Bug 253990

Summary:	Regression: svg/text/modify-text-node-in-tspan.html is flaky crashing
Product:	WebKit	Reporter:	Chris Dumez <cdumez>
Component:	WebCore Misc.	Assignee:	Chris Dumez <cdumez>
Status:	RESOLVED FIXED
Severity:	Normal	CC:	rniwa, simon.fraser, webkit-bug-importer
Priority:	P2	Keywords:	InRadar
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified

Description Chris Dumez 2023-03-15 16:34:17 PDT

svg/text/modify-text-node-in-tspan.html is flaky crashing on the bots:
ASSERTION FAILED: m_ptr
/Volumes/Data/worker/Apple-Ventura-Debug-Build/build/WebKitBuild/Debug/usr/local/include/wtf/Ref.h(116) : T *WTF::Ref<WebCore::Document>::ptr() const [T = WebCore::Document, Traits = WTF::RawPtrTraits<WebCore::Document>]
1   0x8343fa7b9 WTFCrash
2   0x7f331439b WTFCrashWithInfo(int, char const*, char const*, int)
3   0x7f4209328 WTF::Ref<WebCore::Document, WTF::RawPtrTraits<WebCore::Document> >::ptr() const
4   0x7f7304d32 WebCore::Range::nodeChildrenWillBeRemoved(WebCore::ContainerNode&)
5   0x7f70e8430 WebCore::Document::nodeChildrenWillBeRemoved(WebCore::ContainerNode&)
6   0x7f705beff WebCore::ContainerNode::removeAllChildrenWithScriptAssertion(WebCore::ContainerNode::ChildChange::Source, WTF::Vector<WTF::Ref<WebCore::Node, WTF::RawPtrTraits<WebCore::Node> >, 11ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&, WebCore::ContainerNode::DeferChildrenChanged)
7   0x7f705ff31 WebCore::ContainerNode::removeChildren()
8   0x7f97156c5 WebCore::SVGUseElement::clearShadowTree()
9   0x7f9715660 WebCore::SVGUseElement::removedFromAncestor(WebCore::Node::RemovalType, WebCore::ContainerNode&)
10  0x7f7063198 WebCore::notifyNodeRemovedFromDocument(WebCore::ContainerNode&, WebCore::TreeScopeChange, WebCore::Node&)
11  0x7f7063277 WebCore::notifyNodeRemovedFromDocument(WebCore::ContainerNode&, WebCore::TreeScopeChange, WebCore::Node&)
12  0x7f706302c WebCore::notifyChildNodeRemoved(WebCore::ContainerNode&, WebCore::Node&)
13  0x7f705c6e5 WebCore::removeDetachedChildrenInContainer(WebCore::ContainerNode&)
14  0x7f705c4fc WebCore::ContainerNode::removeDetachedChildren()
15  0x7f70c886d WebCore::Document::removedLastRef()
16  0x7f72bfa54 WebCore::Node::removedLastRef()
17  0x7f3714b9c WebCore::Node::deref() const
18  0x7f3df8819 WTF::Ref<WebCore::Document, WTF::RawPtrTraits<WebCore::Document> >::~Ref()
19  0x7f3df84b5 WTF::Ref<WebCore::Document, WTF::RawPtrTraits<WebCore::Document> >::~Ref()
20  0x7f72fe355 WebCore::Range::~Range()
21  0x7f72fe3f5 WebCore::Range::~Range()
22  0x7f72fe419 WebCore::Range::~Range()
23  0x7f3a2378c std::__1::default_delete<WebCore::AbstractRange>::operator()(WebCore::AbstractRange*) const
24  0x7f3a23707 WTF::RefCounted<WebCore::AbstractRange, std::__1::default_delete<WebCore::AbstractRange> >::deref() const
25  0x7f3a2368d WTF::Ref<WebCore::AbstractRange, WTF::RawPtrTraits<WebCore::AbstractRange> >::~Ref()
26  0x7f3a23645 WTF::Ref<WebCore::AbstractRange, WTF::RawPtrTraits<WebCore::AbstractRange> >::~Ref()
27  0x7f3a23629 WebCore::JSDOMWrapper<WebCore::AbstractRange, WTF::RawPtrTraits<WebCore::AbstractRange> >::~JSDOMWrapper()
28  0x7f3a23605 WebCore::JSAbstractRange::~JSAbstractRange()
29  0x7f39b8085 WebCore::JSAbstractRange::~JSAbstractRange()
30  0x7f39b7a4d WebCore::JSAbstractRange::destroy(JSC::JSCell*)
31  0x83625f297 JSC::JSDestructibleObjectDestroyFunc::operator()(JSC::VM&, JSC::JSCell*) const

Comment 1 Chris Dumez 2023-03-15 16:43:32 PDT

Could be a regression from 261586@main.

Comment 2 Chris Dumez 2023-03-15 18:20:01 PDT

Pull request: https://github.com/WebKit/WebKit/pull/11587

Comment 3 EWS 2023-03-15 20:17:24 PDT

Committed 261729@main (eb77502aa6c9): <https://commits.webkit.org/261729@main>

Reviewed commits have been landed. Closing PR #11587 and removing active labels.

Comment 4 Radar WebKit Bug Importer 2023-03-15 20:18:17 PDT

<rdar://problem/106788030>