263021 2023-10-11 10:02:47 -0700 REGRESSION(269168@main): Introduced crashes in debug 2023-10-11 10:08:16 -0700 1 1 1 Unclassified WebKit New Bugs WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 260642 1 commit-queue commit-queue cdumez mike webkit-bug-importer oldest_to_newest 1984318 0 commit-queue 2023-10-11 10:02:47 -0700 https://commits.webkit.org/269168@main introduced a regression: Introduced crashes in debug This is an automatic bug report generated by webkitbot. If this bug report was created because of a flaky test, please file a bug for the flaky test (if we don't already have one on file) and dup this bug against that bug so that we can track how often these flaky tests fail. 1984321 1 468174 commit-queue 2023-10-11 10:02:56 -0700 Created attachment 468174 REVERT of 269168@main Any committer can land this patch automatically by marking it commit-queue+. The commit-queue will build and test the patch before landing to ensure that the revert will be successful. This process takes approximately 15 minutes. If you would like to land the revert faster, you can use the following command: webkit-patch land-attachment ATTACHMENT_ID where ATTACHMENT_ID is the ID of this attachment. 1984325 2 cdumez 2023-10-11 10:06:24 -0700 CRASHING TEST: fast/css/stylesheet-layout-with-pending-paint-expected.html Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 JavaScriptCore 0x138a02244 WTFCrash + 24 (Assertions.cpp:333) 1 WebCore 0x282d078ac WTFCrashWithInfo(int, char const*, char const*, int) + 36 (Assertions.h:778) 2 WebCore 0x284134440 WebCore::HTMLLinkElement::clearSheet() + 240 (HTMLLinkElement.cpp:374) 3 WebCore 0x2841346c0 WebCore::HTMLLinkElement::removedFromAncestor(WebCore::Node::RemovalType, WebCore::ContainerNode&) + 152 (HTMLLinkElement.cpp:408) 4 WebCore 0x283aed8d4 WebCore::notifyNodeRemovedFromDocument(WebCore::ContainerNode&, WebCore::TreeScopeChange, WebCore::Node&) + 324 (ContainerNodeAlgorithms.cpp:126) 5 WebCore 0x283aed9c8 WebCore::notifyNodeRemovedFromDocument(WebCore::ContainerNode&, WebCore::TreeScopeChange, WebCore::Node&) + 568 (ContainerNodeAlgorithms.cpp:134) 6 WebCore 0x283aed9c8 WebCore::notifyNodeRemovedFromDocument(WebCore::ContainerNode&, WebCore::TreeScopeChange, WebCore::Node&) + 568 (ContainerNodeAlgorithms.cpp:134) 7 WebCore 0x283aed6f4 WebCore::notifyChildNodeRemoved(WebCore::ContainerNode&, WebCore::Node&) + 204 (ContainerNodeAlgorithms.cpp:178) 8 WebCore 0x283ae6820 WebCore::removeDetachedChildrenInContainer(WebCore::ContainerNode&) + 408 (ContainerNodeAlgorithms.cpp:197) 9 WebCore 0x283ae663c WebCore::ContainerNode::removeDetachedChildren() + 140 (ContainerNode.cpp:346) 10 WebCore 0x283b5558c WebCore::Document::removedLastRef() + 580 (Document.cpp:828) 11 WebCore 0x283d381a8 WebCore::Node::removedLastRef() + 160 (Node.cpp:2640) 12 WebCore 0x280182430 WebCore::Node::deref() const + 568 (Node.h:822) 13 WebCore 0x2806d0b68 WebCore::EventTarget::deref() + 52 (Node.h:908) 14 WebCore 0x280c0e004 WTF::DefaultRefDerefTraits<WebCore::EventTarget>::derefIfNotNull(WebCore::EventTarget*) + 48 (RefPtr.h:43) 15 WebCore 0x280c0dfc4 WTF::RefPtr<WebCore::EventTarget, WTF::RawPtrTraits<WebCore::EventTarget>, WTF::DefaultRefDerefTraits<WebCore::EventTarget>>::~RefPtr() + 44 (RefPtr.h:75) 16 WebCore 0x280c0df58 WTF::RefPtr<WebCore::EventTarget, WTF::RawPtrTraits<WebCore::EventTarget>, WTF::DefaultRefDerefTraits<WebCore::EventTarget>>::~RefPtr() + 32 (RefPtr.h:75) 17 WebCore 0x283c97268 WebCore::Event::~Event() + 80 (Event.cpp:90) 18 WebCore 0x283c97eb4 WebCore::Event::~Event() + 32 (Event.cpp:90) 19 WebCore 0x283c97ee4 WebCore::Event::~Event() + 32 (Event.cpp:90) 20 WebCore 0x282d551dc std::__1::default_delete<WebCore::Event>::operator()[abi:v160006](WebCore::Event*) const + 92 (unique_ptr.h:65) 21 WebCore 0x2803a9c40 WTF::RefCounted<WebCore::Event, std::__1::default_delete<WebCore::Event>>::deref() const + 56 (RefCounted.h:190) 22 WebCore 0x282d55168 WTF::Ref<WebCore::Event, WTF::RawPtrTraits<WebCore::Event>>::~Ref() + 80 (Ref.h:61) 23 WebCore 0x28044b980 WTF::Ref<WebCore::Event, WTF::RawPtrTraits<WebCore::Event>>::~Ref() + 32 (Ref.h:55) 24 WebCore 0x280d1d654 WebCore::JSDOMWrapper<WebCore::Event, WTF::RawPtrTraits<WebCore::Event>>::~JSDOMWrapper() + 36 (JSDOMWrapper.h:74) 25 WebCore 0x280d1d620 WebCore::JSEvent::~JSEvent() + 32 (JSEvent.h:30) 26 WebCore 0x280cb09a4 WebCore::JSEvent::~JSEvent() + 32 (JSEvent.h:30) 1984326 3 cdumez 2023-10-11 10:06:48 -0700 It is flaky but one should be able to reproduce pretty easily by running the fast/css tests in debug. 1984327 4 ews-feeder 2023-10-11 10:07:38 -0700 Committed 269203@main (8f02a8f5aca1): <https://commits.webkit.org/269203@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 468174. 1984328 5 webkit-bug-importer 2023-10-11 10:08:16 -0700 <rdar://problem/116815789> 468174 2023-10-11 10:02:56 -0700 2023-10-11 10:07:39 -0700 REVERT of 269168@main bug-263021-20231011170255.patch text/plain 3036 commit-queue RnJvbSA5ODRjYTkyMmViN2VmMjk3Yzc3ZDNmYWNiMjFjZmIyODk0MTRjMDNhIE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiBDb21taXQgUXVldWUgPGNvbW1pdC1xdWV1ZUB3ZWJraXQub3Jn PgpEYXRlOiBXZWQsIDExIE9jdCAyMDIzIDE3OjAyOjUyICswMDAwClN1YmplY3Q6IFtQQVRDSF0g VW5yZXZpZXdlZCwgcmV2ZXJ0aW5nIDI2OTE2OEBtYWluLgogaHR0cHM6Ly9idWdzLndlYmtpdC5v cmcvc2hvd19idWcuY2dpP2lkPTI2MzAyMQpNSU1FLVZlcnNpb246IDEuMApDb250ZW50LVR5cGU6 IHRleHQvcGxhaW47IGNoYXJzZXQ9VVRGLTgKQ29udGVudC1UcmFuc2Zlci1FbmNvZGluZzogOGJp dAoKSW50cm9kdWNlZCBjcmFzaGVzIGluIGRlYnVnCgpSZXZlcnRlZCBjaGFuZ2VzZXQ6CgoiTWFr ZSBzZXR0aW5nIGEgbGlua0ByZWw9c3R5bGVzaGVldCB0byDigJxkaXNhYmxlZOKAnSBhbHNvIHNl dCBvd25lck5vZGU9bnVsbCIKaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lk PTI2MDY0MgpodHRwczovL2NvbW1pdHMud2Via2l0Lm9yZy8yNjkxNjhAbWFpbgotLS0KIFNvdXJj ZS9XZWJDb3JlL2h0bWwvSFRNTExpbmtFbGVtZW50LmNwcCAgICAgICAgICAgICAgICAgICAgICAg ICB8IDIgLS0KIC4uLi9jc3MvY3Nzb20vSFRNTExpbmtFbGVtZW50LWRpc2FibGVkLTAwMS1leHBl Y3RlZC50eHQgICAgICAgICB8IDIgKy0KIC4uLi9jc3MvY3Nzb20vSFRNTExpbmtFbGVtZW50LWRp c2FibGVkLTAwMi1leHBlY3RlZC50eHQgICAgICAgICB8IDIgKy0KIDMgZmlsZXMgY2hhbmdlZCwg MiBpbnNlcnRpb25zKCspLCA0IGRlbGV0aW9ucygtKQoKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJD b3JlL2h0bWwvSFRNTExpbmtFbGVtZW50LmNwcCBiL1NvdXJjZS9XZWJDb3JlL2h0bWwvSFRNTExp bmtFbGVtZW50LmNwcAppbmRleCAzMTM1MjUwNTg2NjIuLjAzYjgyOTIyYzcwMSAxMDA2NDQKLS0t IGEvU291cmNlL1dlYkNvcmUvaHRtbC9IVE1MTGlua0VsZW1lbnQuY3BwCisrKyBiL1NvdXJjZS9X ZWJDb3JlL2h0bWwvSFRNTExpbmtFbGVtZW50LmNwcApAQCAtMTU2LDggKzE1Niw2IEBAIHZvaWQg SFRNTExpbmtFbGVtZW50OjpzZXREaXNhYmxlZFN0YXRlKGJvb2wgZGlzYWJsZWQpCiAgICAgICAg IHByb2Nlc3MoKTsKICAgICBlbHNlIHsKICAgICAgICAgQVNTRVJUKG1fc3R5bGVTY29wZSk7Ci0g ICAgICAgIGlmIChtX3NoZWV0KQotICAgICAgICAgICAgbV9zaGVldC0+Y2xlYXJPd25lck5vZGUo KTsKICAgICAgICAgbV9zdHlsZVNjb3BlLT5kaWRDaGFuZ2VBY3RpdmVTdHlsZVNoZWV0Q2FuZGlk YXRlcygpOwogICAgIH0KIH0KZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2ltcG9ydGVkL3czYy93 ZWItcGxhdGZvcm0tdGVzdHMvY3NzL2Nzc29tL0hUTUxMaW5rRWxlbWVudC1kaXNhYmxlZC0wMDEt ZXhwZWN0ZWQudHh0IGIvTGF5b3V0VGVzdHMvaW1wb3J0ZWQvdzNjL3dlYi1wbGF0Zm9ybS10ZXN0 cy9jc3MvY3Nzb20vSFRNTExpbmtFbGVtZW50LWRpc2FibGVkLTAwMS1leHBlY3RlZC50eHQKaW5k ZXggMWY5ODU0NDIxNjVkLi4yM2Q3MmM4MWQzM2MgMTAwNjQ0Ci0tLSBhL0xheW91dFRlc3RzL2lt cG9ydGVkL3czYy93ZWItcGxhdGZvcm0tdGVzdHMvY3NzL2Nzc29tL0hUTUxMaW5rRWxlbWVudC1k aXNhYmxlZC0wMDEtZXhwZWN0ZWQudHh0CisrKyBiL0xheW91dFRlc3RzL2ltcG9ydGVkL3czYy93 ZWItcGxhdGZvcm0tdGVzdHMvY3NzL2Nzc29tL0hUTUxMaW5rRWxlbWVudC1kaXNhYmxlZC0wMDEt ZXhwZWN0ZWQudHh0CkBAIC0xLDQgKzEsNCBAQAogCiBQQVNTIDxsaW5rIGRpc2FibGVkPiBwcmV2 ZW50cyB0aGUgc3R5bGVzaGVldCBmcm9tIGJlaW5nIGluIGRvY3VtZW50LnN0eWxlU2hlZXRzIChm cm9tIHBhcnNlcikKLVBBU1MgSFRNTExpbmtFbGVtZW50LmRpc2FibGVkIHJlZmxlY3RzIHRoZSA8 bGluayBkaXNhYmxlZD4gYXR0cmlidXRlLCBhbmQgYmVoYXZlcyBjb25zaXN0ZW50bHkKK0ZBSUwg SFRNTExpbmtFbGVtZW50LmRpc2FibGVkIHJlZmxlY3RzIHRoZSA8bGluayBkaXNhYmxlZD4gYXR0 cmlidXRlLCBhbmQgYmVoYXZlcyBjb25zaXN0ZW50bHkgYXNzZXJ0X2VxdWFsczogZXhwZWN0ZWQg bnVsbCBidXQgZ290IEVsZW1lbnQgbm9kZSA8bGluayB0aXRsZT0iYWx0IiByZWw9InN0eWxlc2hl ZXQiIGhyZWY9ImRhdGE6dGV4dC9jc3MsaHQuLi4KIApkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMv aW1wb3J0ZWQvdzNjL3dlYi1wbGF0Zm9ybS10ZXN0cy9jc3MvY3Nzb20vSFRNTExpbmtFbGVtZW50 LWRpc2FibGVkLTAwMi1leHBlY3RlZC50eHQgYi9MYXlvdXRUZXN0cy9pbXBvcnRlZC93M2Mvd2Vi LXBsYXRmb3JtLXRlc3RzL2Nzcy9jc3NvbS9IVE1MTGlua0VsZW1lbnQtZGlzYWJsZWQtMDAyLWV4 cGVjdGVkLnR4dAppbmRleCBmMDJhNmI4MzAzZjcuLjIwOWQ0ZWEwNzNlNCAxMDA2NDQKLS0tIGEv TGF5b3V0VGVzdHMvaW1wb3J0ZWQvdzNjL3dlYi1wbGF0Zm9ybS10ZXN0cy9jc3MvY3Nzb20vSFRN TExpbmtFbGVtZW50LWRpc2FibGVkLTAwMi1leHBlY3RlZC50eHQKKysrIGIvTGF5b3V0VGVzdHMv aW1wb3J0ZWQvdzNjL3dlYi1wbGF0Zm9ybS10ZXN0cy9jc3MvY3Nzb20vSFRNTExpbmtFbGVtZW50 LWRpc2FibGVkLTAwMi1leHBlY3RlZC50eHQKQEAgLTEsMyArMSwzIEBACiAKLVBBU1MgSFRNTExp bmtFbGVtZW50LmRpc2FibGVkIHJlZmxlY3RzIHRoZSA8bGluayBkaXNhYmxlZD4gYXR0cmlidXRl LCBhbmQgYmVoYXZlcyBjb25zaXN0ZW50bHksIHdoZW4gdGhlIHNoZWV0IGlzIGFuIGFsdGVybmF0 ZQorRkFJTCBIVE1MTGlua0VsZW1lbnQuZGlzYWJsZWQgcmVmbGVjdHMgdGhlIDxsaW5rIGRpc2Fi bGVkPiBhdHRyaWJ1dGUsIGFuZCBiZWhhdmVzIGNvbnNpc3RlbnRseSwgd2hlbiB0aGUgc2hlZXQg aXMgYW4gYWx0ZXJuYXRlIGFzc2VydF9lcXVhbHM6IGV4cGVjdGVkIG51bGwgYnV0IGdvdCBFbGVt ZW50IG5vZGUgPGxpbmsgdGl0bGU9ImFsdCIgcmVsPSJhbHRlcm5hdGUgc3R5bGVzaGVldCIgaHJl Zj0iZGF0YTp0Li4uCiAK