Changeset 263564 in webkit

Timestamp:

Jun 26, 2020 9:44:31 AM (4 years ago)

Author:

Jack Lee

Message:

ASSERTION FAILED: (it != m_map.end()) in TreeScopeOrderedMap::remove
​https://bugs.webkit.org/show_bug.cgi?id=213611
<rdar://problem/64493506>

Reviewed by Geoffrey Garen.

Source/WebCore:

In function HTMLImageElement::parseAttribute(), empty name attribute is considered valid
which makes the function skip handling of subsequent name changes. Modified the check of
name attribute so only non-empty name is considered valid. This code change is to match
<​https://trac.webkit.org/changeset/262360>.

Test: fast/images/img-change-name-assert.html

• html/HTMLImageElement.cpp:

(WebCore::HTMLImageElement::parseAttribute):

LayoutTests:

Added a regression test for the crash.

• fast/images/img-change-name-assert-expected.txt: Added.
• fast/images/img-change-name-assert.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/images/img-change-name-assert-expected.txt (added)
• LayoutTests/fast/images/img-change-name-assert.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/html/HTMLImageElement.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2020-06-26  Jack Lee  <shihchieh_lee@apple.com>
+
+        ASSERTION FAILED: (it != m_map.end()) in TreeScopeOrderedMap::remove
+        https://bugs.webkit.org/show_bug.cgi?id=213611
+        <rdar://problem/64493506>
+
+        Reviewed by Geoffrey Garen.
+
+        Added a regression test for the crash.
+
+        * fast/images/img-change-name-assert-expected.txt: Added.
+        * fast/images/img-change-name-assert.html: Added.
+
 2020-06-26  Karl Rackler  <rackler@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2020-06-26  Jack Lee  <shihchieh_lee@apple.com>
+
+        ASSERTION FAILED: (it != m_map.end()) in TreeScopeOrderedMap::remove
+        https://bugs.webkit.org/show_bug.cgi?id=213611
+        <rdar://problem/64493506>
+
+        Reviewed by Geoffrey Garen.
+
+        In function HTMLImageElement::parseAttribute(), empty name attribute is considered valid
+        which makes the function skip handling of subsequent name changes. Modified the check of 
+        name attribute so only non-empty name is considered valid. This code change is to match
+        <https://trac.webkit.org/changeset/262360>.
+
+        Test: fast/images/img-change-name-assert.html
+
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::parseAttribute):
+
 2020-06-26  Sihui Liu  <sihui_liu@apple.com>
 

trunk/Source/WebCore/html/HTMLImageElement.cpp

@@ -296 +296 @@
     } else {
         if (name == nameAttr) {
-            bool willHaveName = !value.isNull();
+            bool willHaveName = !value.isEmpty();
             if (m_hadNameBeforeAttributeChanged != willHaveName && isConnected() && !isInShadowTree() && is<HTMLDocument>(document())) {
                 HTMLDocument& document = downcast<HTMLDocument>(this->document());