[Webkit-unassigned] [Bug 279994] New: [GTK][WPE] REGRESSION(283749 at main) Build broken because of pointer use after free

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=279994

            Bug ID: 279994
           Summary: [GTK][WPE] REGRESSION(283749 at main) Build broken
                    because of pointer use after free
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebKitGTK
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: magomez at igalia.com
                CC: bugs-noreply at webkitgtk.org

I don't know why the bots are building properly and they are not showing this error, but this is what I'm getting when trying to build ToT:

In file included from /host/home/magomez/webkit/WebKit/WebKitBuild/GTK/Release/WTF/Headers/wtf/NeverDestroyed.h:32,
                 from /host/home/magomez/webkit/WebKit/Source/WebCore/platform/animation/TimingFunction.h:27,
                 from /host/home/magomez/webkit/WebKit/Source/WebCore/animation/KeyframeInterpolation.h:30,
                 from /host/home/magomez/webkit/WebKit/Source/WebCore/animation/BlendingKeyframes.h:28,
                 from /host/home/magomez/webkit/WebKit/Source/WebCore/animation/BlendingKeyframes.cpp:23,
                 from /host/home/magomez/webkit/WebKit/WebKitBuild/GTK/Release/WebCore/DerivedSources/unified-sources/UnifiedSource-a6b8b600-2.cpp:1:
In member function ‘bool WTF::RefCountedBase::derefAllowingPartiallyDestroyedBase() const’,
    inlined from ‘bool WTF::RefCountedBase::derefBase() const’ at /host/home/magomez/webkit/WebKit/WebKitBuild/GTK/Release/WTF/Headers/wtf/RefCounted.h:155:51,
    inlined from ‘void WTF::RefCounted<T>::deref() const [with T = WebCore::CSSStyleValue]’ at /host/home/magomez/webkit/WebKit/WebKitBuild/GTK/Release/WTF/Headers/wtf/RefCounted.h:211:22,
    inlined from ‘static void WTF::DefaultRefDerefTraits< <template-parameter-1-1> >::derefIfNotNull(T*) [with T = WebCore::CSSNumericValue]’ at /host/home/magomez/webkit/WebKit/WebKitBuild/GTK/Release/WTF/Headers/wtf/Ref.h:62:23,
    inlined from ‘WTF::RefPtr<T, <template-parameter-1-2>, <template-parameter-1-3> >::~RefPtr() [with T = WebCore::CSSNumericValue; _PtrTraits = WTF::RawPtrTraits<WebCore::CSSNumericValue>; _RefDerefTraits = WTF::DefaultRefDerefTraits<WebCore::CSSNumericValue>]’ at /host/home/magomez/webkit/WebKit/WebKitBuild/GTK/Release/WTF/Headers/wtf/RefPtr.h:60:61,
    inlined from ‘WebCore::CSSNumberishTime::CSSNumberishTime(WebCore::CSSNumberish)’ at /host/home/magomez/webkit/WebKit/Source/WebCore/animation/CSSNumberishTime.cpp:79:1,
    inlined from ‘WebCore::CSSNumberishTime::CSSNumberishTime(WebCore::CSSNumberish)’ at /host/home/magomez/webkit/WebKit/Source/WebCore/animation/CSSNumberishTime.cpp:49:1:
/host/home/magomez/webkit/WebKit/WebKitBuild/GTK/Release/WTF/Headers/wtf/RefCounted.h:141:33: error: pointer used after ‘static void WebCore::CSSStyleValue::operator delete(void*)’ [-Werror=use-after-free]
  141 |         unsigned tempRefCount = m_refCount - 1;
      |                                 ^~~~~~~~~~
In file included from /host/home/magomez/webkit/WebKit/Source/WebCore/css/typedom/CSSNumericValue.h:30,
                 from /host/home/magomez/webkit/WebKit/Source/WebCore/animation/CSSNumberishTime.h:28,
                 from /host/home/magomez/webkit/WebKit/Source/WebCore/animation/WebAnimationTypes.h:28,
                 from /host/home/magomez/webkit/WebKit/Source/WebCore/animation/KeyframeInterpolation.h:31:
In destructor ‘virtual WebCore::CSSStyleValue::~CSSStyleValue()’,
    inlined from ‘void WTF::RefCounted<T>::deref() const [with T = WebCore::CSSStyleValue]’ at /host/home/magomez/webkit/WebKit/WebKitBuild/GTK/Release/WTF/Headers/wtf/RefCounted.h:212:13,
    inlined from ‘static void WTF::DefaultRefDerefTraits< <template-parameter-1-1> >::derefIfNotNull(T*) [with T = WebCore::CSSUnitValue]’ at /host/home/magomez/webkit/WebKit/WebKitBuild/GTK/Release/WTF/Headers/wtf/Ref.h:62:23,
    inlined from ‘WTF::RefPtr<T, <template-parameter-1-2>, <template-parameter-1-3> >::~RefPtr() [with T = WebCore::CSSUnitValue; _PtrTraits = WTF::RawPtrTraits<WebCore::CSSUnitValue>; _RefDerefTraits = WTF::DefaultRefDerefTraits<WebCore::CSSUnitValue>]’ at /host/home/magomez/webkit/WebKit/WebKitBuild/GTK/Release/WTF/Headers/wtf/RefPtr.h:60:61,
    inlined from ‘WebCore::CSSNumberishTime::CSSNumberishTime(WebCore::CSSNumberish)’ at /host/home/magomez/webkit/WebKit/Source/WebCore/animation/CSSNumberishTime.cpp:78:5,
    inlined from ‘WebCore::CSSNumberishTime::CSSNumberishTime(WebCore::CSSNumberish)’ at /host/home/magomez/webkit/WebKit/Source/WebCore/animation/CSSNumberishTime.cpp:49:1:
/host/home/magomez/webkit/WebKit/Source/WebCore/css/typedom/CSSStyleValue.h:114:13: note: call to ‘static void WebCore::CSSStyleValue::operator delete(void*)’ here
  114 |     virtual ~CSSStyleValue() = default;
      |             ^
In member function ‘bool WTF::RefCountedBase::derefAllowingPartiallyDestroyedBase() const’,
    inlined from ‘bool WTF::RefCountedBase::derefBase() const’ at /host/home/magomez/webkit/WebKit/WebKitBuild/GTK/Release/WTF/Headers/wtf/RefCounted.h:155:51,
    inlined from ‘void WTF::RefCounted<T>::deref() const [with T = WebCore::CSSStyleValue]’ at /host/home/magomez/webkit/WebKit/WebKitBuild/GTK/Release/WTF/Headers/wtf/RefCounted.h:211:22,
    inlined from ‘static void WTF::DefaultRefDerefTraits< <template-parameter-1-1> >::derefIfNotNull(T*) [with T = WebCore::CSSNumericValue]’ at /host/home/magomez/webkit/WebKit/WebKitBuild/GTK/Release/WTF/Headers/wtf/Ref.h:62:23,
    inlined from ‘WTF::RefPtr<T, <template-parameter-1-2>, <template-parameter-1-3> >::~RefPtr() [with T = WebCore::CSSNumericValue; _PtrTraits = WTF::RawPtrTraits<WebCore::CSSNumericValue>; _RefDerefTraits = WTF::DefaultRefDerefTraits<WebCore::CSSNumericValue>]’ at /host/home/magomez/webkit/WebKit/WebKitBuild/GTK/Release/WTF/Headers/wtf/RefPtr.h:60:61,
    inlined from ‘WebCore::CSSNumberishTime::CSSNumberishTime(WebCore::CSSNumberish)’ at /host/home/magomez/webkit/WebKit/Source/WebCore/animation/CSSNumberishTime.cpp:79:1,
    inlined from ‘WebCore::CSSNumberishTime::CSSNumberishTime(WebCore::CSSNumberish)’ at /host/home/magomez/webkit/WebKit/Source/WebCore/animation/CSSNumberishTime.cpp:49:1:
/host/home/magomez/webkit/WebKit/WebKitBuild/GTK/Release/WTF/Headers/wtf/RefCounted.h:141:33: error: pointer used after ‘static void WebCore::CSSStyleValue::operator delete(void*)’ [-Werror=use-after-free]
  141 |         unsigned tempRefCount = m_refCount - 1;
      |                                 ^~~~~~~~~~
In destructor ‘virtual WebCore::CSSStyleValue::~CSSStyleValue()’,
    inlined from ‘void WTF::RefCounted<T>::deref() const [with T = WebCore::CSSStyleValue]’ at /host/home/magomez/webkit/WebKit/WebKitBuild/GTK/Release/WTF/Headers/wtf/RefCounted.h:212:13,
    inlined from ‘static void WTF::DefaultRefDerefTraits< <template-parameter-1-1> >::derefIfNotNull(T*) [with T = WebCore::CSSUnitValue]’ at /host/home/magomez/webkit/WebKit/WebKitBuild/GTK/Release/WTF/Headers/wtf/Ref.h:62:23,
    inlined from ‘WTF::RefPtr<T, <template-parameter-1-2>, <template-parameter-1-3> >::~RefPtr() [with T = WebCore::CSSUnitValue; _PtrTraits = WTF::RawPtrTraits<WebCore::CSSUnitValue>; _RefDerefTraits = WTF::DefaultRefDerefTraits<WebCore::CSSUnitValue>]’ at /host/home/magomez/webkit/WebKit/WebKitBuild/GTK/Release/WTF/Headers/wtf/RefPtr.h:60:61,
    inlined from ‘WebCore::CSSNumberishTime::CSSNumberishTime(WebCore::CSSNumberish)’ at /host/home/magomez/webkit/WebKit/Source/WebCore/animation/CSSNumberishTime.cpp:78:5,
    inlined from ‘WebCore::CSSNumberishTime::CSSNumberishTime(WebCore::CSSNumberish)’ at /host/home/magomez/webkit/WebKit/Source/WebCore/animation/CSSNumberishTime.cpp:49:1:
/host/home/magomez/webkit/WebKit/Source/WebCore/css/typedom/CSSStyleValue.h:114:13: note: call to ‘static void WebCore::CSSStyleValue::operator delete(void*)’ here
  114 |     virtual ~CSSStyleValue() = default;
      |             ^
cc1plus: all warnings being treated as errors

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20240919/7e8fd3ea/attachment-0001.htm>