svg/text/modify-text-node-in-tspan.html is flaky crashing on the bots: ASSERTION FAILED: m_ptr /Volumes/Data/worker/Apple-Ventura-Debug-Build/build/WebKitBuild/Debug/usr/local/include/wtf/Ref.h(116) : T *WTF::Ref<WebCore::Document>::ptr() const [T = WebCore::Document, Traits = WTF::RawPtrTraits<WebCore::Document>] 1 0x8343fa7b9 WTFCrash 2 0x7f331439b WTFCrashWithInfo(int, char const*, char const*, int) 3 0x7f4209328 WTF::Ref<WebCore::Document, WTF::RawPtrTraits<WebCore::Document> >::ptr() const 4 0x7f7304d32 WebCore::Range::nodeChildrenWillBeRemoved(WebCore::ContainerNode&) 5 0x7f70e8430 WebCore::Document::nodeChildrenWillBeRemoved(WebCore::ContainerNode&) 6 0x7f705beff WebCore::ContainerNode::removeAllChildrenWithScriptAssertion(WebCore::ContainerNode::ChildChange::Source, WTF::Vector<WTF::Ref<WebCore::Node, WTF::RawPtrTraits<WebCore::Node> >, 11ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&, WebCore::ContainerNode::DeferChildrenChanged) 7 0x7f705ff31 WebCore::ContainerNode::removeChildren() 8 0x7f97156c5 WebCore::SVGUseElement::clearShadowTree() 9 0x7f9715660 WebCore::SVGUseElement::removedFromAncestor(WebCore::Node::RemovalType, WebCore::ContainerNode&) 10 0x7f7063198 WebCore::notifyNodeRemovedFromDocument(WebCore::ContainerNode&, WebCore::TreeScopeChange, WebCore::Node&) 11 0x7f7063277 WebCore::notifyNodeRemovedFromDocument(WebCore::ContainerNode&, WebCore::TreeScopeChange, WebCore::Node&) 12 0x7f706302c WebCore::notifyChildNodeRemoved(WebCore::ContainerNode&, WebCore::Node&) 13 0x7f705c6e5 WebCore::removeDetachedChildrenInContainer(WebCore::ContainerNode&) 14 0x7f705c4fc WebCore::ContainerNode::removeDetachedChildren() 15 0x7f70c886d WebCore::Document::removedLastRef() 16 0x7f72bfa54 WebCore::Node::removedLastRef() 17 0x7f3714b9c WebCore::Node::deref() const 18 0x7f3df8819 WTF::Ref<WebCore::Document, WTF::RawPtrTraits<WebCore::Document> >::~Ref() 19 0x7f3df84b5 WTF::Ref<WebCore::Document, WTF::RawPtrTraits<WebCore::Document> >::~Ref() 20 0x7f72fe355 WebCore::Range::~Range() 21 0x7f72fe3f5 WebCore::Range::~Range() 22 0x7f72fe419 WebCore::Range::~Range() 23 0x7f3a2378c std::__1::default_delete<WebCore::AbstractRange>::operator()(WebCore::AbstractRange*) const 24 0x7f3a23707 WTF::RefCounted<WebCore::AbstractRange, std::__1::default_delete<WebCore::AbstractRange> >::deref() const 25 0x7f3a2368d WTF::Ref<WebCore::AbstractRange, WTF::RawPtrTraits<WebCore::AbstractRange> >::~Ref() 26 0x7f3a23645 WTF::Ref<WebCore::AbstractRange, WTF::RawPtrTraits<WebCore::AbstractRange> >::~Ref() 27 0x7f3a23629 WebCore::JSDOMWrapper<WebCore::AbstractRange, WTF::RawPtrTraits<WebCore::AbstractRange> >::~JSDOMWrapper() 28 0x7f3a23605 WebCore::JSAbstractRange::~JSAbstractRange() 29 0x7f39b8085 WebCore::JSAbstractRange::~JSAbstractRange() 30 0x7f39b7a4d WebCore::JSAbstractRange::destroy(JSC::JSCell*) 31 0x83625f297 JSC::JSDestructibleObjectDestroyFunc::operator()(JSC::VM&, JSC::JSCell*) const
Could be a regression from 261586@main.
Pull request: https://github.com/WebKit/WebKit/pull/11587
Committed 261729@main (eb77502aa6c9): <https://commits.webkit.org/261729@main> Reviewed commits have been landed. Closing PR #11587 and removing active labels.
<rdar://problem/106788030>