[Webkit-unassigned] [Bug 213611] New: ASSERTION FAILED: (it != m_map.end()) in TreeScopeOrderedMap::remove

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=213611

            Bug ID: 213611
           Summary: ASSERTION FAILED: (it != m_map.end()) in
                    TreeScopeOrderedMap::remove
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: All
                OS: All
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: Images
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: shihchieh_lee at apple.com

0   com.apple.JavaScriptCore            0x0000000115e611be WTFCrash + 14 (Assertions.cpp:293)
1   com.apple.JavaScriptCore            0x0000000115e611ce WTFCrashWithSecurityImplication + 14
2   com.apple.WebCore                   0x000000013cb07316 WebCore::TreeScopeOrderedMap::remove(WTF::AtomStringImpl const&, WebCore::Element&) + 694 (TreeScopeOrderedMap.cpp:81)
3   com.apple.WebCore                   0x000000013d06ff1e WebCore::HTMLDocument::removeDocumentNamedItem(WTF::AtomStringImpl const&, WebCore::Element&) + 46 (HTMLDocument.cpp:171)
4   com.apple.WebCore                   0x000000013c77fe2f WebCore::Element::updateIdForDocument(WebCore::HTMLDocument&, WTF::AtomString const&, WTF::AtomString const&, WebCore::Element::HTMLDocumentNamedItemMapsUpdatingCondition) + 687 (Element.cpp:4079)
5   com.apple.WebCore                   0x000000013c780946 WebCore::Element::removedFromAncestor(WebCore::Node::RemovalType, WebCore::ContainerNode&) + 1430 (Element.cpp:2208)
6   com.apple.WebCore                   0x000000013d1050e8 WebCore::HTMLImageElement::removedFromAncestor(WebCore::Node::RemovalType, WebCore::ContainerNode&) + 1160 (HTMLImageElement.cpp:463)
7   com.apple.WebCore                   0x000000013c4e97f4 WebCore::notifyNodeRemovedFromDocument(WebCore::ContainerNode&, WebCore::TreeScopeChange, WebCore::Node&) + 1076 (ContainerNodeAlgorithms.cpp:116)
8   com.apple.WebCore                   0x000000013c4e92ed WebCore::notifyChildNodeRemoved(WebCore::ContainerNode&, WebCore::Node&) + 445 (ContainerNodeAlgorithms.cpp:161)
9   com.apple.WebCore                   0x000000013c4def8d WebCore::ContainerNode::removeNodeWithScriptAssertion(WebCore::Node&, WebCore::ContainerNode::ChildChangeSource) + 1533 (ContainerNode.cpp:169)
10  com.apple.WebCore                   0x000000013c4ddd89 WebCore::ContainerNode::removeChild(WebCore::Node&) + 681 (ContainerNode.cpp:577)
11  com.apple.WebCore                   0x000000013c950873 WebCore::Node::remove() + 115 (Node.cpp:629)
12  com.apple.WebCore                   0x0000000137478fd0 WebCore::jsElementPrototypeFunctionRemoveBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSElement*, JSC::ThrowScope&) + 448 (JSElement.cpp:4742)

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20200625/5273e97a/attachment.htm>