Bug 303917 – REGRESSION (iOS 26.1): Frequent UI process crashes in WebCore::ElementContext::isSameElement under WKSelectPicker

• Status: RESOLVED
• Resolution: FIXED
• Component: Forms

We started receiving a lot of these crashes on version 26.1 (and it's still happening on version 26.2).
We don't have repro steps for this crash.

We noticed a change that landed ~3 months ago in that area of code that may be causing the crash: https://github.com/WebKit/WebKit/commit/02f7a612039f3c91d767af54ee0212db38436c19

The crashes we're receiving have the following Stack trace:
(WebKit + 0x00656a90)	WebCore::ElementContext::isSameElement(WebCore::ElementContext const&) const
(WebKit + 0x0096d9dc)	__74-[WKSelectPicker contextMenuInteraction:willEndForConfiguration:animator:]_block_invoke
(UIKitCore + 0x0034f930)	-[_UIContextMenuAnimator performAllCompletions]
(UIKitCore + 0x007f26b0)	block_destroy_helper.72
(UIKitCore + 0x007f41f4)	objectdestroy.36Tm
(UIKitCore + 0x007a7d78)	objectdestroy.3Tm
(UIKitCore + 0x005be1b8)	__swift_memcpy192_8
(UIKitCore + 0x00021910)	block_copy_helper.374
(UIKitCore + 0x001dc844)	-[_UIGroupCompletion _performAllCompletions]
(UIKitCore + 0x0035d888)	-[_UIGravityWellEffectBody .cxx_destruct]
(UIKitCore + 0x00215694)	-[UIScrollView _contentLayoutGuideIfExists]
(UIKitCore + 0x000949ec)	NSStringFromUIEdgeInsets
(UIKitCore + 0x00094950)	NSStringFromUIEdgeInsets
(UIKitCore + 0x0008fbb4)	__UIVIEW_IS_EXECUTING_ANIMATION_COMPLETION_BLOCK__
(UIKitCore + 0x0198bd64)	-[UIViewAnimationBlockDelegate _sendDeferredCompletion:]
(libdispatch.dylib + 0x00001ad8)	_dispatch_call_block_and_release
(libdispatch.dylib + 0x0001b7e8)	_dispatch_client_callout
(libdispatch.dylib + 0x00038b20)	_dispatch_main_queue_drain.cold.5
(libdispatch.dylib + 0x00010ec4)	_dispatch_main_queue_drain
(libdispatch.dylib + 0x00010e00)	_dispatch_main_queue_callback_4CF
(CoreFoundation + 0x0006a2c4)	__CFRUNLOOP_IS_SERVICING_THE_MAIN_DISPATCH_QUEUE__
(CoreFoundation + 0x0001db38)	__CFRunLoopRun
(CoreFoundation + 0x0001ca68)	_CFRunLoopRunSpecificWithOptions
(GraphicsServices + 0x00001494)	GSEventRunModal
(UIKitCore + 0x0009e4b4)	-[UIApplication _run]
(UIKitCore + 0x00046b8c)	UIApplicationMain

Please let us know if you need additional information.

[Radar WebKit Bug Importer]

<rdar://problem/166246076>

[Alexey Proskuryakov]

<rdar://problem/163148093>

[Wenson Hsieh]

Pull request: https://github.com/WebKit/WebKit/pull/55260

[EWS]

Committed 304320@main (41b65165bb54): <https://commits.webkit.org/304320@main>

Reviewed commits have been landed. Closing PR #55260 and removing active labels.

Thanks for taking a look.
We're still collecting crashes on iOS 26.3 (26.3.0 23D5089e), so it's possible this issue is not completely fixed.
Please let us know if you need additional details.

[Alexey Proskuryakov]

Thank you for the followup. Yes, this fix is not in any released or beta versions yet.

[Alexey Proskuryakov]

*** Bug 305457 has been marked as a duplicate of this bug. ***

Hello, was fix already released or when is release planned ?

[Aditya Keerthi]

The fix is in iOS 26.4 betas.