[Webkit-unassigned] [Bug 181091] REGRESSION: [iOS] ASSERTION FAILED: !node.isConnected() in WebCore::notifyNodeInsertedIntoDocument

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=181091

--- Comment #3 from Jer Noble <jer.noble at apple.com> ---
(In reply to Ryan Haddad from comment #1)
> Flakiness dashboard blames
> https://trac.webkit.org/log/webkit/?verbose=on&rev=226154&stop_rev=226150
> 
> https://trac.webkit.org/changeset/226150/webkit is the only one out of those
> changes that seems like it could be responsible.

Here's the diagnosis:

In HTMLMediaElement::insertedIntoAncestor(), we call prepareForLoad(), which calls configureMediaControls(), which calls ensureMediaControlsShadowRoot(), which adds the ShadowRoot to the media element.  But this is happening half-way through notifyNodeInsertedIntoDocument(), the end of which tries to notify all the node's children that they've been inserted. However, due to ensureMediaControlsShadowRoot(), the root has already been notified, and has it's flag set, hence the ASSERTion.

This doesn't happen on Mac because prepareForLoad() and selectMediaResource() are called when the src= attribute is parsed. On iOS, loading isn't permitted without a user gesture, and selectMediaResource() isn't called, which doesn't set m_networkState to NETWORK_NO_SOURCE. So when the insertion into the document happens, m_networkState is still NETWORK_EMPTY, and we call prepareForLoad() again.

The short-term solution is to not try to create the media controls until the element is fully in the document. Luckily, that code already exists in HTMLMediaElement::didFinishInsertingNode().

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20171221/03806569/attachment.html>