sZERpc3BsYXlTdHlsZSwgTWF0aE1MRWxlbWVudDo6TWF0aFZhcmlhbnQgb2xk
TWF0aFZhcmlhbnQpCiB7CisgICAgLy8gUmVuZGVyTWF0aE1MRmVuY2VkT3BlcmF0b3IgZG9lcyBu
b3Qgc3VwcG9ydCBtYXRodmFyaWFudCBvciBkaXNwbGF5c3R5bGUgdHJhbnNmb3Jtcy4KKyAgICAv
LyBTZWUgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE2MDUwOSNjMS4K
KyAgICBib29sIGlzTm9uQW5vbnltb3VzVG9rZW5FbGVtZW50ID0gaXM8UmVuZGVyTWF0aE1MVG9r
ZW4+KHJlbmRlcmVyKSAmJiAhcmVuZGVyZXItPmlzQW5vbnltb3VzKCk7CisKICAgICBpZiAob2xk
RGlzcGxheVN0eWxlICE9IG1fZGlzcGxheVN0eWxlKSB7CiAgICAgICAgIHJlbmRlcmVyLT5zZXRO
ZWVkc0xheW91dEFuZFByZWZXaWR0aHNSZWNhbGMoKTsKLSAgICAgICAgaWYgKGlzPFJlbmRlck1h
dGhNTFRva2VuPihyZW5kZXJlcikpCisgICAgICAgIGlmIChpc05vbkFub255bW91c1Rva2VuRWxl
bWVudCkKICAgICAgICAgICAgIGRvd25jYXN0PFJlbmRlck1hdGhNTFRva2VuPihyZW5kZXJlcikt
PnVwZGF0ZVRva2VuQ29udGVudCgpOwogICAgICAgICBlbHNlIGlmIChpczxSZW5kZXJNYXRoTUxG
cmFjdGlvbj4ocmVuZGVyZXIpKQogICAgICAgICAgICAgZG93bmNhc3Q8UmVuZGVyTWF0aE1MRnJh
Y3Rpb24+KHJlbmRlcmVyKS0+dXBkYXRlRnJvbUVsZW1lbnQoKTsKICAgICB9CiAgICAgaWYgKG9s
ZE1hdGhWYXJpYW50ICE9IG1fbWF0aFZhcmlhbnQpIHsKLSAgICAgICAgaWYgKGlzPFJlbmRlck1h
dGhNTFRva2VuPihyZW5kZXJlcikpCisgICAgICAgIGlmIChpc05vbkFub255bW91c1Rva2VuRWxl
bWVudCkKICAgICAgICAgICAgIGRvd25jYXN0PFJlbmRlck1hdGhNTFRva2VuPihyZW5kZXJlcikt
PnVwZGF0ZVRva2VuQ29udGVudCgpOwogICAgIH0KIH0KZGlmZiAtLWdpdCBhL0xheW91dFRlc3Rz
L0NoYW5nZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxvZwppbmRleCBjOWIxMzhhZjdhYWY4YzU0
MzYwMzBlMjNmODhkM2JhZmQ1MzlhYmVmLi5mZTc4N2U5OGFlMTQ2YTg5ZTJkNDdkNDBmMTU0NjY5
NzQ3ODE1OWZlIDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKKysrIGIvTGF5b3V0
VGVzdHMvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTUgQEAKKzIwMTctMTEtMTUgIEZyZWRlcmljIFdh
bmcgIDxmd2FuZ0BpZ2FsaWEuY29tPgorCisgICAgICAgIEFTU0VSVElPTiBGQUlMRUQ6ICFpc0Fu
b255bW91cygpIGluIFdlYkNvcmU6OlJlbmRlck1hdGhNTE9wZXJhdG9yOjp1cGRhdGVUb2tlbkNv
bnRlbnQKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE2
NjAxMQorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEFk
ZCBhIGNyYXNoIHRlc3QgY2hlY2tpbmcgZGlzcGxheXN0eWxlIGFuZCBtYXRodmFyaWFudCBvbiBt
ZmVuY2VkIG9wZXJhdG9ycy4KKworICAgICAgICAqIG1hdGhtbC9tZmVuY2VkLWRpc3BsYXlzdHls
ZS1hbmQtbWF0aHZhcmlhbnQtY3Jhc2gtZXhwZWN0ZWQudHh0OiBBZGRlZC4KKyAgICAgICAgKiBt
YXRobWwvbWZlbmNlZC1kaXNwbGF5c3R5bGUtYW5kLW1hdGh2YXJpYW50LWNyYXNoLmh0bWw6IEFk
ZGVkLgorCiAyMDE3LTExLTE0ICBNczJnZXIgIDxNczJnZXJAaWdhbGlhLmNvbT4KIAogICAgICAg
ICBBZGQgc29tZSBidWcgbnVtYmVycyBmb3IgZmFpbGluZyBYSFIgdGVzdHMKZGlmZiAtLWdpdCBh
L0xheW91dFRlc3RzL21hdGhtbC9tZmVuY2VkLWRpc3BsYXlzdHlsZS1hbmQtbWF0aHZhcmlhbnQt
Y3Jhc2gtZXhwZWN0ZWQudHh0IGIvTGF5b3V0VGVzdHMvbWF0aG1sL21mZW5jZWQtZGlzcGxheXN0
eWxlLWFuZC1tYXRodmFyaWFudC1jcmFzaC1leHBlY3RlZC50eHQKbmV3IGZpbGUgbW9kZSAxMDA2
NDQKaW5kZXggMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMC4uNjg5MDJm
YTc5MzE0NTk4NWY1Njk2YzMyMDVlZTljZmMyZDEzN2JmYwotLS0gL2Rldi9udWxsCisrKyBiL0xh
eW91dFRlc3RzL21hdGhtbC9tZmVuY2VkLWRpc3BsYXlzdHlsZS1hbmQtbWF0aHZhcmlhbnQtY3Jh
c2gtZXhwZWN0ZWQudHh0CkBAIC0wLDAgKzEsMTAgQEAKK1RoaXMgdGVzdCBwYXNzZXMgaWYgaXQg
ZG9lcyBub3QgY3Jhc2gKKworMAorMQorMgorIAorMAorMQorMgorCmRpZmYgLS1naXQgYS9MYXlv
dXRUZXN0cy9tYXRobWwvbWZlbmNlZC1kaXNwbGF5c3R5bGUtYW5kLW1hdGh2YXJpYW50LWNyYXNo
Lmh0bWwgYi9MYXlvdXRUZXN0cy9tYXRobWwvbWZlbmNlZC1kaXNwbGF5c3R5bGUtYW5kLW1hdGh2
YXJpYW50LWNyYXNoLmh0bWwKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMDAwMDAw
MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMC4uYjZmZGI2YWQ0MzIzODhiOGY4NzIxMTQ3Njkx
MjIxYmVjODJjNGYzOAotLS0gL2Rldi9udWxsCisrKyBiL0xheW91dFRlc3RzL21hdGhtbC9tZmVu
Y2VkLWRpc3BsYXlzdHlsZS1hbmQtbWF0aHZhcmlhbnQtY3Jhc2guaHRtbApAQCAtMCwwICsxLDMy
IEBACis8IURPQ1RZUEUgaHRtbD4KKzxodG1sPgorICA8aGVhZD4KKyAgICA8dGl0bGU+ZGlzcGxh
eXN0eWxlL21hdGh2YXJpYW50IG9uIGFub255bW91cyBtZmVuY2VkIG9wZXJhdG9yczwvdGl0bGU+
CisgICAgPG1ldGEgY2hhcnNldD0idXRmLTgiLz4KKyAgICA8c2NyaXB0PgorICAgICAgICBpZiAo
d2luZG93LnRlc3RSdW5uZXIpCisgICAgICAgICAgICB0ZXN0UnVubmVyLmR1bXBBc1RleHQoKTsK
KyAgICA8L3NjcmlwdD4KKyAgPC9oZWFkPgorICA8Ym9keT4KKworICAgIDxwPlRoaXMgdGVzdCBw
YXNzZXMgaWYgaXQgZG9lcyBub3QgY3Jhc2g8L3A+CisKKyAgICA8bWF0aCBtYXRodmFyaWFudD0i
ZnJha3R1ciI+CisgICAgICA8bWZlbmNlZCBvcGVuPSJBIiBzZXBhcmF0b3JzPSJCIiBjbG9zZT0i
QyI+CisgICAgICAgIDxtbj4wPC9tbj4KKyAgICAgICAgPG1uPjE8L21uPgorICAgICAgICA8bW4+
MjwvbW4+CisgICAgICA8L21mZW5jZWQ+CisgICAgPC9tYXRoPgorCisgICAgPG1hdGggZGlzcGxh
eXN0eWxlPSJ0cnVlIj4KKyAgICAgIDxtZmVuY2VkIG9wZW49IuKIkSIgc2VwYXJhdG9ycz0i4oir
IiBjbG9zZT0i4oiPIj4KKyAgICAgICAgPG1uPjA8L21uPgorICAgICAgICA8bW4+MTwvbW4+Cisg
ICAgICAgIDxtbj4yPC9tbj4KKyAgICAgIDwvbWZlbmNlZD4KKyAgICA8L21hdGg+CisKKyAgPC9i
b2R5PgorPC9odG1sPgo=
</data>
<flag name="review"
          id="346221"
          type_id="1"
          status="+"
          setter="alex"
    />
          </attachment>
      

    </bug>

</bugzilla>