[Webkit-unassigned] [Bug 187802] New: ASSERTION !data.customElementReactionQueue() when creating custom element inside an SVG document

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Thu Jul 19 08:25:35 PDT 2018


https://bugs.webkit.org/show_bug.cgi?id=187802

            Bug ID: 187802
           Summary: ASSERTION !data.customElementReactionQueue() when
                    creating custom element inside an SVG document
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
               URL: https://w3c-test.org/custom-elements/parser/parser-use
                    s-create-an-element-for-a-token-svg.svg
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: HTML DOM
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: fred.wang at free.fr
                CC: cdumez at apple.com, rniwa at webkit.org, rwlbuis at gmail.com
            Blocks: 154907

Created attachment 345347

  --> https://bugs.webkit.org/attachment.cgi?id=345347&action=review

Minimal crash test

See the attached testcase.

#0  0x00007fcdb471cacc in WTFCrash ()
    at ../../Source/WTF/wtf/Assertions.cpp:267
#1  0x00007fcdc015af34 in (anonymous namespace)::Element::enqueueToUpgrade (
    this=0x7fcd2e000068, elementInterface=...)
    at ../../Source/WebCore/dom/Element.cpp:2010
#2  0x00007fcdc00973c3 in (anonymous namespace)::CustomElementReactionQueue::enqueueElementUpgradeIfDefined (element=...)
    at ../../Source/WebCore/dom/CustomElementReactionQueue.cpp:139
#3  0x00007fcdc0159cd1 in (anonymous namespace)::Element::insertedIntoAncestor
    (this=0x7fcd2e000068, insertionType=..., parentOfInsertedTree=...)
    at ../../Source/WebCore/dom/Element.cpp:1751
#4  0x00007fcdc0095e14 in (anonymous namespace)::notifyNodeInsertedIntoDocument
    (parentOfInsertedTree=..., node=..., 
    treeScopeChange=(anonymous namespace)::TreeScopeChange::Changed, 
    postInsertionNotificationTargets=...)
    at ../../Source/WebCore/dom/ContainerNodeAlgorithms.cpp:48
#5  0x00007fcdc00962df in (anonymous namespace)::notifyChildNodeInserted (
    parentOfInsertedTree=..., node=...)
    at ../../Source/WebCore/dom/ContainerNodeAlgorithms.cpp:103
#6  0x00007fcdc0098b65 in (anonymous namespace)::executeNodeInsertionWithScriptAssertion<WebCore::ContainerNode::parserAppendChild(WebCore::Node&)::<lambda()> >((anonymous namespace)::ContainerNode &, (anonymous namespace)::Node &, (anonymous namespace)::ContainerNode::ChildChangeSource, (anonymous namespace)::ReplacedAllChildren, (anonymous namespace)::ContainerNode::<lambda()>) (
    containerNode=..., child=..., 
    source=(anonymous namespace)::ContainerNode::ChildChangeSource::Parser, 
    replacedAllChildren=(anonymous namespace)::ReplacedAllChildren::No, 
    doNodeInsertion=...) at ../../Source/WebCore/dom/ContainerNode.cpp:186
#7  0x00007fcdc0094bf9 in (anonymous namespace)::ContainerNode::parserAppendChild (this=0x7fcd2e8001d0, newChild=...)
    at ../../Source/WebCore/dom/ContainerNode.cpp:723
#8  0x00007fcdc12e28b0 in (anonymous namespace)::XMLDocumentParser::startElementNs (this=0x7fcd30fd8b40, xmlLocalName=0x559de8bdce9a "my-element", 
    xmlPrefix=0x0, xmlURI=0x559de8bdce76 "http://www.w3.org/1999/xhtml", 
    numNamespaces=0, libxmlNamespaces=0x0, numAttributes=0, numDefaulted=0,


Referenced Bugs:

https://bugs.webkit.org/show_bug.cgi?id=154907
[Bug 154907] Implement custom elements API
-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20180719/d46704dc/attachment-0001.html>


More information about the webkit-unassigned mailing list