269322 2024-02-13 14:32:13 -0800 Crash under ~RenderMenuList due to CheckedPtr usage 2024-02-13 15:25:14 -0800 1 1 1 Unclassified WebKit Layout and Rendering WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 cdumez cdumez bfulgham simon.fraser webkit-bug-importer zalan oldest_to_newest 2013304 0 cdumez 2024-02-13 14:32:13 -0800 Crash under ~RenderMenuList due to CheckedPtr usage: ``` Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 WebCore 0x1102c25d0 WTFCrashWithInfo(int, char const*, char const*, int) + 20 1 WebCore 0x11014882c WebCore::RenderLayerModelObject::~RenderLayerModelObject() + 604 2 WebCore 0x110280864 WebCore::RenderMenuList::~RenderMenuList() + 16 3 WebCore 0x1127bed30 WebCore::RenderTreeBuilder::destroy(WebCore::RenderObject&, WebCore::RenderTreeBuilder::CanCollapseAnonymousBlock) + 964 4 WebCore 0x1127c9c1c WebCore::RenderTreeBuilder::destroyAndCleanUpAnonymousWrappers(WebCore::RenderObject&) + 344 5 WebCore 0x1127d7bc8 WebCore::RenderTreeUpdater::tearDownRenderers(WebCore::Element&, WebCore::RenderTreeUpdater::TeardownType, WebCore::RenderTreeBuilder&) + 1460 6 WebCore 0x1127d8de8 WebCore::RenderTreeUpdater::tearDownRenderers(WebCore::Element&) + 84 7 WebCore 0x11198a924 WebCore::ContainerNode::removeBetween(WebCore::Node*, WebCore::Node*, WebCore::Node&) + 312 8 WebCore 0x111986530 WebCore::ContainerNode::removeChild(WebCore::Node&) + 552 9 WebCore 0x110bae9b0 WebCore::jsNodePrototypeFunction_removeChild(JSC::JSGlobalObject*, JSC::CallFrame*) + 504 ``` 2013305 1 cdumez 2024-02-13 14:32:21 -0800 <rdar://119790256> 2013307 2 cdumez 2024-02-13 14:37:14 -0800 Pull request: https://github.com/WebKit/WebKit/pull/24372 2013327 3 ews-feeder 2024-02-13 15:25:12 -0800 Committed 274586@main (35318b4d5407): <https://commits.webkit.org/274586@main> Reviewed commits have been landed. Closing PR #24372 and removing active labels.