[Webkit-unassigned] [Bug 187802] New: ASSERTION !data.customElementReactionQueue() when creating custom element inside an SVG document
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Thu Jul 19 08:25:35 PDT 2018
https://bugs.webkit.org/show_bug.cgi?id=187802
Bug ID: 187802
Summary: ASSERTION !data.customElementReactionQueue() when
creating custom element inside an SVG document
Product: WebKit
Version: WebKit Nightly Build
Hardware: Unspecified
URL: https://w3c-test.org/custom-elements/parser/parser-use
s-create-an-element-for-a-token-svg.svg
OS: Unspecified
Status: NEW
Severity: Normal
Priority: P2
Component: HTML DOM
Assignee: webkit-unassigned at lists.webkit.org
Reporter: fred.wang at free.fr
CC: cdumez at apple.com, rniwa at webkit.org, rwlbuis at gmail.com
Blocks: 154907
Created attachment 345347
--> https://bugs.webkit.org/attachment.cgi?id=345347&action=review
Minimal crash test
See the attached testcase.
#0 0x00007fcdb471cacc in WTFCrash ()
at ../../Source/WTF/wtf/Assertions.cpp:267
#1 0x00007fcdc015af34 in (anonymous namespace)::Element::enqueueToUpgrade (
this=0x7fcd2e000068, elementInterface=...)
at ../../Source/WebCore/dom/Element.cpp:2010
#2 0x00007fcdc00973c3 in (anonymous namespace)::CustomElementReactionQueue::enqueueElementUpgradeIfDefined (element=...)
at ../../Source/WebCore/dom/CustomElementReactionQueue.cpp:139
#3 0x00007fcdc0159cd1 in (anonymous namespace)::Element::insertedIntoAncestor
(this=0x7fcd2e000068, insertionType=..., parentOfInsertedTree=...)
at ../../Source/WebCore/dom/Element.cpp:1751
#4 0x00007fcdc0095e14 in (anonymous namespace)::notifyNodeInsertedIntoDocument
(parentOfInsertedTree=..., node=...,
treeScopeChange=(anonymous namespace)::TreeScopeChange::Changed,
postInsertionNotificationTargets=...)
at ../../Source/WebCore/dom/ContainerNodeAlgorithms.cpp:48
#5 0x00007fcdc00962df in (anonymous namespace)::notifyChildNodeInserted (
parentOfInsertedTree=..., node=...)
at ../../Source/WebCore/dom/ContainerNodeAlgorithms.cpp:103
#6 0x00007fcdc0098b65 in (anonymous namespace)::executeNodeInsertionWithScriptAssertion<WebCore::ContainerNode::parserAppendChild(WebCore::Node&)::<lambda()> >((anonymous namespace)::ContainerNode &, (anonymous namespace)::Node &, (anonymous namespace)::ContainerNode::ChildChangeSource, (anonymous namespace)::ReplacedAllChildren, (anonymous namespace)::ContainerNode::<lambda()>) (
containerNode=..., child=...,
source=(anonymous namespace)::ContainerNode::ChildChangeSource::Parser,
replacedAllChildren=(anonymous namespace)::ReplacedAllChildren::No,
doNodeInsertion=...) at ../../Source/WebCore/dom/ContainerNode.cpp:186
#7 0x00007fcdc0094bf9 in (anonymous namespace)::ContainerNode::parserAppendChild (this=0x7fcd2e8001d0, newChild=...)
at ../../Source/WebCore/dom/ContainerNode.cpp:723
#8 0x00007fcdc12e28b0 in (anonymous namespace)::XMLDocumentParser::startElementNs (this=0x7fcd30fd8b40, xmlLocalName=0x559de8bdce9a "my-element",
xmlPrefix=0x0, xmlURI=0x559de8bdce76 "http://www.w3.org/1999/xhtml",
numNamespaces=0, libxmlNamespaces=0x0, numAttributes=0, numDefaulted=0,
Referenced Bugs:
https://bugs.webkit.org/show_bug.cgi?id=154907
[Bug 154907] Implement custom elements API
--
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20180719/d46704dc/attachment-0001.html>
More information about the webkit-unassigned
mailing list