Bug 174133 – ASSERTION FAILED: !m_visibleDescendantStatusDirty in WebCore::RenderLayer::isVisuallyNonEmpty

• Status: NEW
• Component: Layout and Rendering

[Renata Hodovan]

Created attachment 314567 [details]
Test

Load the attached test with debug WebKitTestRunner:

Checked version: 52ec9f7
OS: macOS Sierra (10.12.5)

<script>
window.onload=function(){
    window.scrollTo(document);
    scroll(document.d);
    document.execCommand('selectAll')
    document.designMode='on'
    document.execCommand('indent')
}
</script>
<style>
* {
    mix-blend-mode:lighten;
    overflow:hidden;
    position:absolute
}
#id_2{
    will-change:-webkit-transform
}
</style>
<n><font-face-format id="id_2"></font-face-format><t>
<desc>X</desc>a

Backtrace:

ASSERTION FAILED: !m_visibleDescendantStatusDirty
WebKit/Source/WebCore/rendering/RenderLayer.cpp(6705) : bool WebCore::RenderLayer::isVisuallyNonEmpty(WebCore::RenderLayer::PaintedContentRequest *) const
1   0x1373d0f11 WTFCrash
2   0x12137b5ea WebCore::RenderLayer::isVisuallyNonEmpty(WebCore::RenderLayer::PaintedContentRequest*) const
3   0x12146bea1 WebCore::RenderLayerBacking::isPaintDestinationForDescendantLayers(WebCore::RenderLayer::PaintedContentRequest&) const::$_1::operator()(WebCore::RenderLayer const&) const
4   0x12146bd94 WTF::Function<WebCore::LayerTraversal (WebCore::RenderLayer const&)>::CallableWrapper<WebCore::RenderLayerBacking::isPaintDestinationForDescendantLayers(WebCore::RenderLayer::PaintedContentRequest&) const::$_1>::call(WebCore::RenderLayer const&)
5   0x121469707 WTF::Function<WebCore::LayerTraversal (WebCore::RenderLayer const&)>::operator()(WebCore::RenderLayer const&) const
6   0x12144f922 WebCore::traverseVisibleNonCompositedDescendantLayers(WebCore::RenderLayer&, WTF::Function<WebCore::LayerTraversal (WebCore::RenderLayer const&)> const&)
7   0x12144f1a0 WebCore::RenderLayerBacking::isPaintDestinationForDescendantLayers(WebCore::RenderLayer::PaintedContentRequest&) const
8   0x12140ff5c WebCore::RenderLayerBacking::paintsContent(WebCore::RenderLayer::PaintedContentRequest&) const
9   0x12140fbfb WebCore::PaintedContentsInfo::paintsContentDetermination()
10  0x12144dd45 WebCore::PaintedContentsInfo::paintsContent()
11  0x121410686 WebCore::RenderLayerBacking::isSimpleContainerCompositingLayer(WebCore::PaintedContentsInfo&) const
12  0x12141037d WebCore::PaintedContentsInfo::contentsTypeDetermination()
13  0x12144e735 WebCore::PaintedContentsInfo::isSimpleContainer()
14  0x12144c7cf WebCore::RenderLayerBacking::updateDirectlyCompositedBackgroundColor(WebCore::PaintedContentsInfo&, bool&)
15  0x12143c3e7 WebCore::RenderLayerBacking::updateDirectlyCompositedBoxDecorations(WebCore::PaintedContentsInfo&, bool&)
16  0x121439b32 WebCore::RenderLayerBacking::updateConfiguration()
17  0x12148b141 WebCore::RenderLayerCompositor::updateLayerCompositingState(WebCore::RenderLayer&, WebCore::RenderLayerCompositor::CompositingChangeRepaint)
18  0x1213a9158 WebCore::RenderLayer::updateScrollInfoAfterLayout()
19  0x120f62168 WebCore::RenderBlock::updateScrollInfoAfterLayout()
20  0x120f6b7b2 WebCore::RenderBlock::simplifiedLayout()
21  0x1210218aa WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit)
22  0x120f624d4 WebCore::RenderBlock::layout()
23  0x11cf9fa2c WebCore::RenderElement::layoutIfNeeded()
24  0x120f6dfb6 WebCore::RenderBlock::layoutPositionedObject(WebCore::RenderBox&, bool, bool)
25  0x120f6cb85 WebCore::RenderBlock::layoutPositionedObjects(bool, bool)
26  0x120f6b583 WebCore::RenderBlock::simplifiedLayout()
27  0x1210218aa WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit)
28  0x120f624d4 WebCore::RenderBlock::layout()
29  0x11cf9fa2c WebCore::RenderElement::layoutIfNeeded()
30  0x120f6dfb6 WebCore::RenderBlock::layoutPositionedObject(WebCore::RenderBox&, bool, bool)
31  0x120f6cb85 WebCore::RenderBlock::layoutPositionedObjects(bool, bool)
ASAN:DEADLYSIGNAL
=================================================================
==20155==ERROR: AddressSanitizer: SEGV on unknown address 0x0000bbadbeef (pc 0x0001373d0f49 bp 0x7fff515e2d70 sp 0x7fff515e2d60 T0)
    #0 0x1373d0f48 in WTFCrash (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x3554f48)
    #1 0x12137b5e9 in WebCore::RenderLayer::isVisuallyNonEmpty(WebCore::RenderLayer::PaintedContentRequest*) const (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x5c6b5e9)
    #2 0x12146bea0 in WebCore::RenderLayerBacking::isPaintDestinationForDescendantLayers(WebCore::RenderLayer::PaintedContentRequest&) const::$_1::operator()(WebCore::RenderLayer const&) const (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x5d5bea0)
    #3 0x12146bd93 in WTF::Function<WebCore::LayerTraversal (WebCore::RenderLayer const&)>::CallableWrapper<WebCore::RenderLayerBacking::isPaintDestinationForDescendantLayers(WebCore::RenderLayer::PaintedContentRequest&) const::$_1>::call(WebCore::RenderLayer const&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x5d5bd93)
    #4 0x121469706 in WTF::Function<WebCore::LayerTraversal (WebCore::RenderLayer const&)>::operator()(WebCore::RenderLayer const&) const (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x5d59706)
    #5 0x12144f921 in WebCore::traverseVisibleNonCompositedDescendantLayers(WebCore::RenderLayer&, WTF::Function<WebCore::LayerTraversal (WebCore::RenderLayer const&)> const&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x5d3f921)
    #6 0x12144f19f in WebCore::RenderLayerBacking::isPaintDestinationForDescendantLayers(WebCore::RenderLayer::PaintedContentRequest&) const (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x5d3f19f)
    #7 0x12140ff5b in WebCore::RenderLayerBacking::paintsContent(WebCore::RenderLayer::PaintedContentRequest&) const (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x5cfff5b)
    #8 0x12140fbfa in WebCore::PaintedContentsInfo::paintsContentDetermination() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x5cffbfa)
    #9 0x12144dd44 in WebCore::PaintedContentsInfo::paintsContent() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x5d3dd44)
    #10 0x121410685 in WebCore::RenderLayerBacking::isSimpleContainerCompositingLayer(WebCore::PaintedContentsInfo&) const (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x5d00685)
    #11 0x12141037c in WebCore::PaintedContentsInfo::contentsTypeDetermination() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x5d0037c)
    #12 0x12144e734 in WebCore::PaintedContentsInfo::isSimpleContainer() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x5d3e734)
    #13 0x12144c7ce in WebCore::RenderLayerBacking::updateDirectlyCompositedBackgroundColor(WebCore::PaintedContentsInfo&, bool&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x5d3c7ce)
    #14 0x12143c3e6 in WebCore::RenderLayerBacking::updateDirectlyCompositedBoxDecorations(WebCore::PaintedContentsInfo&, bool&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x5d2c3e6)
    #15 0x121439b31 in WebCore::RenderLayerBacking::updateConfiguration() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x5d29b31)
    #16 0x12148b140 in WebCore::RenderLayerCompositor::updateLayerCompositingState(WebCore::RenderLayer&, WebCore::RenderLayerCompositor::CompositingChangeRepaint) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x5d7b140)
    #17 0x1213a9157 in WebCore::RenderLayer::updateScrollInfoAfterLayout() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x5c99157)
    #18 0x120f62167 in WebCore::RenderBlock::updateScrollInfoAfterLayout() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x5852167)
    #19 0x120f6b7b1 in WebCore::RenderBlock::simplifiedLayout() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x585b7b1)
    #20 0x1210218a9 in WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x59118a9)
    #21 0x120f624d3 in WebCore::RenderBlock::layout() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x58524d3)
    #22 0x11cf9fa2b in WebCore::RenderElement::layoutIfNeeded() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x188fa2b)
    #23 0x120f6dfb5 in WebCore::RenderBlock::layoutPositionedObject(WebCore::RenderBox&, bool, bool) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x585dfb5)
    #24 0x120f6cb84 in WebCore::RenderBlock::layoutPositionedObjects(bool, bool) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x585cb84)
    #25 0x120f6b582 in WebCore::RenderBlock::simplifiedLayout() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x585b582)
    #26 0x1210218a9 in WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x59118a9)
    #27 0x120f624d3 in WebCore::RenderBlock::layout() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x58524d3)
    #28 0x11cf9fa2b in WebCore::RenderElement::layoutIfNeeded() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x188fa2b)
    #29 0x120f6dfb5 in WebCore::RenderBlock::layoutPositionedObject(WebCore::RenderBox&, bool, bool) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x585dfb5)
    #30 0x120f6cb84 in WebCore::RenderBlock::layoutPositionedObjects(bool, bool) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x585cb84)
    #31 0x120f6b582 in WebCore::RenderBlock::simplifiedLayout() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x585b582)
    #32 0x1210218a9 in WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x59118a9)
    #33 0x120f624d3 in WebCore::RenderBlock::layout() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x58524d3)
    #34 0x11cf9fa2b in WebCore::RenderElement::layoutIfNeeded() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x188fa2b)
    #35 0x120f6dfb5 in WebCore::RenderBlock::layoutPositionedObject(WebCore::RenderBox&, bool, bool) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x585dfb5)
    #36 0x120f6cb84 in WebCore::RenderBlock::layoutPositionedObjects(bool, bool) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x585cb84)
    #37 0x121023028 in WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x5913028)
    #38 0x120f624d3 in WebCore::RenderBlock::layout() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x58524d3)
    #39 0x121968c75 in WebCore::RenderView::layoutContent(WebCore::LayoutState const&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x6258c75)
    #40 0x12196b0d5 in WebCore::RenderView::layout() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x625b0d5)
    #41 0x11d335847 in WebCore::FrameView::layout(bool) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1c25847)
    #42 0x11c919319 in WebCore::Document::updateLayout() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1209319)
    #43 0x11c923eb1 in WebCore::Document::updateLayoutIgnorePendingStylesheets(WebCore::Document::RunPostLayoutTasks) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1213eb1)
    #44 0x122b4d8c7 in WebCore::VisiblePosition::canonicalPosition(WebCore::Position const&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x743d8c7)
    #45 0x122b4d48c in WebCore::VisiblePosition::init(WebCore::Position const&, WebCore::EAffinity) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x743d48c)
    #46 0x122b4d2c2 in WebCore::VisiblePosition::VisiblePosition(WebCore::Position const&, WebCore::EAffinity) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x743d2c2)
    #47 0x122b4d692 in WebCore::VisiblePosition::VisiblePosition(WebCore::Position const&, WebCore::EAffinity) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x743d692)
    #48 0x11bfb1e59 in WebCore::CompositeEditCommand::moveParagraphWithClones(WebCore::VisiblePosition const&, WebCore::VisiblePosition const&, WebCore::Element*, WebCore::Node*) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x8a1e59)
    #49 0x11dde4813 in WebCore::IndentOutdentCommand::indentIntoBlockquote(WebCore::Position const&, WebCore::Position const&, WTF::RefPtr<WebCore::Element>&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x26d4813)
    #50 0x11dde633b in WebCore::IndentOutdentCommand::formatRange(WebCore::Position const&, WebCore::Position const&, WebCore::Position const&, WTF::RefPtr<WebCore::Element>&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x26d633b)
    #51 0x11b9818a0 in WebCore::ApplyBlockElementCommand::formatSelection(WebCore::VisiblePosition const&, WebCore::VisiblePosition const&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x2718a0)
    #52 0x11dde62ae in WebCore::IndentOutdentCommand::formatSelection(WebCore::VisiblePosition const&, WebCore::VisiblePosition const&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x26d62ae)
    #53 0x11b9803f7 in WebCore::ApplyBlockElementCommand::doApply() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x2703f7)
    #54 0x11bfa0e59 in WebCore::CompositeEditCommand::apply() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x890e59)
    #55 0x11ccf5b45 in WebCore::executeIndent(WebCore::Frame&, WebCore::Event*, WebCore::EditorCommandSource, WTF::String const&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x15e5b45)
    #56 0x11ccf1afb in WebCore::Editor::Command::execute(WTF::String const&, WebCore::Event*) const (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x15e1afb)
    #57 0x11c951441 in WebCore::Document::execCommand(WTF::String const&, bool, WTF::String const&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1241441)
    #58 0x11e67f628 in WebCore::jsDocumentPrototypeFunctionExecCommandBody(JSC::ExecState*, WebCore::JSDocument*, JSC::ThrowScope&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x2f6f628)
    #59 0x11e6332d9 in long long WebCore::IDLOperation<WebCore::JSDocument>::call<&(WebCore::jsDocumentPrototypeFunctionExecCommandBody(JSC::ExecState*, WebCore::JSDocument*, JSC::ThrowScope&)), (WebCore::CastedThisErrorBehavior)0>(JSC::ExecState&, char const*) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x2f232d9)
    #60 0x11e632eeb in WebCore::jsDocumentPrototypeFunctionExecCommand(JSC::ExecState*) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x2f22eeb)
    #61 0x23329fc01027  (<unknown module>)
    #62 0x13678b432 in llint_entry (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x290f432)
    #63 0x136783a96 in vmEntryToJavaScript (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x2907a96)
    #64 0x13618a4af in JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x230e4af)
    #65 0x136099873 in JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x221d873)
    #66 0x134940f0a in JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0xac4f0a)
    #67 0x134941487 in JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0xac5487)
    #68 0x134941ffd in JSC::profiledCall(JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0xac5ffd)
    #69 0x11e398670 in WebCore::JSMainThreadExecState::profiledCall(JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x2c88670)
    #70 0x11ec10459 in WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext*, WebCore::Event*) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x3500459)
    #71 0x11ce11119 in WebCore::EventTarget::fireEventListeners(WebCore::Event&, WTF::Vector<WTF::RefPtr<WebCore::RegisteredEventListener>, 1ul, WTF::CrashOnOverflow, 16ul>) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1701119)
    #72 0x11ce10945 in WebCore::EventTarget::fireEventListeners(WebCore::Event&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1700945)
    #73 0x11cbc776a in WebCore::DOMWindow::dispatchEvent(WebCore::Event&, WebCore::EventTarget*) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x14b776a)
    #74 0x11cbe56a6 in WebCore::DOMWindow::dispatchLoadEvent() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x14d56a6)
    #75 0x11c930dcc in WebCore::Document::dispatchWindowLoadEvent() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1220dcc)
    #76 0x11c923301 in WebCore::Document::implicitClose() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1213301)
    #77 0x11d2af482 in WebCore::FrameLoader::checkCallImplicitClose() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1b9f482)
    #78 0x11d2aec02 in WebCore::FrameLoader::checkCompleted() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1b9ec02)
    #79 0x11d2aacbb in WebCore::FrameLoader::finishedParsing() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1b9acbb)
    #80 0x11c955ecc in WebCore::Document::finishedParsing() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1245ecc)
    #81 0x11d70cf95 in WebCore::HTMLConstructionSite::finishedParsing() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1ffcf95)
    #82 0x11da23f27 in WebCore::HTMLTreeBuilder::finished() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x2313f27)
    #83 0x11d78783b in WebCore::HTMLDocumentParser::end() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x207783b)
    #84 0x11d781f06 in WebCore::HTMLDocumentParser::attemptToRunDeferredScriptsAndEnd() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x2071f06)
    #85 0x11d781abd in WebCore::HTMLDocumentParser::prepareToStopParsing() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x2071abd)
    #86 0x11d78795b in WebCore::HTMLDocumentParser::attemptToEnd() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x207795b)
    #87 0x11d787a97 in WebCore::HTMLDocumentParser::finish() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x2077a97)
    #88 0x11cb2c7af in WebCore::DocumentWriter::end() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x141c7af)
    #89 0x11ca77696 in WebCore::DocumentLoader::finishedLoading() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1367696)
    #90 0x11ca77092 in WebCore::DocumentLoader::notifyFinished(WebCore::CachedResource&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1367092)
    #91 0x11bd2a2e3 in WebCore::CachedResource::checkNotify() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x61a2e3)
    #92 0x11bd2a973 in WebCore::CachedResource::finishLoading(WebCore::SharedBuffer*) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x61a973)
    #93 0x11bd1b401 in WebCore::CachedRawResource::finishLoading(WebCore::SharedBuffer*) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x60b401)
    #94 0x1223c37e1 in WebCore::SubresourceLoader::didFinishLoading(WebCore::NetworkLoadMetrics const&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x6cb37e1)
    #95 0x11055d56b in WebKit::WebResourceLoader::didFinishResourceLoad(WebCore::NetworkLoadMetrics const&) (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x1f3956b)
    #96 0x11056a2b9 in void IPC::callMemberFunctionImpl<WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&), std::__1::tuple<WebCore::NetworkLoadMetrics>, 0ul>(WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&), std::__1::tuple<WebCore::NetworkLoadMetrics>&&, std::__1::integer_sequence<unsigned long, 0ul>) (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x1f462b9)
    #97 0x110569ec4 in void IPC::callMemberFunction<WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&), std::__1::tuple<WebCore::NetworkLoadMetrics>, std::__1::integer_sequence<unsigned long, 0ul> >(std::__1::tuple<WebCore::NetworkLoadMetrics>&&, WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)) (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x1f45ec4)
    #98 0x110566f68 in void IPC::handleMessage<Messages::WebResourceLoader::DidFinishResourceLoad, WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)>(IPC::Decoder&, WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)) (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x1f42f68)
    #99 0x11056512a in WebKit::WebResourceLoader::didReceiveWebResourceLoaderMessage(IPC::Connection&, IPC::Decoder&) (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x1f4112a)
    #100 0x10eedb2ac in WebKit::NetworkProcessConnection::didReceiveMessage(IPC::Connection&, IPC::Decoder&) (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x8b72ac)
    #101 0x10e82faaa in IPC::Connection::dispatchMessage(IPC::Decoder&) (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x20baaa)
    #102 0x10e814104 in IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >) (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x1f0104)
    #103 0x10e830795 in IPC::Connection::dispatchOneMessage() (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x20c795)
    #104 0x10e86f39c in IPC::Connection::enqueueIncomingMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >)::$_14::operator()() (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x24b39c)
    #105 0x10e86f2c8 in WTF::Function<void ()>::CallableWrapper<IPC::Connection::enqueueIncomingMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >)::$_14>::call() (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x24b2c8)
    #106 0x13745ba30 in WTF::Function<void ()>::operator()() const (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x35dfa30)
    #107 0x1374aa7d0 in WTF::RunLoop::performWork() (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x362e7d0)
    #108 0x1374ab801 in WTF::RunLoop::performWork(void*) (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x362f801)
    #109 0x7fffabc81320 in __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0xa7320)
    #110 0x7fffabc6221c in __CFRunLoopDoSources0 (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0x8821c)
    #111 0x7fffabc61715 in __CFRunLoopRun (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0x87715)
    #112 0x7fffabc61113 in CFRunLoopRunSpecific (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0x87113)
    #113 0x7fffab1c2ebb in RunCurrentEventLoopInMode (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox+0x30ebb)
    #114 0x7fffab1c2cf0 in ReceiveNextEventCommon (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox+0x30cf0)
    #115 0x7fffab1c2b25 in _BlockUntilNextEventMatchingListInModeWithFilter (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox+0x30b25)
    #116 0x7fffa975ba53 in _DPSNextEvent (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit+0x46a53)
    #117 0x7fffa9ed77ed in -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit+0x7c27ed)
    #118 0x7fffa97503da in -[NSApplication run] (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit+0x3b3da)
    #119 0x7fffa971ae0d in NSApplicationMain (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit+0x5e0d)
    #120 0x7fffc16348c6 in _xpc_objc_main (/usr/lib/system/libxpc.dylib+0x108c6)
    #121 0x7fffc16332e3 in xpc_main (/usr/lib/system/libxpc.dylib+0xf2e3)
    #122 0x10e60df22 in main (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent.Development+0x100001f22)
    #123 0x7fffc13db234 in start (/usr/lib/system/libdyld.dylib+0x5234)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x3554f48) in WTFCrash
==20155==ABORTING
#CRASHED - com.apple.WebKit.WebContent.Development (pid 20155)
LEAK: 1 WebProcessPool
LEAK: 1 WebPageProxy

[Michael Catanzaro]

This one is really annoying! Thanks for posting a reduction. Your fuzzer is awesome.