RESOLVED FIXED283346
REGRESSION(286771@main): ASSERTION FAILED: &object == m_impl->template get<T>() in WTF::WeakPtr<WebCore::WebAnimation, WebCore::WeakPtrImplWithEventTargetData>::WeakPtr(const T &, EnableWeakPtrThreadingAssertions) under AnimationTimelinesController::setTi 
https://bugs.webkit.org/show_bug.cgi?id=283346
Summary REGRESSION(286771@main): ASSERTION FAILED: &object == m_impl->template get<T>...
Fujii Hironori
Reported 2024-11-18 21:18:06 PST
After 286771@main (bug#282072), Debug builds are crashing for imported/w3c/web-platform-tests/scroll-animations/css/scroll-timeline-dynamic.tentative.html History: https://results.webkit.org/?suite=layout-tests&test=imported%2Fw3c%2Fweb-platform-tests%2Fscroll-animations%2Fcss%2Fscroll-timeline-dynamic.tentative.html&style=debug https://build.webkit.org/results/Apple-Sonoma-Debug-WK2-Tests/286771@main%20(2779)/imported/w3c/web-platform-tests/scroll-animations/css/scroll-timeline-dynamic.tentative-crash-log.txt ASSERTION FAILED: &object == m_impl->template get<T>() /Volumes/Data/worker/Apple-Sonoma-Debug-Build/build/WebKitBuild/Debug/usr/local/include/wtf/WeakPtr.h(69) : WTF::WeakPtr<WebCore::WebAnimation, WebCore::WeakPtrImplWithEventTargetData>::WeakPtr(const T &, EnableWeakPtrThreadingAssertions) [T = WebCore::WebAnimation, WeakPtrImpl = WebCore::WeakPtrImplWithEventTargetData, PtrTraits = WTF::RawPtrTraits<WebCore::WeakPtrImplWithEventTargetData>] 1 0x1d291a5e2 WTF::WeakPtr<WebCore::WebAnimation, WebCore::WeakPtrImplWithEventTargetData, WTF::RawPtrTraits<WebCore::WeakPtrImplWithEventTargetData>>::WeakPtr<void>(WebCore::WebAnimation const&, WTF::EnableWeakPtrThreadingAssertions) 2 0x1d28fefcc WTF::WeakPtr<WebCore::WebAnimation, WebCore::WeakPtrImplWithEventTargetData, WTF::RawPtrTraits<WebCore::WeakPtrImplWithEventTargetData>>::WeakPtr<void>(WebCore::WebAnimation const&, WTF::EnableWeakPtrThreadingAssertions) 3 0x1d28fe069 WebCore::AnimationTimelinesController::setTimelineForName(WTF::AtomString const&, WebCore::Element const&, WebCore::WebAnimation&) 4 0x1d28fdcb0 WebCore::AnimationTimelinesController::attachPendingOperations() 5 0x1d28fda6c WebCore::AnimationTimelinesController::registerNamedScrollTimeline(WTF::AtomString const&, WebCore::Element const&, WebCore::ScrollAxis) 6 0x1d5a28deb WebCore::Styleable::updateCSSScrollTimelines(WebCore::RenderStyle const*, WebCore::RenderStyle const&) const::$_41::operator()() const 7 0x1d5a28ac2 WebCore::Styleable::updateCSSScrollTimelines(WebCore::RenderStyle const*, WebCore::RenderStyle const&) const 8 0x1d5a1f300 WebCore::Style::TreeResolver::createAnimatedElementUpdate(WebCore::Style::ResolvedStyle&&, WebCore::Styleable const&, WebCore::Style::Change, WebCore::Style::ResolutionContext const&, WebCore::Style::IsInDisplayNoneTree)::$_25::operator()() const 9 0x1d5a1ce36 WebCore::Style::TreeResolver::createAnimatedElementUpdate(WebCore::Style::ResolvedStyle&&, WebCore::Styleable const&, WebCore::Style::Change, WebCore::Style::ResolutionContext const&, WebCore::Style::IsInDisplayNoneTree) 10 0x1d5a1c1f8 WebCore::Style::TreeResolver::resolveElement(WebCore::Element&, WebCore::RenderStyle const*, WebCore::Style::TreeResolver::ResolutionType) 11 0x1d5a218ca WebCore::Style::TreeResolver::resolveComposedTree() 12 0x1d5a2309b WebCore::Style::TreeResolver::resolve() 13 0x1d36fe0c8 WebCore::Document::resolveStyle(WebCore::Document::ResolveStyleType) 14 0x1d36feedc WebCore::Document::updateStyleIfNeeded() 15 0x1d2a13b75 WebCore::StyleOriginatedAnimation::flushPendingStyleChanges() const 16 0x1d2a13d59 WebCore::StyleOriginatedAnimation::bindingsReady() 17 0x1d143af0c WebCore::jsWebAnimation_readyGetter(JSC::JSGlobalObject&, WebCore::JSWebAnimation&)::'lambda'()::operator()() const 18 0x1d143ae89 JSC::JSValue WebCore::toJS<WebCore::IDLPromise<WebCore::IDLInterface<WebCore::WebAnimation>>, WebCore::jsWebAnimation_readyGetter(JSC::JSGlobalObject&, WebCore::JSWebAnimation&)::'lambda'()>(JSC::JSGlobalObject&, WebCore::JSDOMGlobalObject&, JSC::ThrowScope&, WebCore::jsWebAnimation_readyGetter(JSC::JSGlobalObject&, WebCore::JSWebAnimation&)::'lambda'()&&) 19 0x1d143ae21 WebCore::jsWebAnimation_readyGetter(JSC::JSGlobalObject&, WebCore::JSWebAnimation&) 20 0x1d137cc78 long long WebCore::IDLAttribute<WebCore::JSWebAnimation>::get<&WebCore::jsWebAnimation_readyGetter(JSC::JSGlobalObject&, WebCore::JSWebAnimation&), (WebCore::CastedThisErrorBehavior)2>(JSC::JSGlobalObject&, long long, JSC::PropertyName) 21 0x1d137cb2d WebCore::jsWebAnimation_ready(JSC::JSGlobalObject*, long long, JSC::PropertyName) 22 0x133867492 WTF::FunctionPtr<(WTF::PtrTag)57072, long long (JSC::JSGlobalObject*, long long, JSC::PropertyName), (WTF::FunctionAttributes)1>::operator()(JSC::JSGlobalObject*, long long, JSC::PropertyName) const 23 0x133b6e3ae JSC::PropertySlot::customGetter(JSC::VM&, JSC::PropertyName) const 24 0x132e466c6 JSC::PropertySlot::getValue(JSC::JSGlobalObject*, JSC::PropertyName) const 25 0x13361bff1 JSC::JSValue::get(JSC::JSGlobalObject*, JSC::PropertyName, JSC::PropertySlot&) const 26 0x13353da35 JSC::LLInt::performLLIntGetByID(JSC::BytecodeIndex, JSC::CodeBlock*, JSC::JSGlobalObject*, JSC::JSValue, JSC::Identifier const&, JSC::GetByIdModeMetadata&) 27 0x13353d7ef llint_slow_path_get_by_id 28 0x1344b6f61 llint_entry 29 0x16f15d507 28 ??? 0x000000016f15d507 0x0 + 6158669063 30 0x1344d2bff llint_entry 31 0x1344d1893 llint_entry com.apple.WebKit.WebContent.Development terminated (pid 93478) for reason: crash LEAK: 1 WebPageProxy
Attachments
Add attachment proposed patch, testcase, etc.
Radar WebKit Bug Importer
Comment 1 2024-11-18 23:52:26 PST
<rdar://problem/140180425>
Nikos Mouchtaris
Comment 2 2024-11-19 13:51:34 PST
Pull request: https://github.com/WebKit/WebKit/pull/36863
EWS
Comment 3 2024-11-21 13:02:13 PST
Committed 286920@main (b364108c2896): <https://commits.webkit.org/286920@main> Reviewed commits have been landed. Closing PR #36863 and removing active labels.
Note You need to log in before you can comment on or make changes to this bug.