<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>253990</bug_id>
          
          <creation_ts>2023-03-15 16:34:17 -0700</creation_ts>
          <short_desc>Regression: svg/text/modify-text-node-in-tspan.html is flaky crashing</short_desc>
          <delta_ts>2023-03-15 20:18:17 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>WebCore Misc.</component>
          <version>WebKit Nightly Build</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Chris Dumez">cdumez</reporter>
          <assigned_to name="Chris Dumez">cdumez</assigned_to>
          <cc>rniwa</cc>
    
    <cc>simon.fraser</cc>
    
    <cc>webkit-bug-importer</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1941701</commentid>
    <comment_count>0</comment_count>
    <who name="Chris Dumez">cdumez</who>
    <bug_when>2023-03-15 16:34:17 -0700</bug_when>
    <thetext>svg/text/modify-text-node-in-tspan.html is flaky crashing on the bots:
ASSERTION FAILED: m_ptr
/Volumes/Data/worker/Apple-Ventura-Debug-Build/build/WebKitBuild/Debug/usr/local/include/wtf/Ref.h(116) : T *WTF::Ref&lt;WebCore::Document&gt;::ptr() const [T = WebCore::Document, Traits = WTF::RawPtrTraits&lt;WebCore::Document&gt;]
1   0x8343fa7b9 WTFCrash
2   0x7f331439b WTFCrashWithInfo(int, char const*, char const*, int)
3   0x7f4209328 WTF::Ref&lt;WebCore::Document, WTF::RawPtrTraits&lt;WebCore::Document&gt; &gt;::ptr() const
4   0x7f7304d32 WebCore::Range::nodeChildrenWillBeRemoved(WebCore::ContainerNode&amp;)
5   0x7f70e8430 WebCore::Document::nodeChildrenWillBeRemoved(WebCore::ContainerNode&amp;)
6   0x7f705beff WebCore::ContainerNode::removeAllChildrenWithScriptAssertion(WebCore::ContainerNode::ChildChange::Source, WTF::Vector&lt;WTF::Ref&lt;WebCore::Node, WTF::RawPtrTraits&lt;WebCore::Node&gt; &gt;, 11ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc&gt;&amp;, WebCore::ContainerNode::DeferChildrenChanged)
7   0x7f705ff31 WebCore::ContainerNode::removeChildren()
8   0x7f97156c5 WebCore::SVGUseElement::clearShadowTree()
9   0x7f9715660 WebCore::SVGUseElement::removedFromAncestor(WebCore::Node::RemovalType, WebCore::ContainerNode&amp;)
10  0x7f7063198 WebCore::notifyNodeRemovedFromDocument(WebCore::ContainerNode&amp;, WebCore::TreeScopeChange, WebCore::Node&amp;)
11  0x7f7063277 WebCore::notifyNodeRemovedFromDocument(WebCore::ContainerNode&amp;, WebCore::TreeScopeChange, WebCore::Node&amp;)
12  0x7f706302c WebCore::notifyChildNodeRemoved(WebCore::ContainerNode&amp;, WebCore::Node&amp;)
13  0x7f705c6e5 WebCore::removeDetachedChildrenInContainer(WebCore::ContainerNode&amp;)
14  0x7f705c4fc WebCore::ContainerNode::removeDetachedChildren()
15  0x7f70c886d WebCore::Document::removedLastRef()
16  0x7f72bfa54 WebCore::Node::removedLastRef()
17  0x7f3714b9c WebCore::Node::deref() const
18  0x7f3df8819 WTF::Ref&lt;WebCore::Document, WTF::RawPtrTraits&lt;WebCore::Document&gt; &gt;::~Ref()
19  0x7f3df84b5 WTF::Ref&lt;WebCore::Document, WTF::RawPtrTraits&lt;WebCore::Document&gt; &gt;::~Ref()
20  0x7f72fe355 WebCore::Range::~Range()
21  0x7f72fe3f5 WebCore::Range::~Range()
22  0x7f72fe419 WebCore::Range::~Range()
23  0x7f3a2378c std::__1::default_delete&lt;WebCore::AbstractRange&gt;::operator()(WebCore::AbstractRange*) const
24  0x7f3a23707 WTF::RefCounted&lt;WebCore::AbstractRange, std::__1::default_delete&lt;WebCore::AbstractRange&gt; &gt;::deref() const
25  0x7f3a2368d WTF::Ref&lt;WebCore::AbstractRange, WTF::RawPtrTraits&lt;WebCore::AbstractRange&gt; &gt;::~Ref()
26  0x7f3a23645 WTF::Ref&lt;WebCore::AbstractRange, WTF::RawPtrTraits&lt;WebCore::AbstractRange&gt; &gt;::~Ref()
27  0x7f3a23629 WebCore::JSDOMWrapper&lt;WebCore::AbstractRange, WTF::RawPtrTraits&lt;WebCore::AbstractRange&gt; &gt;::~JSDOMWrapper()
28  0x7f3a23605 WebCore::JSAbstractRange::~JSAbstractRange()
29  0x7f39b8085 WebCore::JSAbstractRange::~JSAbstractRange()
30  0x7f39b7a4d WebCore::JSAbstractRange::destroy(JSC::JSCell*)
31  0x83625f297 JSC::JSDestructibleObjectDestroyFunc::operator()(JSC::VM&amp;, JSC::JSCell*) const</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1941703</commentid>
    <comment_count>1</comment_count>
    <who name="Chris Dumez">cdumez</who>
    <bug_when>2023-03-15 16:43:32 -0700</bug_when>
    <thetext>Could be a regression from 261586@main.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1941732</commentid>
    <comment_count>2</comment_count>
    <who name="Chris Dumez">cdumez</who>
    <bug_when>2023-03-15 18:20:01 -0700</bug_when>
    <thetext>Pull request: https://github.com/WebKit/WebKit/pull/11587</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1941756</commentid>
    <comment_count>3</comment_count>
    <who name="EWS">ews-feeder</who>
    <bug_when>2023-03-15 20:17:24 -0700</bug_when>
    <thetext>Committed 261729@main (eb77502aa6c9): &lt;https://commits.webkit.org/261729@main&gt;

Reviewed commits have been landed. Closing PR #11587 and removing active labels.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1941757</commentid>
    <comment_count>4</comment_count>
    <who name="Radar WebKit Bug Importer">webkit-bug-importer</who>
    <bug_when>2023-03-15 20:18:17 -0700</bug_when>
    <thetext>&lt;rdar://problem/106788030&gt;</thetext>
  </long_desc>
      
      

    </bug>

</bugzilla>