[Webkit-unassigned] [Bug 172473] New: ASSERTION FAILED: tokens.find(item) == notFound in WebCore::DOMTokenList::replace

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=172473

            Bug ID: 172473
           Summary: ASSERTION FAILED: tokens.find(item) == notFound in
                    WebCore::DOMTokenList::replace
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: New Bugs
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: ryanhaddad at apple.com

Created attachment 310920

  --> https://bugs.webkit.org/attachment.cgi?id=310920&action=review

Crash log

This assertion failure is seen with imported/w3c/web-platform-tests/dom/nodes/Element-classlist.html, which was updated as part of https://trac.webkit.org/changeset/217225/webkit

ASSERTION FAILED: tokens.find(item) == notFound
/Volumes/Data/slave/sierra-debug/build/Source/WebCore/html/DOMTokenList.cpp(182) : ExceptionOr<void> WebCore::DOMTokenList::replace(const WTF::AtomicString &, const WTF::AtomicString &)
1   0x119953a5d WTFCrash
2   0x10de042de WebCore::DOMTokenList::replace(WTF::AtomicString const&, WTF::AtomicString const&)
3   0x10e930afb WebCore::jsDOMTokenListPrototypeFunctionReplaceCaller(JSC::ExecState*, WebCore::JSDOMTokenList*, JSC::ThrowScope&)
4   0x10e92e1d2 long long WebCore::BindingCaller<WebCore::JSDOMTokenList>::callOperation<&(WebCore::jsDOMTokenListPrototypeFunctionReplaceCaller(JSC::ExecState*, WebCore::JSDOMTokenList*, JSC::ThrowScope&)), (WebCore::CastedThisErrorBehavior)0>(JSC::ExecState*, char const*)
5   0x10e92df28 WebCore::jsDOMTokenListPrototypeFunctionReplace(JSC::ExecState*)
6   0x34c23a801028
7   0x34c23abf3a54
8   0x34c23ac0c911
9   0x34c23ac08015
10  0x34c23abf4c66
11  0x1194ad4b7 llint_entry
12  0x1194ad531 llint_entry
13  0x1194ad531 llint_entry
14  0x1194a5dee vmEntryToJavaScript
15  0x119275c4e JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*)
16  0x1192258fd JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::ExecState*, JSC::JSObject*)
17  0x118a8a648 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&)
18  0x118a8a810 JSC::profiledEvaluate(JSC::ExecState*, JSC::ProfilingReason, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&)
19  0x10fc68e4b WebCore::JSMainThreadExecState::profiledEvaluate(JSC::ExecState*, JSC::ProfilingReason, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&)
20  0x10fc68c38 WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld&, WebCore::ExceptionDetails*)
21  0x10fc68f2d WebCore::ScriptController::evaluate(WebCore::ScriptSourceCode const&, WebCore::ExceptionDetails*)
22  0x10fc7ec02 WebCore::ScriptElement::executeClassicScript(WebCore::ScriptSourceCode const&)
23  0x10fc7cfdf WebCore::ScriptElement::prepareScript(WTF::TextPosition const&, WebCore::ScriptElement::LegacyTypeSupport)
24  0x10e388750 WebCore::HTMLScriptRunner::runScript(WebCore::ScriptElement&, WTF::TextPosition const&)
25  0x10e3885bf WebCore::HTMLScriptRunner::execute(WTF::Ref<WebCore::ScriptElement>&&, WTF::TextPosition const&)
26  0x10e2a7a62 WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder()
27  0x10e2a7fc3 WebCore::HTMLDocumentParser::pumpTokenizerLoop(WebCore::HTMLDocumentParser::SynchronousMode, bool, WebCore::PumpSession&)
28  0x10e2a6d08 WebCore::HTMLDocumentParser::pumpTokenizer(WebCore::HTMLDocumentParser::SynchronousMode)
29  0x10e2a685b WebCore::HTMLDocumentParser::pumpTokenizerIfPossible(WebCore::HTMLDocumentParser::SynchronousMode)
30  0x10e2a99d9 WebCore::HTMLDocumentParser::resumeParsingAfterScriptExecution()
31  0x10e2a9dee WebCore::HTMLDocumentParser::notifyFinished(WebCore::PendingScript&)

https://build.webkit.org/results/Apple%20Sierra%20Debug%20WK2%20(Tests)/r217232%20(1141)/results.html

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20170522/75a7af7f/attachment-0001.html>