RESOLVED FIXED 270379
Assertion failure in ~CompletionHandler() via ImageBitmap::createCompletionHandler 
https://bugs.webkit.org/show_bug.cgi?id=270379
Summary Assertion failure in ~CompletionHandler() via ImageBitmap::createCompletionHa...
Ryosuke Niwa
Reported 2024-03-01 14:18:33 PST
e.g. 0 JavaScriptCore 0x13a7655e8 WTFCrash + 24 (Assertions.cpp:351) 1 WebCore 0x28250ad38 WTF::CompletionHandler<void (WebCore::ExceptionOr<WTF::Ref<WebCore::ImageBitmap, WTF::RawPtrTraits<WebCore::ImageBitmap>, WTF::DefaultRefDerefTraits<WebCore::ImageBitmap>>>&&)>::~CompletionHandler() + 92 (CompletionHandler.h:65) 2 WebCore 0x2824f9e80 WTF::CompletionHandler<void (WebCore::ExceptionOr<WTF::Ref<WebCore::ImageBitmap, WTF::RawPtrTraits<WebCore::ImageBitmap>, WTF::DefaultRefDerefTraits<WebCore::ImageBitmap>>>&&)>::~CompletionHandler() + 32 (CompletionHandler.h:64) 3 WebCore 0x284624974 WebCore::ImageBitmap::createPromise(WebCore::ScriptExecutionContext&, std::__1::variant<WTF::RefPtr<WebCore::HTMLImageElement, WTF::RawPtrTraits<WebCore::HTMLImageElement>, WTF::DefaultRefDerefTraits<WebCore::HTMLImageElement>>, WTF::RefPtr<WebCore::HTMLVideoElement, WTF::RawPtrTraits<WebCore::HTMLVideoElement>, WTF::DefaultRefDerefTraits<WebCore::HTMLVideoElement>>, WTF::RefPtr<WebCore::HTMLCanvasElement, WTF::RawPtrTraits<WebCore::HTMLCanvasElement>, WTF::DefaultRefDerefTraits<WebCore::HTMLCanvasElement>>, WTF::RefPtr<WebCore::SVGImageElement, WTF::RawPtrTraits<WebCore::SVGImageElement>, WTF::DefaultRefDerefTraits<WebCore::SVGImageElement>>, WTF::RefPtr<WebCore::ImageBitmap, WTF::RawPtrTraits<WebCore::ImageBitmap>, WTF::DefaultRefDerefTraits<WebCore::ImageBitmap>>, WTF::RefPtr<WebCore::OffscreenCanvas, WTF::RawPtrTraits<WebCore::OffscreenCanvas>, WTF::DefaultRefDerefTraits<WebCore::OffscreenCanvas>>, WTF::RefPtr<WebCore::CSSStyleImageValue, WTF::RawPtrTraits<WebCore::CSSStyleImageValue>, WTF::DefaultRefDerefTraits<WebCore::CSSStyleImageValue>>, WTF::RefPtr<WebCore::WebCodecsVideoFrame, WTF::RawPtrTraits<WebCore::WebCodecsVideoFrame>, WTF::DefaultRefDerefTraits<WebCore::WebCodecsVideoFrame>>, WTF::RefPtr<WebCore::Blob, WTF::RawPtrTraits<WebCore::Blob>, WTF::DefaultRefDerefTraits<WebCore::Blob>>, WTF::RefPtr<WebCore::ImageData, WTF::RawPtrTraits<WebCore::ImageData>, WTF::DefaultRefDerefTraits<WebCore::ImageData>>>&&, WebCore::ImageBitmapOptions&&, WebCore::DOMPromiseDeferred<WebCore::IDLInterface<WebCore::ImageBitmap>>&&) + 156 (ImageBitmap.cpp:138) 4 WebCore 0x284fb4080 WebCore::LocalDOMWindow::createImageBitmap(std::__1::variant<WTF::RefPtr<WebCore::HTMLImageElement, WTF::RawPtrTraits<WebCore::HTMLImageElement>, WTF::DefaultRefDerefTraits<WebCore::HTMLImageElement>>, WTF::RefPtr<WebCore::HTMLVideoElement, WTF::RawPtrTraits<WebCore::HTMLVideoElement>, WTF::DefaultRefDerefTraits<WebCore::HTMLVideoElement>>, WTF::RefPtr<WebCore::HTMLCanvasElement, WTF::RawPtrTraits<WebCore::HTMLCanvasElement>, WTF::DefaultRefDerefTraits<WebCore::HTMLCanvasElement>>, WTF::RefPtr<WebCore::SVGImageElement, WTF::RawPtrTraits<WebCore::SVGImageElement>, WTF::DefaultRefDerefTraits<WebCore::SVGImageElement>>, WTF::RefPtr<WebCore::ImageBitmap, WTF::RawPtrTraits<WebCore::ImageBitmap>, WTF::DefaultRefDerefTraits<WebCore::ImageBitmap>>, WTF::RefPtr<WebCore::OffscreenCanvas, WTF::RawPtrTraits<WebCore::OffscreenCanvas>, WTF::DefaultRefDerefTraits<WebCore::OffscreenCanvas>>, WTF::RefPtr<WebCore::CSSStyleImageValue, WTF::RawPtrTraits<WebCore::CSSStyleImageValue>, WTF::DefaultRefDerefTraits<WebCore::CSSStyleImageValue>>, WTF::RefPtr<WebCore::WebCodecsVideoFrame, WTF::RawPtrTraits<WebCore::WebCodecsVideoFrame>, WTF::DefaultRefDerefTraits<WebCore::WebCodecsVideoFrame>>, WTF::RefPtr<WebCore::Blob, WTF::RawPtrTraits<WebCore::Blob>, WTF::DefaultRefDerefTraits<WebCore::Blob>>, WTF::RefPtr<WebCore::ImageData, WTF::RawPtrTraits<WebCore::ImageData>, WTF::DefaultRefDerefTraits<WebCore::ImageData>>>&&, WebCore::ImageBitmapOptions&&, WebCore::DOMPromiseDeferred<WebCore::IDLInterface<WebCore::ImageBitmap>>&&) + 132 (LocalDOMWindow.cpp:1932) 5 WebCore 0x281497580 WebCore::jsLocalDOMWindowInstanceFunction_createImageBitmap1Body(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSLocalDOMWindow*, WTF::Ref<WebCore::DeferredPromise, WTF::RawPtrTraits<WebCore::DeferredPromise>, WTF::DefaultRefDerefTraits<WebCore::DeferredPromise>>&&)::'lambda'()::operator()() const + 84 (JSLocalDOMWindow.cpp:27907) 6 WebCore 0x2814974dc JSC::JSValue WebCore::toJS<WebCore::IDLPromise<WebCore::IDLInterface<WebCore::ImageBitmap>>, WebCore::jsLocalDOMWindowInstanceFunction_createImageBitmap1Body(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSLocalDOMWindow*, WTF::Ref<WebCore::DeferredPromise, WTF::RawPtrTraits<WebCore::DeferredPromise>, WTF::DefaultRefDerefTraits<WebCore::DeferredPromise>>&&)::'lambda'()>(JSC::JSGlobalObject&, WebCore::JSDOMGlobalObject&, JSC::ThrowScope&, WebCore::jsLocalDOMWindowInstanceFunction_createImageBitmap1Body(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSLocalDOMWindow*, WTF::Ref<WebCore::DeferredPromise, WTF::RawPtrTraits<WebCore::DeferredPromise>, WTF::DefaultRefDerefTraits<WebCore::DeferredPromise>>&&)::'lambda'()&&) + 40 (JSDOMConvertBase.h:195) 7 WebCore 0x281496b88 WebCore::jsLocalDOMWindowInstanceFunction_createImageBitmap1Body(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSLocalDOMWindow*, WTF::Ref<WebCore::DeferredPromise, WTF::RawPtrTraits<WebCore::DeferredPromise>, WTF::DefaultRefDerefTraits<WebCore::DeferredPromise>>&&) + 812 (JSLocalDOMWindow.cpp:27907) 8 WebCore 0x281496464 WebCore::jsLocalDOMWindowInstanceFunction_createImageBitmapOverloadDispatcher(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSLocalDOMWindow*, WTF::Ref<WebCore::DeferredPromise, WTF::RawPtrTraits<WebCore::DeferredPromise>, WTF::DefaultRefDerefTraits<WebCore::DeferredPromise>>&&) + 412 (JSLocalDOMWindow.cpp:27950) 9 WebCore 0x281497950 long long WebCore::IDLOperationReturningPromise<WebCore::JSLocalDOMWindow>::call<&WebCore::jsLocalDOMWindowInstanceFunction_createImageBitmapOverloadDispatcher(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSLocalDOMWindow*, WTF::Ref<WebCore::DeferredPromise, WTF::RawPtrTraits<WebCore::DeferredPromise>, WTF::DefaultRefDerefTraits<WebCore::DeferredPromise>>&&), (WebCore::CastedThisErrorBehavior)2>(JSC::JSGlobalObject&, JSC::CallFrame&, char const*)::'lambda'(JSC::JSGlobalObject&, JSC::CallFrame&, WTF::Ref<WebCore::DeferredPromise, WTF::RawPtrTraits<WebCore::DeferredPromise>, WTF::DefaultRefDerefTraits<WebCore::DeferredPromise>>&&)::operator()(JSC::JSGlobalObject&, JSC::CallFrame&, WTF::Ref<WebCore::DeferredPromise, WTF::RawPtrTraits<WebCore::DeferredPromise>, WTF::DefaultRefDerefTraits<WebCore::DeferredPromise>>&&) const + 516 (JSDOMOperationReturningPromise.h:54) 10 WebCore 0x281496718 JSC::JSValue WebCore::callPromiseFunction<long long WebCore::IDLOperationReturningPromise<WebCore::JSLocalDOMWindow>::call<&WebCore::jsLocalDOMWindowInstanceFunction_createImageBitmapOverloadDispatcher(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSLocalDOMWindow*, WTF::Ref<WebCore::DeferredPromise, WTF::RawPtrTraits<WebCore::DeferredPromise>, WTF::DefaultRefDerefTraits<WebCore::DeferredPromise>>&&), (WebCore::CastedThisErrorBehavior)2>(JSC::JSGlobalObject&, JSC::CallFrame&, char const*)::'lambda'(JSC::JSGlobalObject&, JSC::CallFrame&, WTF::Ref<WebCore::DeferredPromise, WTF::RawPtrTraits<WebCore::DeferredPromise>, WTF::DefaultRefDerefTraits<WebCore::DeferredPromise>>&&)>(JSC::JSGlobalObject&, JSC::CallFrame&, long long WebCore::IDLOperationReturningPromise<WebCore::JSLocalDOMWindow>::call<&WebCore::jsLocalDOMWindowInstanceFunction_createImageBitmapOverloadDispatcher(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSLocalDOMWindow*, WTF::Ref<WebCore::DeferredPromise, WTF::RawPtrTraits<WebCore::DeferredPromise>, WTF::DefaultRefDerefTraits<WebCore::DeferredPromise>>&&), (WebCore::CastedThisErrorBehavior)2>(JSC::JSGlobalObject&, JSC::CallFrame&, char const*)::'lambda'(JSC::JSGlobalObject&, JSC::CallFrame&, WTF::Ref<WebCore::DeferredPromise, WTF::RawPtrTraits<WebCore::DeferredPromise>, WTF::DefaultRefDerefTraits<WebCore::DeferredPromise>>&&)) + 332 (JSDOMPromiseDeferred.h:376) 11 WebCore 0x2814962b0 long long WebCore::IDLOperationReturningPromise<WebCore::JSLocalDOMWindow>::call<&WebCore::jsLocalDOMWindowInstanceFunction_createImageBitmapOverloadDispatcher(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSLocalDOMWindow*, WTF::Ref<WebCore::DeferredPromise, WTF::RawPtrTraits<WebCore::DeferredPromise>, WTF::DefaultRefDerefTraits<WebCore::DeferredPromise>>&&), (WebCore::CastedThisErrorBehavior)2>(JSC::JSGlobalObject&, JSC::CallFrame&, char const*) + 52 (JSDOMOperationReturningPromise.h:41) 12 WebCore 0x281483214 WebCore::jsLocalDOMWindowInstanceFunction_createImageBitmap(JSC::JSGlobalObject*, JSC::CallFrame*) + 44 (JSLocalDOMWindow.cpp:27966) 13 ??? 0x2a61c4044 ???
Attachments
Add attachment proposed patch, testcase, etc.
Ryosuke Niwa
Comment 1 2024-03-01 14:27:00 PST
Pull request: https://github.com/WebKit/WebKit/pull/25365
EWS
Comment 2 2024-03-01 16:41:45 PST
Committed 275581@main (198cfb4f193c): <https://commits.webkit.org/275581@main> Reviewed commits have been landed. Closing PR #25365 and removing active labels.
Radar WebKit Bug Importer
Comment 3 2024-03-01 16:42:24 PST
<rdar://problem/123927125>
Note You need to log in before you can comment on or make changes to this bug.