[Webkit-unassigned] [Bug 225434] RELEASE_ASSERT(m_selection->isNone()) fails in Document::removedLastRef

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=225434

--- Comment #1 from Fujii Hironori <Hironori.Fujii at sony.com> ---
Mac port (Debug build, r277068 (237371 at main))

ASSERTION FAILED: m_selection->isNone()
./dom/Document.cpp(822) : void WebCore::Document::removedLastRef()
1   0x162342719 WTFCrash
2   0x14164b46b WTFCrashWithInfo(int, char const*, char const*, int)
3   0x1448e4f3c WebCore::Document::removedLastRef()
4   0x144a96e14 WebCore::Node::removedLastRef()
5   0x1418e4d9f WebCore::Node::deref() const
6   0x144a8de75 WebCore::Node::derefEventTarget()
7   0x141c02d3c WebCore::EventTarget::deref()
8   0x141c02cef WTF::Ref<WebCore::EventTarget, WTF::RawPtrTraits<WebCore::EventTarget> >::~Ref()
9   0x141c02c55 WTF::Ref<WebCore::EventTarget, WTF::RawPtrTraits<WebCore::EventTarget> >::~Ref()
10  0x1420d94be WebCore::JSDOMWrapper<WebCore::EventTarget>::~JSDOMWrapper()
11  0x1420d9498 WebCore::JSEventTarget::~JSEventTarget()
12  0x14202be55 WebCore::JSEventTarget::~JSEventTarget()
13  0x141faa6fd WebCore::JSEventTarget::destroy(JSC::JSCell*)
14  0x163e164aa JSC::JSDestructibleObjectDestroyFunc::operator()(JSC::VM&, JSC::JSCell*) const
15  0x163e16475 JSC::JSDestructibleObjectHeapCellType::destroy(JSC::VM&, JSC::JSCell*)
16  0x163739bfd JSC::Subspace::destroy(JSC::VM&, JSC::JSCell*)
17  0x16372cdaf JSC::PreciseAllocation::sweep()
18  0x163714261 JSC::MarkedSpace::sweepPreciseAllocations()
19  0x16368dd76 JSC::Heap::sweepInFinalize()
20  0x16368da10 JSC::Heap::finalize()
21  0x16368d100 JSC::Heap::handleNeedFinalize(unsigned int)
22  0x16368c016 JSC::Heap::handleNeedFinalize()
23  0x163688558 JSC::Heap::finishChangingPhase(JSC::GCConductor)
24  0x163689bec JSC::Heap::changePhase(JSC::GCConductor, JSC::CollectorPhase)
25  0x163689b85 JSC::Heap::runEndPhase(JSC::GCConductor)
26  0x163687dea JSC::Heap::runCurrentPhase(JSC::GCConductor, JSC::CurrentThreadState*)
27  0x1636bcc6a JSC::Heap::collectInMutatorThread()::$_0::operator()(JSC::CurrentThreadState&) const
28  0x1636bcbf6 WTF::ScopedLambdaFunctor<void (JSC::CurrentThreadState&), JSC::Heap::collectInMutatorThread()::$_0>::implFunction(void*, JSC::CurrentThreadState&)
29  0x1636fb5cc void WTF::ScopedLambda<void (JSC::CurrentThreadState&)>::operator()<JSC::CurrentThreadState&>(JSC::CurrentThreadState&) const
30  0x1636fb556 JSC::callWithCurrentThreadState(WTF::ScopedLambda<void (JSC::CurrentThreadState&)> const&)
31  0x16368d1e1 JSC::Heap::collectInMutatorThread()
2021-05-05 23:01:17.752 MiniBrowser[1596:17741] WebContent process crashed; reloading

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20210506/e73b2d03/attachment.htm>