Bug 277210

Summary:	accessibility/add-children-pseudo-element.html asserts in debug
Product:	WebKit	Reporter:	Simon Fraser (smfr) <simon.fraser>
Component:	Accessibility	Assignee:	Nobody <webkit-unassigned>
Status:	RESOLVED DUPLICATE
Severity:	Normal	CC:	andresg_22, simon.fraser, webkit-bug-importer
Priority:	P2	Keywords:	InRadar
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified

Simon Fraser (smfr)

Reported 2024-07-27 11:45:43 PDT

accessibility/add-children-pseudo-element.html asserts when run locally: Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.WebCore 0x32f2e3e2c WTFCrashWithInfo(int, char const*, char const*, int) 1 com.apple.WebCore 0x32f070fe4 WebCore::AccessibilityRenderObject::remoteSVGRootElement(WebCore::AccessibilityRenderObject::CreationChoice) const 2 com.apple.WebCore 0x32f065364 WebCore::AccessibilityRenderObject::detachRemoteSVGRoot() 3 com.apple.WebCore 0x32f0652f4 WebCore::AccessibilityRenderObject::detachRemoteParts(WebCore::AccessibilityDetachmentType) 4 com.apple.WebCore 0x32ef60a3c WebCore::AXCoreObject::detach(WebCore::AccessibilityDetachmentType) 5 com.apple.WebCore 0x32ef67e3c WebCore::AXObjectCache::remove(WTF::ObjectIdentifierGeneric<WebCore::AXIDType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long long>, unsigned long long>) 6 com.apple.WebCore 0x32ef68478 WebCore::AXObjectCache::remove(WebCore::RenderObject*) 7 com.apple.WebCore 0x331f601a8 WebCore::RenderObject::willBeDestroyed() 8 com.apple.WebCore 0x331e1773c WebCore::RenderElement::willBeDestroyed() 9 com.apple.WebCore 0x331f1c9c8 WebCore::RenderLayerModelObject::willBeDestroyed() 10 com.apple.WebCore 0x331d89a88 WebCore::RenderBoxModelObject::willBeDestroyed() 11 com.apple.WebCore 0x331d6c4b0 WebCore::RenderBox::willBeDestroyed() 12 com.apple.WebCore 0x331f66e40 WebCore::RenderReplaced::willBeDestroyed() 13 com.apple.WebCore 0x331e7e484 WebCore::RenderImage::willBeDestroyed() 14 com.apple.WebCore 0x331f55aac WebCore::RenderObject::destroy() 15 com.apple.WebCore 0x331f55874 WebCore::RenderObjectDeleter::operator()(WebCore::RenderObject*) const 16 com.apple.WebCore 0x331dd3524 std::__1::unique_ptr<WebCore::RenderObject, WebCore::RenderObjectDeleter>::reset[abi:sn170006](WebCore::RenderObject*) 17 com.apple.WebCore 0x331dd34a8 std::__1::unique_ptr<WebCore::RenderObject, WebCore::RenderObjectDeleter>::~unique_ptr[abi:sn170006]() 18 com.apple.WebCore 0x331db09f0 std::__1::unique_ptr<WebCore::RenderObject, WebCore::RenderObjectDeleter>::~unique_ptr[abi:sn170006]() 19 com.apple.WebCore 0x3321eb3a4 WebCore::RenderTreeBuilder::destroy(WebCore::RenderObject&, WebCore::RenderTreeBuilder::CanCollapseAnonymousBlock) 20 com.apple.WebCore 0x3321eb964 WebCore::RenderTreeBuilder::destroy(WebCore::RenderObject&, WebCore::RenderTreeBuilder::CanCollapseAnonymousBlock)::$_14::operator()() const 21 com.apple.WebCore 0x3321eb39c WebCore::RenderTreeBuilder::destroy(WebCore::RenderObject&, WebCore::RenderTreeBuilder::CanCollapseAnonymousBlock) 22 com.apple.WebCore 0x3321f17e4 WebCore::RenderTreeBuilder::destroyAndCleanUpAnonymousWrappers(WebCore::RenderObject&, WebCore::RenderElement const*) 23 com.apple.WebCore 0x33221941c WebCore::RenderTreeUpdater::tearDownRenderers(WebCore::Element&, WebCore::RenderTreeUpdater::TeardownType, WebCore::RenderTreeBuilder&)::$_13::operator()(unsigned int) const 24 com.apple.WebCore 0x33221799c WebCore::RenderTreeUpdater::tearDownRenderers(WebCore::Element&, WebCore::RenderTreeUpdater::TeardownType, WebCore::RenderTreeBuilder&) 25 com.apple.WebCore 0x33221a24c WebCore::RenderTreeUpdater::GeneratedContent::removeAfterPseudoElement(WebCore::Element&, WebCore::RenderTreeBuilder&) 26 com.apple.WebCore 0x3322160c8 WebCore::RenderTreeUpdater::GeneratedContent::updatePseudoElement(WebCore::Element&, WebCore::Style::ElementUpdate const&, WebCore::PseudoId) 27 com.apple.WebCore 0x332215d08 WebCore::RenderTreeUpdater::updateAfterDescendants(WebCore::Element&, WebCore::Style::ElementUpdate const*) 28 com.apple.WebCore 0x332215c68 WebCore::RenderTreeUpdater::popParent() 29 com.apple.WebCore 0x332214f1c WebCore::RenderTreeUpdater::popParentsToDepth(unsigned int) 30 com.apple.WebCore 0x332214428 WebCore::RenderTreeUpdater::updateRenderTree(WebCore::ContainerNode&) 31 com.apple.WebCore 0x332213ebc WebCore::RenderTreeUpdater::commit(std::__1::unique_ptr<WebCore::Style::Update, std::__1::default_delete<WebCore::Style::Update>>) 32 com.apple.WebCore 0x32fe6783c WebCore::Document::updateRenderTree(std::__1::unique_ptr<WebCore::Style::Update, std::__1::default_delete<WebCore::Style::Update>>) 33 com.apple.WebCore 0x32fe67fe4 WebCore::Document::resolveStyle(WebCore::Document::ResolveStyleType) 34 com.apple.WebCore 0x32fe68c74 WebCore::Document::updateStyleIfNeeded() 35 com.apple.WebCore 0x32fe71e7c WebCore::Document::implicitClose() 36 com.apple.WebCore 0x330d3c680 WebCore::FrameLoader::checkCallImplicitClose() 37 com.apple.WebCore 0x330d3bf0c WebCore::FrameLoader::checkCompleted() 38 com.apple.WebCore 0x330d3bff0 WebCore::FrameLoader::loadDone(WebCore::LoadCompletionType) 39 com.apple.WebCore 0x330ed5348 WebCore::CachedResourceLoader::loadDone(WebCore::LoadCompletionType, bool) 40 com.apple.WebCore 0x330e3570c WebCore::SubresourceLoader::notifyDone(WebCore::LoadCompletionType) 41 com.apple.WebCore 0x330e319b4 WebCore::SubresourceLoader::didFinishLoading(WebCore::NetworkLoadMetrics const&) 42 com.apple.WebKit 0x1233a9804 WebKit::WebResourceLoader::didFinishResourceLoad(WebCore::NetworkLoadMetrics&&)

Attachments
Add attachment proposed patch, testcase, etc.

Radar WebKit Bug Importer

Comment 1 2024-07-27 11:45:53 PDT

<rdar://problem/132644196>

Alexey Proskuryakov

Comment 2 2024-07-29 15:34:49 PDT

This is a very recent regression, https://results.webkit.org/?suite=layout-tests&test=accessibility%2Fadd-children-pseudo-element.html&style=debug

Alexey Proskuryakov

Comment 3 2024-08-02 12:55:38 PDT

*** This bug has been marked as a duplicate of bug 277360 ***

Note You need to log in before you can comment on or make changes to this bug.