Bug 237977

Summary: ASSERTION FAILED: !m_invoking in CustomElementQueue::add() on tv.youtube.com
Product: WebKit Reporter: Simon Fraser (smfr) <simon.fraser>
Component: DOMAssignee: Ryosuke Niwa <rniwa>
Status: RESOLVED FIXED    
Severity: Normal CC: cdumez, jcraig, rniwa, simon.fraser, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Crash log none

Description Simon Fraser (smfr) 2022-03-16 13:03:58 PDT 
Loading tv.youtube.com (logged in) quickly asserts here:

ASSERTION FAILED: !m_invoking
./dom/CustomElementReactionQueue.cpp(247) : void WebCore::CustomElementQueue::add(WebCore::Element &)
1   0x538bc7ed9 WTFCrash
2   0x54cb6716b WTFCrashWithInfo(int, char const*, char const*, int)
3   0x54fdf181c WebCore::CustomElementQueue::add(WebCore::Element&)
4   0x54fdf0610 WebCore::CustomElementReactionQueue::enqueueElementOnAppropriateElementQueue(WebCore::Element&)
5   0x54fdf104a WebCore::CustomElementReactionQueue::enqueueAttributeChangedCallbackIfNeeded(WebCore::Element&, WebCore::QualifiedName const&, WTF::AtomString const&, WTF::AtomString const&)
6   0x54ff05301 WebCore::Element::attributeChanged(WebCore::QualifiedName const&, WTF::AtomString const&, WTF::AtomString const&, WebCore::Element::AttributeModificationReason)
7   0x55006a800 WebCore::StyledElement::attributeChanged(WebCore::QualifiedName const&, WTF::AtomString const&, WTF::AtomString const&, WebCore::Element::AttributeModificationReason)
8   0x54ff0bd14 WebCore::Element::didAddAttribute(WebCore::QualifiedName const&, WTF::AtomString const&)
9   0x54ff0bc70 WebCore::Element::addAttributeInternal(WebCore::QualifiedName const&, WTF::AtomString const&, WebCore::Element::SynchronizationOfLazyAttribute)
10  0x54ff0494c WebCore::Element::setAttributeInternal(unsigned int, WebCore::QualifiedName const&, WTF::AtomString const&, WebCore::Element::SynchronizationOfLazyAttribute)
11  0x54ff04d22 WebCore::Element::setAttributeWithoutSynchronization(WebCore::QualifiedName const&, WTF::AtomString const&)
12  0x54d758aa8 WebCore::setJSElement_ariaLabelSetter(JSC::JSGlobalObject&, WebCore::JSElement&, JSC::JSValue)::'lambda'()::operator()() const
13  0x54d758a3d void WebCore::invokeFunctorPropagatingExceptionIfNecessary<WebCore::setJSElement_ariaLabelSetter(JSC::JSGlobalObject&, WebCore::JSElement&, JSC::JSValue)::'lambda'()>(JSC::JSGlobalObject&, JSC::ThrowScope&, WebCore::setJSElement_ariaLabelSetter(JSC::JSGlobalObject&, WebCore::JSElement&, JSC::JSValue)::'lambda'()&&)
14  0x54d7589e6 WebCore::setJSElement_ariaLabelSetter(JSC::JSGlobalObject&, WebCore::JSElement&, JSC::JSValue)
15  0x54d691696 bool WebCore::IDLAttribute<WebCore::JSElement>::set<&(WebCore::setJSElement_ariaLabelSetter(JSC::JSGlobalObject&, WebCore::JSElement&, JSC::JSValue)), (WebCore::CastedThisErrorBehavior)0>(JSC::JSGlobalObject&, long long, long long, JSC::PropertyName)
16  0x54d691515 WebCore::setJSElement_ariaLabel(JSC::JSGlobalObject*, long long, long long, JSC::PropertyName)
17  0x53a7efd44 JSC::JSObject::putInlineSlow(JSC::JSGlobalObject*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&)
18  0x53a7ef52c JSC::JSObject::putInlineForJSObject(JSC::JSCell*, JSC::JSGlobalObject*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&)
19  0x539e1a631 JSC::JSCell::putInline(JSC::JSGlobalObject*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&)
20  0x539e1b070 JSC::JSValue::putInline(JSC::JSGlobalObject*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&)
21  0x53a32b820 llint_slow_path_put_by_id
22  0x539273507 llint_entry
23  0x53928aea7 llint_entry
24  0x53928bf4b llint_entry
25  0x53928aea7 llint_entry
26  0x53928aea7 llint_entry
27  0x241a848d0bdb
28  0x241a8482389b
29  0x241a848b0c21
30  0x241a84a9a396
31  0x241a84a9b852
Comment 1 Simon Fraser (smfr) 2022-03-16 13:05:09 PDT 
Created attachment 454883 [details]
Crash log
Comment 2 Simon Fraser (smfr) 2022-03-16 13:05:21 PDT 
This is with trunk at r291330
Comment 3 Radar WebKit Bug Importer 2022-03-23 13:04:42 PDT 
<rdar://problem/90718851>
Comment 4 Ryosuke Niwa 2022-07-02 15:18:54 PDT 
I tried reproducing this assertion failure but couldn't.
Comment 5 Ryosuke Niwa 2022-07-15 23:14:12 PDT 
Ah, I see the problem now. AriaAttributes are missing CEReactions!
Comment 6 Ryosuke Niwa 2022-07-16 00:06:59 PDT 
Filed https://github.com/w3c/aria/issues/1767
Comment 7 Ryosuke Niwa 2022-07-16 01:16:40 PDT 
Pull request: https://github.com/WebKit/WebKit/pull/2486
Comment 8 EWS 2022-07-17 15:28:29 PDT 
Committed 252552@main (a0165aefca5b): <https://commits.webkit.org/252552@main>

Reviewed commits have been landed. Closing PR #2486 and removing active labels.
Comment 9 Ryosuke Niwa 2022-07-17 21:36:49 PDT 
*** Bug 231049 has been marked as a duplicate of this bug. ***