Bug 324715

Summary:

[WebKit][Main] [b65f1f5687cf5bd8] ASAN_ILL in WebCore::TreeScopeOrderedMap::remove

Product:

WebKit

Reporter:

Tim Nguyen (:ntim) <ntim>

Component:

DOM

Assignee:

Luke Warlow <lwarlow>

Status:

RESOLVED DUPLICATE

Severity:

Normal

CC:

annevk, webkit-bug-importer

Priority:

Keywords:

InRadar

Version:

WebKit Nightly Build

Hardware:

Unspecified

OS:

Unspecified

Attachments:

Description	Flags
original fuzz testcase	none
testcase	none

Tim Nguyen (:ntim)

Reported 2026-09-21 10:48:19 PDT

rdar://186841090

Attachments
original fuzz testcase (826.11 KB, text/html) 2026-09-21 10:51 PDT, Tim Nguyen (:ntim)	no flags	Details
testcase (1.43 KB, text/html) 2026-09-21 10:51 PDT, Tim Nguyen (:ntim)	no flags	Details
View All Add attachment proposed patch, testcase, etc.

Tim Nguyen (:ntim)

Comment 1 2026-09-21 10:48:24 PDT

The attached testcase (/var/folders/pr/tbxd9lm57n93jflf52cm2ktc0000gn/T/webkit_fuzzer_llm_pkag2dvm/testcase.html) crashes a Release ASan build of WebKit Found by fuzzer WebKit-WebKitTestRunner-claudomato This crash was seen 43 times during the past 7 days. Testcase: ``` <!DOCTYPE html> <html> <head> <script> function runTest() { const pictureElement = document.getElementById("pictureElement"); const animateElement = document.getElementById("animateElement"); document.open(String.fromCharCode(81, 62, 55, 59, 102, 88, 50, 83, 89, 50, 84, 91, 121, 119, 36, 83, 60, 122, 75, 84), "htmlvar00009"); animateElement.moveBefore(pictureElement, null); } </script> </head> <body onload="runTest()"> <picture id="pictureElement" rowspan="0" aria-keyshortcuts=""5)m^\<3wH" sandbox="allow-top-navigation-by-user-activation" language="javascript" controls="controls"><source id="pictureSource" srcset="data:image/gif;base64,R0lGODlhIAAgAPIBAGbMzP///wAAADOZZpn/zAAAAAAAAAAAACH5BAAAAAAALAAAAAAgACAAAAOLGLrc/k7ISau9S5DNu/8fICgaYJ5oqqbDGJRrLAMtScw468J5Xr+3nm8XFM5+PGMMWYwxcMyZ40iULQaDhSzqDGBNisGyuhUDrmNb72pWcaXhtpsM/27pVi8UX96rcQpDf3V+QD12d4NKK2+Lc4qOKI2RJ5OUNHyXSDRYnZ6foKAuLxelphMQqaoPCQA7" type="image/png"><img id="pictureImage" src="x" bordercolor="white" style="-webkit-mask-size: 0px 1px; width: 1px auto; word-break: normal; text-decoration: 1px; background-position-x: 1svmin" referrerpolicy="origin-when-cross-origin" case="second" method="dialog"></picture> <animate id="animateElement" repeatCount="0.7035113304553267" to="currentColor" to="objectBoundingBox" to="0" onend="eventhandler2()" specularExponent="10" horiz-origin-x="1" markerWidth="1" diffuseConstant="1" mask-type="luminance" /> </body> </html> ``` Reproduced on: WebKit main @ 320455@main Does not reproduce on the SU branch Reproduction Command: DYLD_FRAMEWORK_PATH=$PWD DYLD_LIBRARY_PATH=$PWD __XPC_DYLD_FRAMEWORK_PATH=$PWD __XPC_DYLD_LIBRARY_PATH=$PWD ASAN_OPTIONS=handle_segv=2,handle_sigbus=2,handle_sigill=2,handle_abort=2,handle_sigtrap=2,allocator_may_return_null=1 __XPC_ASAN_OPTIONS=handle_segv=2,handle_sigbus=2,handle_sigill=2,handle_abort=2,handle_sigtrap=2,allocator_may_return_null=1 ./WebKitTestRunner --no-enable-all-experimental-feature --no-timeout testcase.html testcase.html Crash Log: AddressSanitizer:DEADLYSIGNAL ================================================================= ==41752==ERROR: AddressSanitizer: TRAP on unknown address 0x000145888c54 (pc 0x000145888c54 bp 0x00016f056a20 sp 0x00016f056a00 T0) #0 0x000145888c54 in WTFCrashWithInfo(int, char const*, char const*)+0x50 (WebCore:arm64e+0x1019cc54) #1 0x000135f12658 in WebCore::TreeScopeOrderedMap::remove(WTF::AtomString const&, WebCore::Element&)+0xae0 (WebCore:arm64e+0x826658) #2 0x0001420c5d1c in WebCore::TreeScope::removeElementById(WTF::AtomString const&, WebCore::Element&, bool)+0x64 (WebCore:arm64e+0xc9d9d1c) #3 0x0001394eb8ac in WebCore::Element::movingSteps(WebCore::Node::IsSubtreeRoot, WebCore::ContainerNode&)+0x7a8 (WebCore:arm64e+0x3dff8ac) #4 0x00013939e640 in WebCore::runMovingStepsForShadowIncludingInclusiveDescendants(WebCore::Node&, WebCore::Node&, WebCore::ContainerNode&, bool)+0x100 (WebCore:arm64e+0x3cb2640) #5 0x00013939bae8 in WebCore::ContainerNode::moveBefore(WebCore::Node&, WTF::RefPtr<WebCore::Node, WTF::RawPtrTraits<WebCore::Node>, WTF::DefaultRefDerefTraits<WebCore::Node>>&&)+0x18ac (WebCore:arm64e+0x3cafae8) #6 0x000139917bc4 in WebCore::jsElementPrototypeFunction_moveBefore(JSC::JSGlobalObject*, JSC::CallFrame*)+0x868 (WebCore:arm64e+0x422bbc4) #7 0x007000024140 (<unknown module>) #8 0x007000008084 (<unknown module>) #9 0x007000008064 (<unknown module>) #10 0x0070000084e4 (<unknown module>) #11 0x0001137c0370 in JSC::Interpreter::executeCall(JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::JSCell*, JSC::ArgList const&)+0xbb4 (JavaScriptCore:arm64e+0x154370) #12 0x0001154a0474 in JSC::call(JSC::JSGlobalObject*, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&)+0x1f8 (JavaScriptCore:arm64e+0x1e34474) #13 0x00011372a814 in JSC::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&)+0x1c0 (JavaScriptCore:arm64e+0xbe814) #14 0x000140c5dfa0 in WebCore::JSExecState::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&)+0x2c0 (WebCore:arm64e+0xb571fa0) #15 0x000135a99c60 in WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext&, WebCore::Event&)+0x14ac (WebCore:arm64e+0x3adc60) #16 0x000135a96bcc in WebCore::EventTarget::innerInvokeEventListeners(WebCore::Event&, WTF::Vector<WTF::Ref<WebCore::RegisteredEventListener, WTF::RawPtrTraits<WebCore::RegisteredEventListener>, WTF::DefaultRefDerefTraits<WebCore::RegisteredEventListener>>, 1ul, WTF::CrashOnOverflow, 2ul, WTF::FastMalloc>, WebCore::EventTarget::EventInvokePhase)+0x9b0 (WebCore:arm64e+0x3aabcc) Reproducibility: Original testcase: 25/25 (100.0%) - Average time: 2.17s Minimized testcase: 25/25 (100.0%) - Average time: 1.49s ------------------------------------- Fuzz-0 Triage: P2. Based on: ----------------- P2 ----------------- NULL pointer derefs (RELEASE_)ASSERTs in the WebContent Process --------------------------------------

Tim Nguyen (:ntim)

Comment 2 2026-09-21 10:51:12 PDT

Created attachment 481451 [details] original fuzz testcase

Tim Nguyen (:ntim)

Comment 3 2026-09-21 10:51:28 PDT

Created attachment 481452 [details] testcase

Anne van Kesteren

Comment 4 2026-09-29 04:58:35 PDT

*** This bug has been marked as a duplicate of bug 325616 ***

Note You need to log in before you can comment on or make changes to this bug.