RESOLVED FIXED261886
Regression(268215@main): imported/w3c/web-platform-tests/css/css-transitions/changing-while-transition-001.html is flakily crashing 
https://bugs.webkit.org/show_bug.cgi?id=261886
Summary Regression(268215@main): imported/w3c/web-platform-tests/css/css-transitions/...
Chris Dumez
Reported 2023-09-21 08:57:01 PDT
imported/w3c/web-platform-tests/css/css-transitions/changing-while-transition-001.html is flakily crashing after the smart pointer adoption work: ``` Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.WebCore 0x123d09114 WTFCrashWithInfo(int, char const*, char const*, int) 1 com.apple.WebCore 0x123939870 WebCore::EventTarget::~EventTarget() 2 com.apple.WebCore 0x123b010e4 WebCore::HTMLDivElement::~HTMLDivElement() 3 com.apple.WebCore 0x1236bdbe0 WebCore::CSSComputedStyleDeclaration::deref() 4 com.apple.JavaScriptCore 0x115c39a00 void JSC::MarkedBlock::Handle::specializedSweep<true, (JSC::MarkedBlock::Handle::EmptyMode)1, (JSC::MarkedBlock::Handle::SweepMode)0, (JSC::MarkedBlock::Handle::SweepDestructionMode)1, (JSC::MarkedBlock::Handle::ScribbleMode)0, (JSC::MarkedBlock::Handle::NewlyAllocatedMode)1, (JSC::MarkedBlock::Handle::MarksMode)1, JSC::JSDestructibleObjectDestroyFunc>(JSC::FreeList*, JSC::MarkedBlock::Handle::EmptyMode, JSC::MarkedBlock::Handle::SweepMode, JSC::MarkedBlock::Handle::SweepDestructionMode, JSC::MarkedBlock::Handle::ScribbleMode, JSC::MarkedBlock::Handle::NewlyAllocatedMode, JSC::MarkedBlock::Handle::MarksMode, JSC::JSDestructibleObjectDestroyFunc const&) 5 com.apple.JavaScriptCore 0x115c38100 void JSC::MarkedBlock::Handle::finishSweepKnowingHeapCellType<JSC::JSDestructibleObjectDestroyFunc>(JSC::FreeList*, JSC::JSDestructibleObjectDestroyFunc const&)::'lambda'()::operator()() const 6 com.apple.JavaScriptCore 0x115c33bc4 void JSC::MarkedBlock::Handle::finishSweepKnowingHeapCellType<JSC::JSDestructibleObjectDestroyFunc>(JSC::FreeList*, JSC::JSDestructibleObjectDestroyFunc const&) 7 com.apple.JavaScriptCore 0x115c33a94 JSC::JSDestructibleObjectHeapCellType::finishSweep(JSC::MarkedBlock::Handle&, JSC::FreeList*) const 8 com.apple.JavaScriptCore 0x1158be624 JSC::MarkedBlock::Handle::sweep(JSC::FreeList*) ```
Attachments
Add attachment proposed patch, testcase, etc.
Chris Dumez
Comment 1 2023-09-21 10:10:54 PDT
Pull request: https://github.com/WebKit/WebKit/pull/18025
EWS
Comment 2 2023-09-21 10:14:13 PDT
Committed 268260@main (92891095fc28): <https://commits.webkit.org/268260@main> Reviewed commits have been landed. Closing PR #18025 and removing active labels.
Radar WebKit Bug Importer
Comment 3 2023-09-21 10:15:15 PDT
<rdar://problem/115848569>
Note You need to log in before you can comment on or make changes to this bug.