Title: [263564] trunk
- Revision
- 263564
- Author
- [email protected]
- Date
- 2020-06-26 09:44:31 -0700 (Fri, 26 Jun 2020)
Log Message
ASSERTION FAILED: (it != m_map.end()) in TreeScopeOrderedMap::remove
https://bugs.webkit.org/show_bug.cgi?id=213611
<rdar://problem/64493506>
Reviewed by Geoffrey Garen.
Source/WebCore:
In function HTMLImageElement::parseAttribute(), empty name attribute is considered valid
which makes the function skip handling of subsequent name changes. Modified the check of
name attribute so only non-empty name is considered valid. This code change is to match
<https://trac.webkit.org/changeset/262360>.
Test: fast/images/img-change-name-assert.html
* html/HTMLImageElement.cpp:
(WebCore::HTMLImageElement::parseAttribute):
LayoutTests:
Added a regression test for the crash.
* fast/images/img-change-name-assert-expected.txt: Added.
* fast/images/img-change-name-assert.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (263563 => 263564)
--- trunk/LayoutTests/ChangeLog 2020-06-26 16:41:15 UTC (rev 263563)
+++ trunk/LayoutTests/ChangeLog 2020-06-26 16:44:31 UTC (rev 263564)
@@ -1,3 +1,16 @@
+2020-06-26 Jack Lee <[email protected]>
+
+ ASSERTION FAILED: (it != m_map.end()) in TreeScopeOrderedMap::remove
+ https://bugs.webkit.org/show_bug.cgi?id=213611
+ <rdar://problem/64493506>
+
+ Reviewed by Geoffrey Garen.
+
+ Added a regression test for the crash.
+
+ * fast/images/img-change-name-assert-expected.txt: Added.
+ * fast/images/img-change-name-assert.html: Added.
+
2020-06-26 Karl Rackler <[email protected]>
Remove expectation for http/tests/security/contentSecurityPolicy/upgrade-insecure-requests/upgrade-insecure-fetch-in-main-frame.html and http/tests/security/contentSecurityPolicy/upgrade-insecure-requests/upgrade-insecure-fetch-in-worker.html as they are passing.
Added: trunk/LayoutTests/fast/images/img-change-name-assert-expected.txt (0 => 263564)
--- trunk/LayoutTests/fast/images/img-change-name-assert-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/images/img-change-name-assert-expected.txt 2020-06-26 16:44:31 UTC (rev 263564)
@@ -0,0 +1 @@
+"Tests changing name of an image element. The test passes if WebKit doesn't crash or hit an ssertion."
Added: trunk/LayoutTests/fast/images/img-change-name-assert.html (0 => 263564)
--- trunk/LayoutTests/fast/images/img-change-name-assert.html (rev 0)
+++ trunk/LayoutTests/fast/images/img-change-name-assert.html 2020-06-26 16:44:31 UTC (rev 263564)
@@ -0,0 +1,8 @@
+<body><image id=img name=""></image><span>"Tests changing name of an image element. The test passes if WebKit doesn't crash or hit an ssertion."</span>
+<script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+
+ img.name = "new name";
+ img.remove();
+</script>
Modified: trunk/Source/WebCore/ChangeLog (263563 => 263564)
--- trunk/Source/WebCore/ChangeLog 2020-06-26 16:41:15 UTC (rev 263563)
+++ trunk/Source/WebCore/ChangeLog 2020-06-26 16:44:31 UTC (rev 263564)
@@ -1,3 +1,21 @@
+2020-06-26 Jack Lee <[email protected]>
+
+ ASSERTION FAILED: (it != m_map.end()) in TreeScopeOrderedMap::remove
+ https://bugs.webkit.org/show_bug.cgi?id=213611
+ <rdar://problem/64493506>
+
+ Reviewed by Geoffrey Garen.
+
+ In function HTMLImageElement::parseAttribute(), empty name attribute is considered valid
+ which makes the function skip handling of subsequent name changes. Modified the check of
+ name attribute so only non-empty name is considered valid. This code change is to match
+ <https://trac.webkit.org/changeset/262360>.
+
+ Test: fast/images/img-change-name-assert.html
+
+ * html/HTMLImageElement.cpp:
+ (WebCore::HTMLImageElement::parseAttribute):
+
2020-06-26 Sihui Liu <[email protected]>
Text manipulation should observe adjacent elements with new renderer together
Modified: trunk/Source/WebCore/html/HTMLImageElement.cpp (263563 => 263564)
--- trunk/Source/WebCore/html/HTMLImageElement.cpp 2020-06-26 16:41:15 UTC (rev 263563)
+++ trunk/Source/WebCore/html/HTMLImageElement.cpp 2020-06-26 16:44:31 UTC (rev 263564)
@@ -295,7 +295,7 @@
loadDeferredImage();
} else {
if (name == nameAttr) {
- bool willHaveName = !value.isNull();
+ bool willHaveName = !value.isEmpty();
if (m_hadNameBeforeAttributeChanged != willHaveName && isConnected() && !isInShadowTree() && is<HTMLDocument>(document())) {
HTMLDocument& document = downcast<HTMLDocument>(this->document());
const AtomString& id = getIdAttribute();
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
