Bug 297414

Summary:	REGRESSION(298647@main): [ macOS wk2 Debug, iOS Debug ] ASSERTION FAILED: !isSuspended() is constantly crashing imported/w3c/web-platform-tests/navigation-api/navigate-event/intercept-detach-multiple.html
Product:	WebKit	Reporter:	Bryan Medina <bmedina2>
Component:	New Bugs	Assignee:	rupin
Status:	RESOLVED FIXED
Severity:	Normal	CC:	rupin, webkit-bot-watchers-bugzilla, webkit-bug-importer
Priority:	P2	Keywords:	InRadar
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified

Bryan Medina

Reported 2025-08-14 13:32:04 PDT

imported/w3c/web-platform-tests/navigation-api/navigate-event/intercept-detach-multiple.html is a constant crash on macOS wk2 Debug and iOS Debug. HISTORY: https://results.webkit.org/?suite=layout-tests&test=imported%2Fw3c%2Fweb-platform-tests%2Fnavigation-api%2Fnavigate-event%2Fintercept-detach-multiple.html CRASH LOG: No crash log found for WebKitTestRunnerApp:27182. STDERR: ASSERTION FAILED: !isSuspended() /Volumes/Data/worker/Apple-iOS-18-Simulator-Debug-Build/build/Source/WebCore/bindings/js/JSDOMPromise.cpp(100) : void WebCore::DOMPromise::markAsHandled() 1 0x146811c6c WebCore::DOMPromise::markAsHandled() 2 0x1489323b4 WebCore::Navigation::innerDispatchNavigateEvent(WebCore::NavigationNavigationType, WTF::Ref<WebCore::NavigationDestination, WTF::RawPtrTraits<WebCore::NavigationDestination>, WTF::DefaultRefDerefTraits<WebCore::NavigationDestination>>&&, WTF::String const&, WebCore::FormState*, WebCore::SerializedScriptValue*, WebCore::Element*) 3 0x1489335dc WebCore::Navigation::dispatchPushReplaceReloadNavigateEvent(WTF::URL const&, WebCore::NavigationNavigationType, bool, WebCore::FormState*, WebCore::SerializedScriptValue*, WebCore::Element*) 4 0x1485f01c4 WebCore::NavigationScheduler::scheduleLocationChange(WebCore::Document&, WebCore::SecurityOrigin&, WTF::URL const&, WTF::String const&, WebCore::LockHistory, WebCore::LockBackForwardList, WebCore::NavigationHistoryBehavior, WTF::CompletionHandler<void (WebCore::ScheduleLocationChangeResult)>&&) 5 0x148881b30 WebCore::LocalDOMWindow::setLocation(WebCore::LocalDOMWindow&, WTF::URL const&, WebCore::NavigationHistoryBehavior, WebCore::SetLocationLocking, WebCore::CanNavigateState) 6 0x1488f0c80 WebCore::Location::setLocation(WebCore::LocalDOMWindow&, WebCore::LocalDOMWindow&, WTF::String const&) 7 0x1488f091c WebCore::Location::setHref(WebCore::LocalDOMWindow&, WebCore::LocalDOMWindow&, WTF::String const&) 8 0x144256be4 WebCore::setJSLocation_hrefSetter(JSC::JSGlobalObject&, WebCore::JSLocation&, JSC::JSValue)::'lambda'()::operator()() const 9 0x144256b0c void WebCore::invokeFunctorPropagatingExceptionIfNecessary<WebCore::setJSLocation_hrefSetter(JSC::JSGlobalObject&, WebCore::JSLocation&, JSC::JSValue)::'lambda'()>(JSC::JSGlobalObject&, JSC::ThrowScope&, WebCore::setJSLocation_hrefSetter(JSC::JSGlobalObject&, WebCore::JSLocation&, JSC::JSValue)::'lambda'()&&) 10 0x144256aa4 WebCore::setJSLocation_hrefSetter(JSC::JSGlobalObject&, WebCore::JSLocation&, JSC::JSValue) 11 0x144106650 bool WebCore::IDLAttribute<WebCore::JSLocation>::set<&WebCore::setJSLocation_hrefSetter(JSC::JSGlobalObject&, WebCore::JSLocation&, JSC::JSValue), (WebCore::CastedThisErrorBehavior)0>(JSC::JSGlobalObject&, long long, long long, JSC::PropertyName) 12 0x144106534 WebCore::setJSLocation_href(JSC::JSGlobalObject*, long long, long long, JSC::PropertyName) 13 0x105327800 WTF::FunctionPtr<(WTF::PtrTag)30177, bool (JSC::JSGlobalObject*, long long, long long, JSC::PropertyName), (WTF::FunctionAttributes)1>::operator()(JSC::JSGlobalObject*, long long, long long, JSC::PropertyName) const 14 0x105425f4c JSC::JSObject::putInlineSlow(JSC::JSGlobalObject*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) 15 0x104940390 JSC::JSObject::putInlineForJSObject(JSC::JSCell*, JSC::JSGlobalObject*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) 16 0x10540d95c JSC::JSObject::put(JSC::JSCell*, JSC::JSGlobalObject*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) 17 0x1468a446c WebCore::JSLocation::put(JSC::JSCell*, JSC::JSGlobalObject*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) 18 0x1053236b4 JSC::JSCell::put(JSC::JSCell*, JSC::JSGlobalObject*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) 19 0x1049400bc JSC::JSCell::putInline(JSC::JSGlobalObject*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) 20 0x10494464c JSC::JSValue::putInline(JSC::JSGlobalObject*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) 21 0x104ff2a4c llint_slow_path_put_by_id 22 0x105ed5be0 jsc_llint_llintOpWithMetadata__llintOpWithReturn__llintOp__commonOp__fn__fn__makeReturn__fn__fn__1566_fn__opPutByIdSlow_LowLevelInterpreter_asm_510 23 0x105ef2554 op_call_varargs_return_location 24 0x105ef2554 op_call_varargs_return_location 25 0x105ec7658 llint_call_javascript 26 0x104e258ac JSC::Interpreter::executeCallImpl(JSC::VM&, JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) 27 0x104e259ec JSC::Interpreter::executeCall(JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) 28 0x10511921c JSC::call(JSC::JSGlobalObject*, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) 29 0x1051192d4 JSC::call(JSC::JSGlobalObject*, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) 30 0x1051195b4 JSC::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) 31 0x1467f8fd4 WebCore::JSExecState::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) #CRASHED - com.apple.WebKit.WebContent.Development (pid 27185) LEAK: 1 WebProcessPool LEAK: 1 WebPageProxy

Attachments
Add attachment proposed patch, testcase, etc.

Radar WebKit Bug Importer

Comment 1 2025-08-14 13:32:31 PDT

<rdar://problem/158349001>

Bryan Medina

Comment 2 2025-08-14 13:47:58 PDT

I was able to reproduce the crash locally on my device running macOS Sequoia arm64 Debug ToT using the following command: run-webkit-tests imported/w3c/web-platform-tests/navigation-api/navigate-event/intercept-detach-multiple.html --debug

EWS

Comment 3 2025-08-14 13:57:28 PDT

Test gardening commit 298704@main (9cc81f445bd2): <https://commits.webkit.org/298704@main> Reviewed commits have been landed. Closing PR #49409 and removing active labels.

Bryan Medina

Comment 4 2025-08-14 14:36:46 PDT

It seems to me that the regression point is at 298647@main, since that is where the test started failing and when changes were made to navigation api.

Basuke Suzuki

Comment 5 2025-08-15 09:09:32 PDT

Pull request: https://github.com/WebKit/WebKit/pull/49458

EWS

Comment 6 2025-08-15 10:09:50 PDT

Committed 298757@main (9ec9904c3651): <https://commits.webkit.org/298757@main> Reviewed commits have been landed. Closing PR #49458 and removing active labels.

rupin

Comment 7 2025-08-21 18:29:53 PDT

This test was clearly not fixed in https://commits.webkit.org/298757@main. I'm not sure why that patch was attached to this bug. It doesn't look like the patch updated the expectations either. The test was expectations was simply moved from one TestExpectations to another in this gardening patch: https://commits.webkit.org/298810@main. Reopening this.

rupin

Comment 8 2025-08-21 18:41:45 PDT

Re-opening for pull request https://github.com/WebKit/WebKit/pull/49745

EWS

Comment 9 2025-08-22 16:57:55 PDT

Committed 299078@main (eaa78a5094ac): <https://commits.webkit.org/299078@main> Reviewed commits have been landed. Closing PR #49745 and removing active labels.

Note You need to log in before you can comment on or make changes to this bug.