| Summary: | ASSERTION FAILED: (it != m_map.end()) in TreeScopeOrderedMap::remove | ||||||
|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Jack <shihchieh_lee> | ||||
| Component: | Images | Assignee: | Jack <shihchieh_lee> | ||||
| Status: | RESOLVED FIXED | ||||||
| Severity: | Normal | CC: | cdumez, changseok, esprehn+autocc, ews-watchlist, ggaren, gyuyoung.kim, mjs, rwlbuis | ||||
| Priority: | P2 | Keywords: | InRadar | ||||
| Version: | WebKit Nightly Build | ||||||
| Hardware: | All | ||||||
| OS: | All | ||||||
| Attachments: |
|
||||||
|
Description
Jack
2020-06-25 11:23:47 PDT
<rdar::/64493506> Test case:
<body><image id=img name=""></image>
<script>
img.name = "new name";
img.remove();
</script>
Cause of the crash:
1. Initially image element has an empty name so image's ID is not added to document's named item hash map. This is a behavior change after https://bugs.webkit.org/show_bug.cgi?id=212473.
2. Next we change image's name attribute in the script and add image's name to document's named item hash map. However, image's ID is still not added[1].
3. When we remove the image element, we try to remove image's ID from named item hash map because its name attribute is not empty. Since the ID was never added, it triggers the assertion in TreeScopeOrderedMap::remove().
Note:
[1] The reason we do not add image's ID in step #2:
Function HTMLImageElement::parseAttribute() is called multiple times in the test to check for valid name attribute and to add image's ID to document's named item. Once a valid name attribute is found, the function does not attempt to add ID anymore.
However, this part of code was not changed in bug 212473. We still consider empty name a valid attribute. Therefore, the first time HTMLImageElement::parseAttribute() is called when image has an empty name attribute, the function set a flag that denotes a valid name is found, and therefore ignore subsequent name changes.
Although the empty name is considered valid, image's ID was still not added to named item the first time, since another condition was not matched -- the node was not inserted when parseAttribute() is called at the first time.
Created attachment 402798 [details]
Patch
Comment on attachment 402798 [details]
Patch
r=me
Committed r263564: <https://trac.webkit.org/changeset/263564> All reviewed patches have been landed. Closing bug and clearing flags on attachment 402798 [details]. |