Bug 279372 – Release assert in ElementIterator<WebCore::HTMLAnchorElement>::traverseAncestor() via searchForLinkRemovingExistingDDLinks

• Component: WebCore Misc.
• Status: RESOLVED FIXED

[Ryosuke Niwa]

e.g.
Thread 0 name:   Dispatch queue: com.apple.main-thread
Thread 0 Crashed:
0   WebCore                       	       0x1add9ec40 WTFCrashWithInfo(int, char const*, char const*, int) + 11426880 [inlined]
1   WebCore                       	       0x1add9ec40 WTF::CanMakeCheckedPtrBase<WTF::SingleThreadIntegralWrapper<unsigned int>, unsigned int>::decrementPtrCount() const + 11426880 [inlined]
2   WebCore                       	       0x1add9ec40 WTF::CheckedPtr<WebCore::HTMLAnchorElement, WTF::RawPtrTraits<WebCore::HTMLAnchorElement>>::derefIfNotNull() + 11426880 [inlined]
3   WebCore                       	       0x1add9ec40 WTF::CheckedPtr<WebCore::HTMLAnchorElement, WTF::RawPtrTraits<WebCore::HTMLAnchorElement>>::~CheckedPtr() + 11426880 [inlined]
4   WebCore                       	       0x1add9ec40 WTF::CheckedPtr<WebCore::HTMLAnchorElement, WTF::RawPtrTraits<WebCore::HTMLAnchorElement>>::~CheckedPtr() + 11426880 [inlined]
5   WebCore                       	       0x1add9ec40 WTF::CheckedPtr<WebCore::HTMLLinkElement, WTF::RawPtrTraits<WebCore::HTMLLinkElement>>::operator=(WebCore::HTMLLinkElement*) + 11426880
6   WebCore                       	       0x1add8d3eb WebCore::ElementIterator<WebCore::HTMLAnchorElement>::traverseAncestor() + 11355115 [inlined]
7   WebCore                       	       0x1add8d3eb WebCore::ElementAncestorIterator<WebCore::HTMLAnchorElement>::operator++() + 11355115 [inlined]
8   WebCore                       	       0x1add8d3eb WebCore::searchForLinkRemovingExistingDDLinks(WebCore::Node&, WebCore::Node&) + 11355115 [inlined]
9   WebCore                       	       0x1add8d3eb WebCore::processDataDetectorScannerResults(__DDScanner*, WTF::OptionSet<WebCore::DataDetectorType>, std::__1::optional<double>, __DDScanQuery*, WebCore::SimpleRange const&, WTF::Vector<WebCore::DDQueryFragmentCore, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&) + 11355115
10  WebCore                       	       0x1adda34cb WebCore::DataDetection::detectContentInFrame(WebCore::LocalFrame*, WTF::OptionSet<WebCore::DataDetectorType>, std::__1::optional<double>, WTF::CompletionHandler<void (NSArray*)>&&)::$_0::operator()()::'lambda0'()::operator()() + 11445451 [inlined]
11  WebCore                       	       0x1adda34cb WTF::Detail::CallableWrapper<WebCore::DataDetection::detectContentInFrame(WebCore::LocalFrame*, WTF::OptionSet<WebCore::DataDetectorType>, std::__1::optional<double>, WTF::CompletionHandler<void (NSArray*)>&&)::$_0::operator()()::'lambda0'(), void>::call() + 11445451
12  JavaScriptCore                	       0x1b11fd6eb WTF::Function<void ()>::operator()() const + 370411 [inlined]
13  JavaScriptCore                	       0x1b11fd6eb WTF::RunLoop::performWork() + 370411

<rdar://134586621>

[Ryosuke Niwa]

Pull request: https://github.com/WebKit/WebKit/pull/33328

[EWS]

Committed 283363@main (d1b3d851cc7b): <https://commits.webkit.org/283363@main>

Reviewed commits have been landed. Closing PR #33328 and removing active labels.

[EWS]

Committed 283286.24@safari-7620-branch (4335cb57071d): <https://commits.webkit.org/283286.24@safari-7620-branch>

Reviewed commits have been landed. Closing PR #1752 and removing active labels.