Bug 241141 – REGRESSION (251042@main):[ iOS Debug ] ASSERTION FAILED: m_ptr in Ref.h(115) : T *WTF::Ref<WTF::WeakPtrImpl<>>::operator->() const [T = WTF::WeakPtrImpl<>, Traits = WTF::RawPtrTraits<WTF::WeakPtrImpl<>>]

• Component: WebCore Misc.
• Status: RESOLVED FIXED

[Karl Rackler]

Created attachment 459894 [details]
Crash Log

Description:
[ iOS Debug ] Bot failed Exiting early after 50 crashes, 51 failures, 12 api tests failed or timed out


The first failure that I saw on the dashboard was on 5/27/2022 at 251069@main.  The first build I see with this failure is https://build.webkit.org/#/builders/267/builds/2681/steps/12/logs/stdio.

REPRODUCTION STEPS
I can reproduce these crashes on 251042@main, but unable to reproduce them on 251041@main or earlier.

Command: 
run-webkit-tests --ios-simulator --debug --exit-after-n-failures 1 --exit-after-n-crashes-or-timeouts 1 --iterations 100 --no-retry editing/deleting/5546763.html

Result: 
Unexpected flakiness: crashes (1)
  editing/deleting/5546763.html [ Crash Pass ]

History:
https://results.webkit.org/?suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&test=editing%2Fdeleting%2F5546763.html&test=editing%2Fdeleting%2Fcollapse-whitespace-3587601-fix.html&test=editing%2Fdeleting%2Fdelete-block-merge-contents-009.html&test=editing%2Fdeleting%2Fdelete-br-001.html&test=editing%2Fdeleting%2Fdelete-emoji-3.html&test=editing%2Fdeleting%2Fdelete-line-011.html&test=editing%2Fdeleting%2Fdelete-select-all-001.html&test=editing%2Fdeleting%2Fdelete-to-select-table.html&test=editing%2Fdeleting%2Fdelete-ws-fixup-004.html&test=editing%2Fdeleting%2Fmerge-paragraph-from-p-with-style-3.html&test=editing%2Fdeleting%2Fmerge-paragraph-with-style-from-rule.html&test=editing%2Fdeleting%2Fsmart-delete-004.html&test=editing%2FexecCommand%2F4924441.html&test=editing%2FexecCommand%2F5207369.html&test=editing%2FexecCommand%2Fbreak-out-of-empty-list-item.html&test=editing%2FexecCommand%2Fcrash-line-break-after-outdent.html&test=editing%2FexecCommand%2Fenabling-and-selection-2.html&test=editing%2FexecCommand%2Findent-nested-inlines-2.html&test=editing%2FexecCommand%2Finfinite-recursion-computeRectForRepaint.html&test=editing%2FexecCommand%2Finsert-nested-lists-with-pre.html&test=editing%2FexecCommand%2Flist-wrapping-image-crash.html&test=editing%2FexecCommand%2Fovertype.html&test=editing%2FexecCommand%2Fquery-text-decoration-with-typing-style.html&test=editing%2FexecCommand%2Fremove-format-multiple-elements-mac.html&test=editing%2Finserting%2F5549929-1.html&test=editing%2Finserting%2F6703873.html&test=editing%2Finserting%2Finsert-div-027.html&test=editing%2Fpasteboard%2F4930986-2.html&test=editing%2Fpasteboard%2Fdatatransfer-items-copy-html.html&test=editing%2Fpasteboard%2Femacs-killring-backward-delete-prepend.html&test=editing%2Fpasteboard%2Finput-field-1.html&test=editing%2Fpasteboard%2Fpaste-line-endings-006.html&test=editing%2Fpasteboard%2Fpaste-table-001.html&test=editing%2Fpasteboard%2Fpaste-text-019.html&test=editing%2Fpasteboard%2Fpaste-text-with-style-2.html&test=editing%2Fselection%2F5234383-1.html&test=editing%2Fselection%2Fcharacter-data-mutation.html&test=editing%2Fselection%2FdeleteFromDocument-after-document-open-crash.html&test=editing%2Fselection%2Fextend-left-right-by-lineboundary.html&test=editing%2Fselection%2Fextend-selection-enclosing-block-win.html&test=editing%2Fselection%2Fios%2Fselect-all-in-readonly-input-does-not-overflow.html&test=editing%2Fselection%2Fmixed-editability-12.html&test=editing%2Fselection%2Fmove-by-sentence-linebreak.html&test=editing%2Fspelling%2Ftoggle-spellchecking.html&test=editing%2Fstyle%2Fbackground-color-retained.html&test=editing%2Fstyle%2Fremove-underline-after-paragraph-in-bold.html&test=editing%2Fstyle%2Ftoggle-style-bold-italic-mixed-editability.html&test=editing%2Funsupported-content%2Flist-delete-003.html&test=fast%2Fcss-generated-content%2Ffirst-letter-table-cell-format-block-crash.html&limit=&platform=ios&style=debug

stderr: 
ASSERTION FAILED: m_ptr
/Volumes/Data/worker/Apple-iOS-15-Simulator-Debug-Build/build/WebKitBuild/Debug-iphonesimulator/usr/local/include/wtf/Ref.h(115) : T *WTF::Ref<WTF::WeakPtrImpl<>>::operator->() const [T = WTF::WeakPtrImpl<>, Traits = WTF::RawPtrTraits<WTF::WeakPtrImpl<>>]
1   0x154d4dda9 WTFCrash
2   0x17dc2a00b WTFCrashWithInfo(int, char const*, char const*, int)
3   0x17dce5a18 WTF::Ref<WTF::WeakPtrImpl<WTF::EmptyCounter>, WTF::RawPtrTraits<WTF::WeakPtrImpl<WTF::EmptyCounter> > >::operator->() const
4   0x1813d2bb6 WTF::WeakHashMap<WebCore::Element, WTF::ObjectIdentifier<WebCore::ElementIdentifierType>, WTF::EmptyCounter>::WeakHashMapIteratorBase<WTF::WeakHashMap<WebCore::Element, WTF::ObjectIdentifier<WebCore::ElementIdentifierType>, WTF::EmptyCounter>, WTF::HashTableIteratorAdapter<WTF::HashTable<WTF::Ref<WTF::WeakPtrImpl<WTF::EmptyCounter>, WTF::RawPtrTraits<WTF::WeakPtrImpl<WTF::EmptyCounter> > >, WTF::KeyValuePair<WTF::Ref<WTF::WeakPtrImpl<WTF::EmptyCounter>, WTF::RawPtrTraits<WTF::WeakPtrImpl<WTF::EmptyCounter> > >, WTF::ObjectIdentifier<WebCore::ElementIdentifierType> >, WTF::KeyValuePairKeyExtractor<WTF::KeyValuePair<WTF::Ref<WTF::WeakPtrImpl<WTF::EmptyCounter>, WTF::RawPtrTraits<WTF::WeakPtrImpl<WTF::EmptyCounter> > >, WTF::ObjectIdentifier<WebCore::ElementIdentifierType> > >, WTF::DefaultHash<WTF::Ref<WTF::WeakPtrImpl<WTF::EmptyCounter>, WTF::RawPtrTraits<WTF::WeakPtrImpl<WTF::EmptyCounter> > > >, WTF::HashMap<WTF::Ref<WTF::WeakPtrImpl<WTF::EmptyCounter>, WTF::RawPtrTraits<WTF::WeakPtrImpl<WTF::EmptyCounter> > >, WTF::ObjectIdentifier<WebCore::ElementIdentifierType>, WTF::DefaultHash<WTF::Ref<WTF::WeakPtrImpl<WTF::EmptyCounter>, WTF::RawPtrTraits<WTF::WeakPtrImpl<WTF::EmptyCounter> > > >, WTF::HashTraits<WTF::Ref<WTF::WeakPtrImpl<WTF::EmptyCounter>, WTF::RawPtrTraits<WTF::WeakPtrImpl<WTF::EmptyCounter> > > >, WTF::HashTraits<WTF::ObjectIdentifier<WebCore::ElementIdentifierType> >, WTF::HashTableTraits>::KeyValuePairTraits, WTF::HashTraits<WTF::Ref<WTF::WeakPtrImpl<WTF::EmptyCounter>, WTF::RawPtrTraits<WTF::WeakPtrImpl<WTF::EmptyCounter> > > > >, WTF::KeyValuePair<WTF::Ref<WTF::WeakPtrImpl<WTF::EmptyCounter>, WTF::RawPtrTraits<WTF::WeakPtrImpl<WTF::EmptyCounter> > >, WTF::ObjectIdentifier<WebCore::ElementIdentifierType> > >, WTF::WeakHashMap<WebCore::Element, WTF::ObjectIdentifier<WebCore::ElementIdentifierType>, WTF::EmptyCounter>::PeekPtrType, WTF::WeakHashMap<WebCore::Element, WTF::ObjectIdentifier<WebCore::ElementIdentifierType>, WTF::EmptyCounter>::PeekType>::makePeek()
5   0x18139eb65 WTF::WeakHashMap<WebCore::Element, WTF::ObjectIdentifier<WebCore::ElementIdentifierType>, WTF::EmptyCounter>::WeakHashMapIterator::operator->()
6   0x18139e9e8 WebCore::Element::identifier() const
7   0x1387ae133 WebKit::WebPage::contextForElement(WebCore::Element&) const
8   0x1379b441d WebKit::WebPage::focusedElementInformation()
9   0x1387a690b WebKit::WebPage::elementDidFocus(WebCore::Element&, WebCore::FocusOptions const&)
10  0x1387a6739 WebKit::WebPage::elementDidRefocus(WebCore::Element&, WebCore::FocusOptions const&)
11  0x138451ef9 WebKit::WebChromeClient::elementDidRefocus(WebCore::Element&, WebCore::FocusOptions const&)
12  0x1821e147d WebCore::FocusController::setFocusedElement(WebCore::Element*, WebCore::Frame&, WebCore::FocusOptions const&)
13  0x181616ae4 WebCore::FrameSelection::setFocusedElementIfNeeded()
14  0x1816164c7 WebCore::FrameSelection::setSelectionWithoutUpdatingAppearance(WebCore::VisibleSelection const&, WTF::OptionSet<WebCore::FrameSelection::SetSelectionOption>, WebCore::FrameSelection::CursorAlignOnScroll, WebCore::TextGranularity)
15  0x1815f8900 WebCore::FrameSelection::setSelection(WebCore::VisibleSelection const&, WTF::OptionSet<WebCore::FrameSelection::SetSelectionOption>, WebCore::AXTextStateChangeIntent, WebCore::FrameSelection::CursorAlignOnScroll, WebCore::TextGranularity)
16  0x1815ffc5e WebCore::Editor::changeSelectionAfterCommand(WebCore::VisibleSelection const&, WTF::OptionSet<WebCore::FrameSelection::SetSelectionOption>)
17  0x1815ff621 WebCore::Editor::appliedEditing(WebCore::CompositeEditCommand&)
18  0x181694310 WebCore::TypingCommand::typingAddedToOpenCommand(WebCore::TypingCommand::ETypingCommand)
19  0x181691b45 WebCore::TypingCommand::deleteKeyPressed(WebCore::TextGranularity, bool)
20  0x181693bd3 WebCore::TypingCommand::doApply()
21  0x18159dcdf WebCore::CompositeEditCommand::apply()
22  0x181690bc3 WebCore::TypingCommand::deleteKeyPressed(WebCore::Document&, unsigned int, WebCore::TextGranularity)
23  0x18162dcb6 WebCore::executeDelete(WebCore::Frame&, WebCore::Event*, WebCore::EditorCommandSource, WTF::String const&)
24  0x181603814 WebCore::Editor::Command::execute(WTF::String const&, WebCore::Event*) const
25  0x1812bc239 WebCore::Document::execCommand(WTF::String const&, bool, WTF::String const&)
26  0x17e89d6d9 WebCore::jsDocumentPrototypeFunction_execCommandBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSDocument*)
27  0x17e89d06e long long WebCore::IDLOperation<WebCore::JSDocument>::call<&(WebCore::jsDocumentPrototypeFunction_execCommandBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSDocument*)), (WebCore::CastedThisErrorBehavior)0>(JSC::JSGlobalObject&, JSC::CallFrame&, char const*)
28  0x17e885f54 WebCore::jsDocumentPrototypeFunction_execCommand(JSC::JSGlobalObject*, JSC::CallFrame*)
29  0x50bf2b40c038
30  0x155450157 llint_entry
31  0x15542bc3e vmEntryToJavaScript
com.apple.WebKit.WebContent.Development terminated (pid 6914) for reason: crash

Crash Log:
 Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0  com.apple.JavaScriptCore   	       0x154d4ddae        WTFCrash
1  com.apple.WebCore          	       0x17dc2a008        WTFCrashWithInfo(int, char const*, char const*, int)
2  com.apple.WebCore          	       0x17dce5a16        WTF::Ref<WTF::WeakPtrImpl<WTF::EmptyCounter>, WTF::RawPtrTraits<WTF::WeakPtrImpl<WTF::EmptyCounter> > >::operator->() const
3  com.apple.WebCore          	       0x1813d2bb4        WTF::WeakHashMap<WebCore::Element, WTF::ObjectIdentifier<WebCore::ElementIdentifierType>, WTF::EmptyCounter>::WeakHashMapIteratorBase<WTF::WeakHashMap<WebCore::Element, WTF::ObjectIdentifier<WebCore::ElementIdentifierType>, WTF::EmptyCounter>, WTF::HashTableIteratorAdapter<WTF::HashTable<WTF::Ref<WTF::WeakPtrImpl<WTF::EmptyCounter>, WTF::RawPtrTraits<WTF::WeakPtrImpl<WTF::EmptyCounter> > >, WTF::KeyValuePair<WTF::Ref<WTF::WeakPtrImpl<WTF::EmptyCounter>, WTF::RawPtrTraits<WTF::WeakPtrImpl<WTF::EmptyCounter> > >, WTF::ObjectIdentifier<WebCore::ElementIdentifierType> >, WTF::KeyValuePairKeyExtractor<WTF::KeyValuePair<WTF::Ref<WTF::WeakPtrImpl<WTF::EmptyCounter>, WTF::RawPtrTraits<WTF::WeakPtrImpl<WTF::EmptyCounter> > >, WTF::ObjectIdentifier<WebCore::ElementIdentifierType> > >, WTF::DefaultHash<WTF::Ref<WTF::WeakPtrImpl<WTF::EmptyCounter>, WTF::RawPtrTraits<WTF::WeakPtrImpl<WTF::EmptyCounter> > > >, WTF::HashMap<WTF::Ref<WTF::WeakPtrImpl<WTF::EmptyCounter>, WTF::RawPtrTraits<WTF::WeakPtrImpl<WTF::EmptyCounter> > >, WTF::ObjectIdentifier<WebCore::ElementIdentifierType>, WTF::DefaultHash<WTF::Ref<WTF::WeakPtrImpl<WTF::EmptyCounter>, WTF::RawPtrTraits<WTF::WeakPtrImpl<WTF::EmptyCounter> > > >, WTF::HashTraits<WTF::Ref<WTF::WeakPtrImpl<WTF::EmptyCounter>, WTF::RawPtrTraits<WTF::WeakPtrImpl<WTF::EmptyCounter> > > >, WTF::HashTraits<WTF::ObjectIdentifier<WebCore::ElementIdentifierType> >, WTF::HashTableTraits>::KeyValuePairTraits, WTF::HashTraits<WTF::Ref<WTF::WeakPtrImpl<WTF::EmptyCounter>, WTF::RawPtrTraits<WTF::WeakPtrImpl<WTF::EmptyCounter> > > > >, WTF::KeyValuePair<WTF::Ref<WTF::WeakPtrImpl<WTF::EmptyCounter>, WTF::RawPtrTraits<WTF::WeakPtrImpl<WTF::EmptyCounter> > >, WTF::ObjectIdentifier<WebCore::ElementIdentifierType> > >, WTF::WeakHashMap<WebCore::Element, WTF::ObjectIdentifier<WebCore::ElementIdentifierType>, WTF::EmptyCounter>::PeekPtrType, WTF::WeakHashMap<WebCore::Element, WTF::ObjectIdentifier<WebCore::ElementIdentifierType>, WTF::EmptyCounter>::PeekType>::makePeek()
4  com.apple.WebCore          	       0x18139eb62        WTF::WeakHashMap<WebCore::Element, WTF::ObjectIdentifier<WebCore::ElementIdentifierType>, WTF::EmptyCounter>::WeakHashMapIterator::operator->()
5  com.apple.WebCore          	       0x18139e9e6        WebCore::Element::identifier() const

[Radar WebKit Bug Importer]

<rdar://problem/94168551>

[Chris Dumez]

Pull request: https://github.com/WebKit/WebKit/pull/1189

[EWS]

Committed r295063 (251158@main): <https://commits.webkit.org/251158@main>

Reviewed commits have been landed. Closing PR #1189 and removing active labels.