RESOLVED FIXED 268329
REGRESSION (273601@main): InspectorInstrumentation::instrumentingAgents() cannot use RefPtr for document 
https://bugs.webkit.org/show_bug.cgi?id=268329
Summary REGRESSION (273601@main): InspectorInstrumentation::instrumentingAgents() can...
Marta Darbinyan
Reported 2024-01-29 13:54:38 PST
Description: inspector/canvas/create-context-2d.html inspector/canvas/resolveContext-2d.html are flaky crash on macOS ToT. Suspecting 273601@main is the changed who intaduced the regression. This issue can be bisected to <commit> using the command: run-webkit-tests --root --exit-after-n-failures 1 --debug <test> History: https://results.webkit.org/?suite=layout-tests&suite=layout-tests&test=inspector%2Fcanvas%2FresolveContext-2d.html&test=inspector%2Fcanvas%2Fcreate-context-2d.html&style=debug Crash Log: stderr: 2024-01-29 11:50:18.729 DumpRenderTree[85083:1793608] nil host used in call to allowsSpecificHTTPSCertificateForHost 2024-01-29 11:50:18.729 DumpRenderTree[85083:1793608] nil host used in call to allowsAnyHTTPSCertificateForHost: 2024-01-29 11:50:18.771 DumpRenderTree[85083:1793608] nil host used in call to allowsSpecificHTTPSCertificateForHost 2024-01-29 11:50:18.771 DumpRenderTree[85083:1793608] nil host used in call to allowsAnyHTTPSCertificateForHost: 2024-01-29 11:50:18.773 DumpRenderTree[85083:1793608] nil host used in call to allowsSpecificHTTPSCertificateForHost 2024-01-29 11:50:18.773 DumpRenderTree[85083:1793608] nil host used in call to allowsAnyHTTPSCertificateForHost: 2024-01-29 11:50:18.792 DumpRenderTree[85083:1793608] nil host used in call to allowsSpecificHTTPSCertificateForHost 2024-01-29 11:50:18.792 DumpRenderTree[85083:1793608] nil host used in call to allowsAnyHTTPSCertificateForHost: 2024-01-29 11:50:18.812 DumpRenderTree[85083:1793608] nil host used in call to allowsSpecificHTTPSCertificateForHost 2024-01-29 11:50:18.812 DumpRenderTree[85083:1793608] nil host used in call to allowsAnyHTTPSCertificateForHost: ASSERTION FAILED: !m_inRemovedLastRefFunction /Volumes/Data/worker/Apple-Monterey-Debug-Build/build/Source/WebCore/dom/Node.h(798) : void WebCore::Node::ref() const 1 0x12bead3b9 WTFCrash 2 0x18cf42d2b WTFCrashWithInfo(int, char const*, char const*, int) 3 0x18d0f6293 WebCore::Node::ref() const 4 0x18d0f615e WTF::DefaultRefDerefTraits<WebCore::Document>::refIfNotNull(WebCore::Document*) 5 0x18d0f6111 WTF::RefPtr<WebCore::Document, WTF::RawPtrTraits<WebCore::Document>, WTF::DefaultRefDerefTraits<WebCore::Document> >::RefPtr(WebCore::Document*) 6 0x18d0f49fd WTF::RefPtr<WebCore::Document, WTF::RawPtrTraits<WebCore::Document>, WTF::DefaultRefDerefTraits<WebCore::Document> >::RefPtr(WebCore::Document*) 7 0x191cef971 WebCore::InspectorInstrumentation::instrumentingAgents(WebCore::ScriptExecutionContext&) 8 0x19068b840 WebCore::InspectorInstrumentation::instrumentingAgents(WebCore::ScriptExecutionContext*) 9 0x191774212 WebCore::InspectorInstrumentation::didChangeCanvasMemory(WebCore::CanvasRenderingContext&) 10 0x191773fa2 WebCore::CanvasBase::setImageBuffer(WTF::RefPtr<WebCore::ImageBuffer, WTF::RawPtrTraits<WebCore::ImageBuffer>, WTF::DefaultRefDerefTraits<WebCore::ImageBuffer> >&&) const 11 0x19182d3c5 WebCore::HTMLCanvasElement::createImageBuffer() const 12 0x191772422 WebCore::CanvasBase::buffer() const 13 0x191a7426d WebCore::CanvasRenderingContext2DBase::needsPreparationForDisplay() const 14 0x19182b761 WebCore::HTMLCanvasElement::needsPreparationForDisplay() 15 0x19182dbc4 WebCore::HTMLCanvasElement::removedFromAncestor(WebCore::Node::RemovalType, WebCore::ContainerNode&) 16 0x191148028 WebCore::notifyNodeRemovedFromDocument(WebCore::ContainerNode&, WebCore::TreeScopeChange, WebCore::Node&) 17 0x19114810a WebCore::notifyNodeRemovedFromDocument(WebCore::ContainerNode&, WebCore::TreeScopeChange, WebCore::Node&) 18 0x19114810a WebCore::notifyNodeRemovedFromDocument(WebCore::ContainerNode&, WebCore::TreeScopeChange, WebCore::Node&) 19 0x191147ebc WebCore::notifyChildNodeRemoved(WebCore::ContainerNode&, WebCore::Node&) 20 0x191140cb4 WebCore::removeDetachedChildrenInContainer(WebCore::ContainerNode&) 21 0x191140ad0 WebCore::ContainerNode::removeDetachedChildren() 22 0x1911ce9f0 WebCore::Document::removedLastRef() 23 0x19141589e WebCore::Node::removedLastRef() 24 0x18d0f7bfc WebCore::Node::deref() const 25 0x18d6a255f WebCore::EventTarget::deref() 26 0x18d6a24e9 WTF::Ref<WebCore::EventTarget, WTF::RawPtrTraits<WebCore::EventTarget> >::~Ref() 27 0x18d6a2265 WTF::Ref<WebCore::EventTarget, WTF::RawPtrTraits<WebCore::EventTarget> >::~Ref() 28 0x18ddde4f9 WebCore::JSDOMWrapper<WebCore::EventTarget, WTF::RawPtrTraits<WebCore::EventTarget> >::~JSDOMWrapper() 29 0x18ddde4d5 WebCore::JSEventTarget::~JSEventTarget() 30 0x18dd65755 WebCore::JSEventTarget::~JSEventTarget() 31 0x18dd0bccd WebCore::JSEventTarget::destroy(JSC::JSCell*) Link: https://build.webkit.org/results/Apple-Monterey-Debug-WK1-Tests/273666@main%20(8786)/inspector/canvas/create-context-2d-crash-log.txt
Attachments
Add attachment proposed patch, testcase, etc.
Radar WebKit Bug Importer
Comment 1 2024-01-29 13:55:07 PST
<rdar://problem/121879996>
EWS
Comment 2 2024-01-29 17:15:32 PST
Test gardening commit 273706@main (577579bbd87a): <https://commits.webkit.org/273706@main> Reviewed commits have been landed. Closing PR #23481 and removing active labels.
Anne van Kesteren
Comment 3 2024-01-30 00:31:51 PST
Pull request: https://github.com/WebKit/WebKit/pull/23495
EWS
Comment 4 2024-01-30 08:53:08 PST
Committed 273759@main (d1ec9ec68ba1): <https://commits.webkit.org/273759@main> Reviewed commits have been landed. Closing PR #23495 and removing active labels.
Note You need to log in before you can comment on or make changes to this bug.