Bug 261886 – Regression(268215@main): imported/w3c/web-platform-tests/css/css-transitions/changing-while-transition-001.html is flakily crashing

• Component: CSS
• Status: RESOLVED FIXED

[Chris Dumez]

imported/w3c/web-platform-tests/css/css-transitions/changing-while-transition-001.html is flakily crashing after the smart pointer adoption work:
```
 Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0  com.apple.WebCore       	       0x123d09114 WTFCrashWithInfo(int, char const*, char const*, int)
1  com.apple.WebCore       	       0x123939870 WebCore::EventTarget::~EventTarget()
2  com.apple.WebCore       	       0x123b010e4 WebCore::HTMLDivElement::~HTMLDivElement()
3  com.apple.WebCore       	       0x1236bdbe0 WebCore::CSSComputedStyleDeclaration::deref()
4  com.apple.JavaScriptCore	       0x115c39a00 void JSC::MarkedBlock::Handle::specializedSweep<true, (JSC::MarkedBlock::Handle::EmptyMode)1, (JSC::MarkedBlock::Handle::SweepMode)0, (JSC::MarkedBlock::Handle::SweepDestructionMode)1, (JSC::MarkedBlock::Handle::ScribbleMode)0, (JSC::MarkedBlock::Handle::NewlyAllocatedMode)1, (JSC::MarkedBlock::Handle::MarksMode)1, JSC::JSDestructibleObjectDestroyFunc>(JSC::FreeList*, JSC::MarkedBlock::Handle::EmptyMode, JSC::MarkedBlock::Handle::SweepMode, JSC::MarkedBlock::Handle::SweepDestructionMode, JSC::MarkedBlock::Handle::ScribbleMode, JSC::MarkedBlock::Handle::NewlyAllocatedMode, JSC::MarkedBlock::Handle::MarksMode, JSC::JSDestructibleObjectDestroyFunc const&)
5  com.apple.JavaScriptCore	       0x115c38100 void JSC::MarkedBlock::Handle::finishSweepKnowingHeapCellType<JSC::JSDestructibleObjectDestroyFunc>(JSC::FreeList*, JSC::JSDestructibleObjectDestroyFunc const&)::'lambda'()::operator()() const
6  com.apple.JavaScriptCore	       0x115c33bc4 void JSC::MarkedBlock::Handle::finishSweepKnowingHeapCellType<JSC::JSDestructibleObjectDestroyFunc>(JSC::FreeList*, JSC::JSDestructibleObjectDestroyFunc const&)
7  com.apple.JavaScriptCore	       0x115c33a94 JSC::JSDestructibleObjectHeapCellType::finishSweep(JSC::MarkedBlock::Handle&, JSC::FreeList*) const
8  com.apple.JavaScriptCore	       0x1158be624 JSC::MarkedBlock::Handle::sweep(JSC::FreeList*)
```

[Chris Dumez]

Pull request: https://github.com/WebKit/WebKit/pull/18025

[EWS]

Committed 268260@main (92891095fc28): <https://commits.webkit.org/268260@main>

Reviewed commits have been landed. Closing PR #18025 and removing active labels.

[Radar WebKit Bug Importer]

<rdar://problem/115848569>