Bug 255381

Summary: ASSERTION FAILED: !m_count on http/tests/misc/image-blocked-src-change.html, flakily
Product: WebKit Reporter: Fujii Hironori <Hironori.Fujii>
Component: DOMAssignee: Nobody <webkit-unassigned>
Status: RESOLVED DUPLICATE    
Severity: Normal CC: ap, cdumez, chirag_m_shah, rniwa, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
See Also: https://bugs.webkit.org/show_bug.cgi?id=207226
Attachments:
Description Flags
image-blocked-src-change-crash-log.txt
none
WinCairo crash log for http/tests/misc/image-blocked-src-change.html none

Description Fujii Hironori 2023-04-12 18:11:58 PDT 
http/tests/misc/image-blocked-src-change.html is randomly crashing

https://results.webkit.org/?suite=layout-tests&test=http%2Ftests%2Fmisc%2Fimage-blocked-src-change.html

https://build.webkit.org/results/Apple-iPadOS-16-Simulator-Debug-WK2-Tests/262483@main%20(1103)/results.html

ASSERTION FAILED: !m_count
/Volumes/Data/worker/Apple-iOS-16-Simulator-Debug-Build/build/WebKitBuild/Debug-iphonesimulator/usr/local/include/wtf/CheckedRef.h(242) : WTF::CanMakeCheckedPtrBase<WTF::SingleThreadIntegralWrapper<unsigned int>, unsigned int>::~CanMakeCheckedPtrBase() [StorageType = WTF::SingleThreadIntegralWrapper<unsigned int>, PtrCounterType = unsigned int]
1   0x5878f4419 WTFCrash
2   0x5b7a1ab8b WTFCrashWithInfo(int, char const*, char const*, int)
3   0x5bb75549b WTF::CanMakeCheckedPtrBase<WTF::SingleThreadIntegralWrapper<unsigned int>, unsigned int>::~CanMakeCheckedPtrBase()
4   0x5bb847987 WebCore::ScriptExecutionContext::~ScriptExecutionContext()
5   0x5bb5fa60c WebCore::Document::~Document()
6   0x5bbb9028f WebCore::HTMLDocument::~HTMLDocument()
7   0x5bbb902b5 WebCore::HTMLDocument::~HTMLDocument()
8   0x5bbb90399 WebCore::HTMLDocument::~HTMLDocument()
9   0x5bb5fc8c3 WebCore::Document::decrementReferencingNodeCount()
10  0x5bb5fc167 WebCore::Document::removedLastRef()
11  0x5bb7f95b4 WebCore::Node::removedLastRef()
12  0x5b7b9695c WebCore::Node::deref() const
13  0x5b80d602b WebCore::EventTarget::deref()
14  0x5b867cbae WTF::DefaultRefDerefTraits<WebCore::EventTarget>::derefIfNotNull(WebCore::EventTarget*)
15  0x5b867cb79 WTF::RefPtr<WebCore::EventTarget, WTF::RawPtrTraits<WebCore::EventTarget>, WTF::DefaultRefDerefTraits<WebCore::EventTarget> >::~RefPtr()
16  0x5b867cb25 WTF::RefPtr<WebCore::EventTarget, WTF::RawPtrTraits<WebCore::EventTarget>, WTF::DefaultRefDerefTraits<WebCore::EventTarget> >::~RefPtr()
17  0x5bb745138 WebCore::Event::~Event()
18  0x5bb7451d5 WebCore::Event::~Event()
19  0x5bb7451f9 WebCore::Event::~Event()
20  0x5b7dedf0c std::__1::default_delete<WebCore::Event>::operator()(WebCore::Event*) const
21  0x5b7dede87 WTF::RefCounted<WebCore::Event, std::__1::default_delete<WebCore::Event> >::deref() const
22  0x5b7eb4b9d WTF::Ref<WebCore::Event, WTF::RawPtrTraits<WebCore::Event> >::~Ref()
23  0x5b7e9ab05 WTF::Ref<WebCore::Event, WTF::RawPtrTraits<WebCore::Event> >::~Ref()
24  0x5b8795089 WebCore::JSDOMWrapper<WebCore::Event, WTF::RawPtrTraits<WebCore::Event> >::~JSDOMWrapper()
25  0x5b8795065 WebCore::JSEvent::~JSEvent()
26  0x5b87265d5 WebCore::JSEvent::~JSEvent()
27  0x5b872380d WebCore::JSEvent::destroy(JSC::JSCell*)
28  0x58975ba77 JSC::JSDestructibleObjectDestroyFunc::operator()(JSC::VM&, JSC::JSCell*) const
29  0x58975ba45 JSC::JSDestructibleObjectHeapCellType::destroy(JSC::VM&, JSC::JSCell*) const
30  0x58911d88a JSC::Subspace::destroy(JSC::VM&, JSC::JSCell*)
31  0x5891102c1 JSC::PreciseAllocation::sweep()
com.apple.WebKit.WebContent.Development terminated (pid 74527) for reason: crash

https://build.webkit.org/results/Apple-Monterey-Release-WK1-Tests/262809@main%20(9276)/results.html
Comment 1 Fujii Hironori 2023-04-12 18:28:09 PDT 
Created attachment 465878 [details]
image-blocked-src-change-crash-log.txt
Comment 2 Fujii Hironori 2023-04-12 18:31:13 PDT 
Maybe after 262252@main (bug#254347).
Comment 3 Fujii Hironori 2023-04-12 18:41:04 PDT 
WinCairo Release is the most crashing bot. 262262@main is the first crash.
https://results.webkit.org/?suite=layout-tests&test=http%2Ftests%2Fmisc%2Fimage-blocked-src-change.html&platform=wincairo
https://build.webkit.org/#/builders/728/builds/480

BTW, I can't reproduce the crash locally with WinCairo Release.
Comment 4 Radar WebKit Bug Importer 2023-04-19 18:12:20 PDT 
<rdar://problem/108291845>
Comment 6 Fujii Hironori 2023-05-03 23:32:05 PDT 

*** This bug has been marked as a duplicate of bug 256290 ***