http/tests/misc/image-blocked-src-change.html is randomly crashing https://results.webkit.org/?suite=layout-tests&test=http%2Ftests%2Fmisc%2Fimage-blocked-src-change.html https://build.webkit.org/results/Apple-iPadOS-16-Simulator-Debug-WK2-Tests/262483@main%20(1103)/results.html ASSERTION FAILED: !m_count /Volumes/Data/worker/Apple-iOS-16-Simulator-Debug-Build/build/WebKitBuild/Debug-iphonesimulator/usr/local/include/wtf/CheckedRef.h(242) : WTF::CanMakeCheckedPtrBase<WTF::SingleThreadIntegralWrapper<unsigned int>, unsigned int>::~CanMakeCheckedPtrBase() [StorageType = WTF::SingleThreadIntegralWrapper<unsigned int>, PtrCounterType = unsigned int] 1 0x5878f4419 WTFCrash 2 0x5b7a1ab8b WTFCrashWithInfo(int, char const*, char const*, int) 3 0x5bb75549b WTF::CanMakeCheckedPtrBase<WTF::SingleThreadIntegralWrapper<unsigned int>, unsigned int>::~CanMakeCheckedPtrBase() 4 0x5bb847987 WebCore::ScriptExecutionContext::~ScriptExecutionContext() 5 0x5bb5fa60c WebCore::Document::~Document() 6 0x5bbb9028f WebCore::HTMLDocument::~HTMLDocument() 7 0x5bbb902b5 WebCore::HTMLDocument::~HTMLDocument() 8 0x5bbb90399 WebCore::HTMLDocument::~HTMLDocument() 9 0x5bb5fc8c3 WebCore::Document::decrementReferencingNodeCount() 10 0x5bb5fc167 WebCore::Document::removedLastRef() 11 0x5bb7f95b4 WebCore::Node::removedLastRef() 12 0x5b7b9695c WebCore::Node::deref() const 13 0x5b80d602b WebCore::EventTarget::deref() 14 0x5b867cbae WTF::DefaultRefDerefTraits<WebCore::EventTarget>::derefIfNotNull(WebCore::EventTarget*) 15 0x5b867cb79 WTF::RefPtr<WebCore::EventTarget, WTF::RawPtrTraits<WebCore::EventTarget>, WTF::DefaultRefDerefTraits<WebCore::EventTarget> >::~RefPtr() 16 0x5b867cb25 WTF::RefPtr<WebCore::EventTarget, WTF::RawPtrTraits<WebCore::EventTarget>, WTF::DefaultRefDerefTraits<WebCore::EventTarget> >::~RefPtr() 17 0x5bb745138 WebCore::Event::~Event() 18 0x5bb7451d5 WebCore::Event::~Event() 19 0x5bb7451f9 WebCore::Event::~Event() 20 0x5b7dedf0c std::__1::default_delete<WebCore::Event>::operator()(WebCore::Event*) const 21 0x5b7dede87 WTF::RefCounted<WebCore::Event, std::__1::default_delete<WebCore::Event> >::deref() const 22 0x5b7eb4b9d WTF::Ref<WebCore::Event, WTF::RawPtrTraits<WebCore::Event> >::~Ref() 23 0x5b7e9ab05 WTF::Ref<WebCore::Event, WTF::RawPtrTraits<WebCore::Event> >::~Ref() 24 0x5b8795089 WebCore::JSDOMWrapper<WebCore::Event, WTF::RawPtrTraits<WebCore::Event> >::~JSDOMWrapper() 25 0x5b8795065 WebCore::JSEvent::~JSEvent() 26 0x5b87265d5 WebCore::JSEvent::~JSEvent() 27 0x5b872380d WebCore::JSEvent::destroy(JSC::JSCell*) 28 0x58975ba77 JSC::JSDestructibleObjectDestroyFunc::operator()(JSC::VM&, JSC::JSCell*) const 29 0x58975ba45 JSC::JSDestructibleObjectHeapCellType::destroy(JSC::VM&, JSC::JSCell*) const 30 0x58911d88a JSC::Subspace::destroy(JSC::VM&, JSC::JSCell*) 31 0x5891102c1 JSC::PreciseAllocation::sweep() com.apple.WebKit.WebContent.Development terminated (pid 74527) for reason: crash https://build.webkit.org/results/Apple-Monterey-Release-WK1-Tests/262809@main%20(9276)/results.html
Created attachment 465878 [details] image-blocked-src-change-crash-log.txt
Maybe after 262252@main (bug#254347).
WinCairo Release is the most crashing bot. 262262@main is the first crash. https://results.webkit.org/?suite=layout-tests&test=http%2Ftests%2Fmisc%2Fimage-blocked-src-change.html&platform=wincairo https://build.webkit.org/#/builders/728/builds/480 BTW, I can't reproduce the crash locally with WinCairo Release.
<rdar://problem/108291845>
Created attachment 466003 [details] WinCairo crash log for http/tests/misc/image-blocked-src-change.html https://build.webkit.org/results/WinCairo-64-bit-Release-Tests/263148@main%20(705)/CrashLog_26d4_2023-04-19_16-08-50-160.txt https://build.webkit.org/#/builders/728/builds/705
*** This bug has been marked as a duplicate of bug 256290 ***