Bug 261886 - Regression(268215@main): imported/w3c/web-platform-tests/css/css-transitions/changing-while-transition-001.html is flakily crashing
Summary: Regression(268215@main): imported/w3c/web-platform-tests/css/css-transitions/...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: CSS (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Chris Dumez
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2023-09-21 08:57 PDT by Chris Dumez
Modified: 2023-09-21 10:15 PDT (History)
2 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Chris Dumez 2023-09-21 08:57:01 PDT 
imported/w3c/web-platform-tests/css/css-transitions/changing-while-transition-001.html is flakily crashing after the smart pointer adoption work:
```
 Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0  com.apple.WebCore       	       0x123d09114 WTFCrashWithInfo(int, char const*, char const*, int)
1  com.apple.WebCore       	       0x123939870 WebCore::EventTarget::~EventTarget()
2  com.apple.WebCore       	       0x123b010e4 WebCore::HTMLDivElement::~HTMLDivElement()
3  com.apple.WebCore       	       0x1236bdbe0 WebCore::CSSComputedStyleDeclaration::deref()
4  com.apple.JavaScriptCore	       0x115c39a00 void JSC::MarkedBlock::Handle::specializedSweep<true, (JSC::MarkedBlock::Handle::EmptyMode)1, (JSC::MarkedBlock::Handle::SweepMode)0, (JSC::MarkedBlock::Handle::SweepDestructionMode)1, (JSC::MarkedBlock::Handle::ScribbleMode)0, (JSC::MarkedBlock::Handle::NewlyAllocatedMode)1, (JSC::MarkedBlock::Handle::MarksMode)1, JSC::JSDestructibleObjectDestroyFunc>(JSC::FreeList*, JSC::MarkedBlock::Handle::EmptyMode, JSC::MarkedBlock::Handle::SweepMode, JSC::MarkedBlock::Handle::SweepDestructionMode, JSC::MarkedBlock::Handle::ScribbleMode, JSC::MarkedBlock::Handle::NewlyAllocatedMode, JSC::MarkedBlock::Handle::MarksMode, JSC::JSDestructibleObjectDestroyFunc const&)
5  com.apple.JavaScriptCore	       0x115c38100 void JSC::MarkedBlock::Handle::finishSweepKnowingHeapCellType<JSC::JSDestructibleObjectDestroyFunc>(JSC::FreeList*, JSC::JSDestructibleObjectDestroyFunc const&)::'lambda'()::operator()() const
6  com.apple.JavaScriptCore	       0x115c33bc4 void JSC::MarkedBlock::Handle::finishSweepKnowingHeapCellType<JSC::JSDestructibleObjectDestroyFunc>(JSC::FreeList*, JSC::JSDestructibleObjectDestroyFunc const&)
7  com.apple.JavaScriptCore	       0x115c33a94 JSC::JSDestructibleObjectHeapCellType::finishSweep(JSC::MarkedBlock::Handle&, JSC::FreeList*) const
8  com.apple.JavaScriptCore	       0x1158be624 JSC::MarkedBlock::Handle::sweep(JSC::FreeList*)
```
Comment 1 Chris Dumez 2023-09-21 10:10:54 PDT 
Pull request: https://github.com/WebKit/WebKit/pull/18025
Comment 2 EWS 2023-09-21 10:14:13 PDT 
Committed 268260@main (92891095fc28): <https://commits.webkit.org/268260@main>

Reviewed commits have been landed. Closing PR #18025 and removing active labels.
Comment 3 Radar WebKit Bug Importer 2023-09-21 10:15:15 PDT 
<rdar://problem/115848569>