Bug 269322 - Crash under ~RenderMenuList due to CheckedPtr usage
Summary: Crash under ~RenderMenuList due to CheckedPtr usage
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Layout and Rendering (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Chris Dumez
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2024-02-13 14:32 PST by Chris Dumez
Modified: 2024-02-13 15:25 PST (History)
4 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Chris Dumez 2024-02-13 14:32:13 PST 
Crash under ~RenderMenuList due to CheckedPtr usage:
```
Thread 0 Crashed::  Dispatch queue: com.apple.main-thread
0   WebCore                       	       0x1102c25d0 WTFCrashWithInfo(int, char const*, char const*, int) + 20
1   WebCore                       	       0x11014882c WebCore::RenderLayerModelObject::~RenderLayerModelObject() + 604
2   WebCore                       	       0x110280864 WebCore::RenderMenuList::~RenderMenuList() + 16
3   WebCore                       	       0x1127bed30 WebCore::RenderTreeBuilder::destroy(WebCore::RenderObject&, WebCore::RenderTreeBuilder::CanCollapseAnonymousBlock) + 964
4   WebCore                       	       0x1127c9c1c WebCore::RenderTreeBuilder::destroyAndCleanUpAnonymousWrappers(WebCore::RenderObject&) + 344
5   WebCore                       	       0x1127d7bc8 WebCore::RenderTreeUpdater::tearDownRenderers(WebCore::Element&, WebCore::RenderTreeUpdater::TeardownType, WebCore::RenderTreeBuilder&) + 1460
6   WebCore                       	       0x1127d8de8 WebCore::RenderTreeUpdater::tearDownRenderers(WebCore::Element&) + 84
7   WebCore                       	       0x11198a924 WebCore::ContainerNode::removeBetween(WebCore::Node*, WebCore::Node*, WebCore::Node&) + 312
8   WebCore                       	       0x111986530 WebCore::ContainerNode::removeChild(WebCore::Node&) + 552
9   WebCore                       	       0x110bae9b0 WebCore::jsNodePrototypeFunction_removeChild(JSC::JSGlobalObject*, JSC::CallFrame*) + 504
```
Comment 1 Chris Dumez 2024-02-13 14:32:21 PST 
<rdar://119790256>
Comment 2 Chris Dumez 2024-02-13 14:37:14 PST 
Pull request: https://github.com/WebKit/WebKit/pull/24372
Comment 3 EWS 2024-02-13 15:25:12 PST 
Committed 274586@main (35318b4d5407): <https://commits.webkit.org/274586@main>

Reviewed commits have been landed. Closing PR #24372 and removing active labels.