225684 2021-05-11 19:25:38 -0700 REGRESSION: Release assert in SlotAssignment::assignedNodesForSlot via ComposedTreeIterator::traverseNextInShadowTree in Element::insertedIntoAncestor 2021-06-02 12:22:18 -0700 1 1 1 Unclassified WebKit DOM WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=224408 InRadar P2 Normal --- 148695 1 rniwa rniwa cdumez cgarcia darin esprehn+autocc ews-watchlist kangil.han koivisto zalan oldest_to_newest 1759138 0 rniwa 2021-05-11 19:25:38 -0700 e.g. Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.WebCore 0x00000001090fcdf3 WTFCrashWithInfo(int, char const*, char const*, int) + 19 1 com.apple.WebCore 0x000000010a3df43a WebCore::SlotAssignment::assignedNodesForSlot(WebCore::HTMLSlotElement const&, WebCore::ShadowRoot&) + 426 2 com.apple.WebCore 0x000000010a5e96d0 WebCore::HTMLSlotElement::assignedNodes() const + 64 3 com.apple.WebCore 0x000000010a301f1e WebCore::ComposedTreeIterator::traverseNextInShadowTree() + 222 4 com.apple.WebCore 0x000000010aeb019c WebCore::RenderTreeUpdater::tearDownRenderers(WebCore::Element&, WebCore::RenderTreeUpdater::TeardownType, WebCore::RenderTreeBuilder&) + 316 5 com.apple.WebCore 0x000000010a3e3031 WebCore::SlotAssignment::didChangeSlot(WTF::AtomString const&, WebCore::ShadowRoot&) + 257 6 com.apple.WebCore 0x000000010a36f4be WebCore::Element::insertedIntoAncestor(WebCore::Node::InsertionType, WebCore::ContainerNode&) + 270 7 com.apple.WebCore 0x000000010a3124fa WebCore::notifyNodeInsertedIntoDocument(WebCore::ContainerNode&, WebCore::Node&, WebCore::TreeScopeChange, WTF::Vector<WTF::Ref<WebCore::Node, WTF::RawPtrTraits<WebCore::Node> >, 11ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&) + 58 8 com.apple.WebCore 0x000000010a312382 WebCore::notifyChildNodeInserted(WebCore::ContainerNode&, WebCore::Node&) + 130 9 com.apple.WebCore 0x000000010a306016 WebCore::ContainerNode::appendChildWithoutPreInsertionValidityCheck(WebCore::Node&) + 998 10 com.apple.WebCore 0x000000010a3a812d WebCore::Node::appendChild(WebCore::Node&) + 93 11 com.apple.WebCore 0x0000000109744a0f WebCore::jsNodePrototypeFunction_appendChild(JSC::JSGlobalObject*, JSC::CallFrame*) + 223 <rdar://77799319> 1759142 1 428338 rniwa 2021-05-11 20:11:16 -0700 Created attachment 428338 Patch 1759161 2 428338 darin 2021-05-11 21:58:09 -0700 Comment on attachment 428338 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=428338&action=review > Source/WebCore/ChangeLog:14 > + the shadow root is conncted to a document but HTMLSlotElement isn't since its connected flag has not been updated yet. Typo in connected. 1759283 3 rniwa 2021-05-12 10:12:29 -0700 (In reply to Darin Adler from comment #2) > Comment on attachment 428338 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=428338&action=review > > > Source/WebCore/ChangeLog:14 > > + the shadow root is conncted to a document but HTMLSlotElement isn't since its connected flag has not been updated yet. > > Typo in connected. Fixed. Thanks for the review. 1759284 4 rniwa 2021-05-12 10:13:24 -0700 Committed r277373 (237631@main): <https://commits.webkit.org/237631@main> 428338 2021-05-11 20:11:16 -0700 2021-05-11 21:58:22 -0700 Patch bug-225684-20210511201115.patch text/plain 5113 rniwa U3VidmVyc2lvbiBSZXZpc2lvbjogMjc3MzE3CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggZTM5NWUzZjM4N2M2MTg2 NGNiNTNmNzBlYjRiZGUxNjZjNGU5ZmJmNy4uZWIxOTMxYjBiM2Q0OWY3OTE3ZWU4MTc5ZDUwNzFh MjNmNmUyMjMxYSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDIzIEBACisyMDIxLTA1LTExICBSeW9z dWtlIE5pd2EgIDxybml3YUB3ZWJraXQub3JnPgorCisgICAgICAgIFJFR1JFU1NJT046IFJlbGVh c2UgYXNzZXJ0IGluIFNsb3RBc3NpZ25tZW50Ojphc3NpZ25lZE5vZGVzRm9yU2xvdCB2aWEgQ29t cG9zZWRUcmVlSXRlcmF0b3I6OnRyYXZlcnNlTmV4dEluU2hhZG93VHJlZQorICAgICAgICBpbiBF bGVtZW50OjppbnNlcnRlZEludG9BbmNlc3RvcgorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0 Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjI1Njg0CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZ IChPT1BTISkuCisKKyAgICAgICAgVGhlIHJlbGVhc2UgYXNzZXJ0aW9uIGZhaWx1cmUgd2FzIGNh dXNlZCBieSBSZW5kZXJUcmVlVXBkYXRlcjo6dGVhckRvd25SZW5kZXJlcnMgZW5kIHVwIHRyYXZl cnNpbmcgdGhlIHBhcnRzIG9mIHRoZSBET00KKyAgICAgICAgZm9yIHdoaWNoIEVsZW1lbnQ6Omlu c2VydGVkSW50b0FuY2VzdG9yIGhhZCBub3QgYmVlbiBjYWxsZWQgeWV0LiBTaW5jZSBIVE1MU2xv dEVsZW1lbnQ6Omluc2VydGVkSW50b0FuY2VzdG9yIGlzIHdoZXJlCisgICAgICAgIFNsb3RBc3Np Z25tZW50OjpTbG90IGlzIHVwZGF0ZWQgZm9yIGEgbmV3bHkgaW5zZXJ0ZWQgc2xvdCwgU2xvdEFz c2lnbm1lbnQ6OlNsb3QgbWF5IG5vdCBjb250YWluIHRoaXMgc2xvdCBlbGVtZW50LgorCisgICAg ICAgIEZpeGVkIHRoZSBidWcgYnkgcmV0dXJuaW5nIGVhcmx5IGluIFNsb3RBc3NpZ25tZW50Ojph c3NpZ25lZE5vZGVzRm9yU2xvdCB3aGVuIHRoaXMgY29uZGl0aW9uIGhvbGRzLCB3aGljaCBpcyB3 aGVuCisgICAgICAgIHRoZSBzaGFkb3cgcm9vdCBpcyBjb25uY3RlZCB0byBhIGRvY3VtZW50IGJ1 dCBIVE1MU2xvdEVsZW1lbnQgaXNuJ3Qgc2luY2UgaXRzIGNvbm5lY3RlZCBmbGFnIGhhcyBub3Qg YmVlbiB1cGRhdGVkIHlldC4KKworICAgICAgICBUZXN0OiBmYXN0L3NoYWRvdy1kb20vaW5zZXJ0 LWhvc3QtY2hpbGQtd2l0aC1zbG90LXJlbmRlcmVyLXRlYXJkb3duLWNyYXNoLmh0bWwKKworICAg ICAgICAqIGRvbS9TbG90QXNzaWdubWVudC5jcHA6CisgICAgICAgIChXZWJDb3JlOjpTbG90QXNz aWdubWVudDo6YXNzaWduZWROb2Rlc0ZvclNsb3QpOgorCiAyMDIxLTA1LTEwICBXZW5zb24gSHNp ZWggIDx3ZW5zb25faHNpZWhAYXBwbGUuY29tPgogCiAgICAgICAgIFttYWNPU10gQWxsb3cgaW1t ZWRpYXRlIGFjdGlvbiBnZXN0dXJlcyB0byBiZWdpbiB3aGVuIGZvcmNlIGNsaWNraW5nIHRleHQg aW5zaWRlIGltYWdlIG92ZXJsYXlzCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9kb20vU2xv dEFzc2lnbm1lbnQuY3BwIGIvU291cmNlL1dlYkNvcmUvZG9tL1Nsb3RBc3NpZ25tZW50LmNwcApp bmRleCBlYmZkMDFkOGZlMGJlOWZlNGFmYTBlMmZjZjU3MTVjY2I2Y2Y2NTRmLi4xOGJmYjJmNzBi ZTk4YmE4NTM5ZDEyZDQ3Mjk0NmZmZDBjMWNkYWJlIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29y ZS9kb20vU2xvdEFzc2lnbm1lbnQuY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL2RvbS9TbG90QXNz aWdubWVudC5jcHAKQEAgLTMzMiw2ICszMzIsMTAgQEAgY29uc3QgVmVjdG9yPFdlYWtQdHI8Tm9k ZT4+KiBTbG90QXNzaWdubWVudDo6YXNzaWduZWROb2Rlc0ZvclNsb3QoY29uc3QgSFRNTFNsb3QK ICAgICBBU1NFUlQoc2xvdEVsZW1lbnQuY29udGFpbmluZ1NoYWRvd1Jvb3QoKSA9PSAmc2hhZG93 Um9vdCk7CiAgICAgY29uc3QgQXRvbVN0cmluZyYgc2xvdE5hbWUgPSBzbG90TmFtZUZyb21BdHRy aWJ1dGVWYWx1ZShzbG90RWxlbWVudC5hdHRyaWJ1dGVXaXRob3V0U3luY2hyb25pemF0aW9uKG5h bWVBdHRyKSk7CiAgICAgYXV0byogc2xvdCA9IG1fc2xvdHMuZ2V0KHNsb3ROYW1lKTsKKworICAg IGJvb2wgaGFzTm90Q2FsbGVkSW5zZXJ0ZWRJbnRvQW5jZXN0b3JPblNsb3QgPSBzaGFkb3dSb290 LmlzQ29ubmVjdGVkKCkgJiYgIXNsb3RFbGVtZW50LmlzQ29ubmVjdGVkKCk7CisgICAgaWYgKGhh c05vdENhbGxlZEluc2VydGVkSW50b0FuY2VzdG9yT25TbG90KQorICAgICAgICByZXR1cm4gbnVs bHB0cjsKICAgICBSRUxFQVNFX0FTU0VSVChzbG90KTsKIAogICAgIGlmICghbV9zbG90QXNzaWdu bWVudHNJc1ZhbGlkKQpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nIGIvTGF5b3V0 VGVzdHMvQ2hhbmdlTG9nCmluZGV4IDg5ZWY5YjEzNGQ5NzQ4NGFmOGFlMjQ4NjQyYzc1MjliYTVk ZTA5NmMuLjJkMWI3OGQxMDU2ODJmZDRkMmUxMzQxMTUzMmFjZjYzMTVlYWM5M2QgMTAwNjQ0Ci0t LSBhL0xheW91dFRlc3RzL0NoYW5nZUxvZworKysgYi9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKQEAg LTEsMyArMSwxNSBAQAorMjAyMS0wNS0xMSAgUnlvc3VrZSBOaXdhICA8cm5pd2FAd2Via2l0Lm9y Zz4KKworICAgICAgICBSRUdSRVNTSU9OOiBSZWxlYXNlIGFzc2VydCBpbiBTbG90QXNzaWdubWVu dDo6YXNzaWduZWROb2Rlc0ZvclNsb3QgdmlhIENvbXBvc2VkVHJlZUl0ZXJhdG9yOjp0cmF2ZXJz ZU5leHRJblNoYWRvd1RyZWUgaW4gRWxlbWVudDo6aW5zZXJ0ZWRJbnRvQW5jZXN0b3IKKyAgICAg ICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIyNTY4NAorCisgICAg ICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEFkZGVkIGEgcmVncmVz c2lvbiB0ZXN0LgorCisgICAgICAgICogZmFzdC9zaGFkb3ctZG9tL2luc2VydC1ob3N0LWNoaWxk LXdpdGgtc2xvdC1yZW5kZXJlci10ZWFyZG93bi1jcmFzaC1leHBlY3RlZC50eHQ6IEFkZGVkLgor ICAgICAgICAqIGZhc3Qvc2hhZG93LWRvbS9pbnNlcnQtaG9zdC1jaGlsZC13aXRoLXNsb3QtcmVu ZGVyZXItdGVhcmRvd24tY3Jhc2guaHRtbDogQWRkZWQuCisKIDIwMjEtMDUtMTAgIENocmlzIER1 bWV6ICA8Y2R1bWV6QGFwcGxlLmNvbT4KIAogICAgICAgICBbIG1hY09TIFJlbGVhc2Ugd2syIF0g aHR0cC90ZXN0cy9jYWNoZS1zdG9yYWdlL2NhY2hlLXJlY29yZHMtcGVyc2lzdGVuY3kuaHR0cHMu aHRtbCBpcyBmbGFreSBjcmFzaGluZwpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvZmFzdC9zaGFk b3ctZG9tL2luc2VydC1ob3N0LWNoaWxkLXdpdGgtc2xvdC1yZW5kZXJlci10ZWFyZG93bi1jcmFz aC1leHBlY3RlZC50eHQgYi9MYXlvdXRUZXN0cy9mYXN0L3NoYWRvdy1kb20vaW5zZXJ0LWhvc3Qt Y2hpbGQtd2l0aC1zbG90LXJlbmRlcmVyLXRlYXJkb3duLWNyYXNoLWV4cGVjdGVkLnR4dApuZXcg ZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwLi5lYTFmOWU2MDk2N2E4NTlhYTJhMDUxN2M4ODg3ZjY3MWMwYjczZGIyCi0tLSAvZGV2 L251bGwKKysrIGIvTGF5b3V0VGVzdHMvZmFzdC9zaGFkb3ctZG9tL2luc2VydC1ob3N0LWNoaWxk LXdpdGgtc2xvdC1yZW5kZXJlci10ZWFyZG93bi1jcmFzaC1leHBlY3RlZC50eHQKQEAgLTAsMCAr MSwzIEBACitUaGlzIHRlc3RzIGlmIFdlYktpdCBkb2VzIG5vdCBjcmFzaCBvciBoaXQgYW55IGFz c2VydGlvbnMuCisKK1BBU1MKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2Zhc3Qvc2hhZG93LWRv bS9pbnNlcnQtaG9zdC1jaGlsZC13aXRoLXNsb3QtcmVuZGVyZXItdGVhcmRvd24tY3Jhc2guaHRt bCBiL0xheW91dFRlc3RzL2Zhc3Qvc2hhZG93LWRvbS9pbnNlcnQtaG9zdC1jaGlsZC13aXRoLXNs b3QtcmVuZGVyZXItdGVhcmRvd24tY3Jhc2guaHRtbApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRl eCAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwLi5lMWIzYTJlYjFmMGE3 NGZkN2JiZDIwODI2NjUyYzhmNzNmNjRmMzMxCi0tLSAvZGV2L251bGwKKysrIGIvTGF5b3V0VGVz dHMvZmFzdC9zaGFkb3ctZG9tL2luc2VydC1ob3N0LWNoaWxkLXdpdGgtc2xvdC1yZW5kZXJlci10 ZWFyZG93bi1jcmFzaC5odG1sCkBAIC0wLDAgKzEsMjkgQEAKKzwhRE9DVFlQRSBodG1sPgorPGh0 bWw+Cis8Ym9keT4KKzxwPlRoaXMgdGVzdHMgaWYgV2ViS2l0IGRvZXMgbm90IGNyYXNoIG9yIGhp dCBhbnkgYXNzZXJ0aW9ucy48L3A+Cis8c2NyaXB0PgorCitpZiAod2luZG93LnRlc3RSdW5uZXIp CisgICAgdGVzdFJ1bm5lci5kdW1wQXNUZXh0KCk7CisKK2NvbnN0IGhvc3QgPSBkb2N1bWVudC5j cmVhdGVFbGVtZW50KCdkaXYnKTsKK2RvY3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQoaG9zdCk7Citj b25zdCBzaGFkb3dSb290ID0gaG9zdC5hdHRhY2hTaGFkb3coe21vZGU6ICdjbG9zZWQnfSk7Citz aGFkb3dSb290LmlubmVySFRNTCA9ICc8ZGl2IGlkPSJpbm5lciI+PHNsb3QgbmFtZT0ic29tZS1u YW1lIj48L3Nsb3Q+PC9kaXY+JzsKKworY29uc3QgaW5uZXJIb3N0ID0gc2hhZG93Um9vdC5nZXRF bGVtZW50QnlJZCgnaW5uZXInKTsKK2NvbnN0IGlubmVyU2hhZG93Um9vdCA9IGlubmVySG9zdC5h dHRhY2hTaGFkb3coe21vZGU6ICdjbG9zZWQnfSk7Citpbm5lclNoYWRvd1Jvb3QuYXBwZW5kQ2hp bGQoZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgnc2xvdCcpKTsKK2lubmVySG9zdC5nZXRCb3VuZGlu Z0NsaWVudFJlY3QoKTsKKworc2hhZG93Um9vdC5xdWVyeVNlbGVjdG9yKCdzbG90JykucmVtb3Zl KCk7Citjb25zdCBuZXdDaGlsZCA9IGRvY3VtZW50LmNyZWF0ZUVsZW1lbnQoJ2RpdicpOworbmV3 Q2hpbGQuYXBwZW5kQ2hpbGQoZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgnc2xvdCcpKTsKK2lubmVy SG9zdC5hcHBlbmRDaGlsZChuZXdDaGlsZCk7CisKK2RvY3VtZW50LndyaXRlKCc8ZGl2PlBBU1M8 L2Rpdj4nKTsKKworPC9zY3JpcHQ+Cis8L2JvZHk+Cis8L2h0bWw+Cg==