[Webkit-unassigned] [Bug 218455] New: REGRESSION (r269227): Crash in WebCore::WorkerOrWorkletGlobalScope::prepareForDestruction

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=218455

            Bug ID: 218455
           Summary: REGRESSION (r269227): Crash in
                    WebCore::WorkerOrWorkletGlobalScope::prepareForDestruc
                    tion
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: New Bugs
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: ryanhaddad at apple.com

The following two tests are consistently crashing on iOS and macOS debug bots after https://trac.webkit.org/changeset/269227/webkit
fast/css-custom-paint/constructor.html
fast/css-custom-paint/registerPaintBindings.html

https://results.webkit.org/?suite=layout-tests&suite=layout-tests&test=fast%2Fcss-custom-paint%2Fconstructor.html&test=fast%2Fcss-custom-paint%2FregisterPaintBindings.html

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.JavaScriptCore            0x000000020f36df8e WTFCrash + 14 (Assertions.cpp:295)
1   com.apple.WebCore                   0x00000001ee5e65eb WTFCrashWithInfo(int, char const*, char const*, int) + 27
2   com.apple.WebCore                   0x00000001f383bdb5 WebCore::WorkerOrWorkletGlobalScope::prepareForDestruction() + 181 (WorkerOrWorkletGlobalScope.cpp:53)
3   com.apple.WebCore                   0x00000001f39b6abf WebCore::WorkletGlobalScope::prepareForDestruction() + 31 (WorkletGlobalScope.cpp:95)
4   com.apple.WebCore                   0x00000001f16be46e WebCore::PaintWorkletGlobalScope::prepareForDestruction() + 78 (PaintWorkletGlobalScope.h:73)
5   com.apple.WebCore                   0x00000001f16bd7c2 WebCore::Document::willBeRemovedFromFrame() + 1714 (Document.cpp:2621)
6   com.apple.WebCore                   0x00000001f25f78d3 WebCore::Frame::setView(WTF::RefPtr<WebCore::FrameView, WTF::RawPtrTraits<WebCore::FrameView>, WTF::DefaultRefDerefTraits<WebCore::FrameView> >&&) + 195
7   com.apple.WebCore                   0x00000001f25fc49d WebCore::Frame::createView(WebCore::IntSize const&, WTF::Optional<WebCore::Color> const&, WebCore::IntSize const&, WebCore::IntRect const&, bool, WebCore::ScrollbarMode, bool, WebCore::ScrollbarMode, bool) + 253 (Frame.cpp:870)
8   com.apple.WebKit                    0x00000001e19a33c7 WebKit::WebFrameLoaderClient::transitionToCommittedForNewPage() + 887 (WebFrameLoaderClient.cpp:1524)
9   com.apple.WebCore                   0x00000001f23d3cde WebCore::FrameLoader::transitionToCommitted(WebCore::CachedPage*) + 1982 (FrameLoader.cpp:2211)
10  com.apple.WebCore                   0x00000001f23d2987 WebCore::FrameLoader::commitProvisionalLoad() + 1191 (FrameLoader.cpp:2022)
11  com.apple.WebCore                   0x00000001f2356fbc WebCore::DocumentLoader::commitIfReady() + 60 (DocumentLoader.cpp:377)
12  com.apple.WebCore                   0x00000001f2357720 WebCore::DocumentLoader::finishedLoading() + 304 (DocumentLoader.cpp:442)
13  com.apple.WebCore                   0x00000001f2363154 WebCore::DocumentLoader::maybeLoadEmpty() + 1076 (DocumentLoader.cpp:1831)
14  com.apple.WebCore                   0x00000001f23632e5 WebCore::DocumentLoader::startLoadingMainResource() + 357 (DocumentLoader.cpp:1844)
15  com.apple.WebCore                   0x00000001f23fc83c WebCore::FrameLoader::continueLoadAfterNavigationPolicy(WebCore::ResourceRequest const&, WebCore::FormState*, WebCore::NavigationPolicyDecision, WebCore::AllowNavigationToInvalidURL)::$_11::operator()() + 1612

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20201102/ec1aeb12/attachment-0001.htm>