Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 2236b2a0c44b31d7af4630641ef1dd2afd772db5
https://github.com/WebKit/WebKit/commit/2236b2a0c44b31d7af4630641ef1dd2afd772db5
Author: Megan Gardner <[email protected]>
Date: 2026-03-20 (Fri, 20 Mar 2026)
Changed paths:
M LayoutTests/platform/ios/TestExpectations
M Tools/TestRunnerShared/cocoa/LayoutTestSpellChecker.mm
Log Message:
-----------
REGRESSION(309217@main): [iOS] ASSERTION FAILED: m_ptr in
editing/input/cocoa/extended-proofreading.html
https://bugs.webkit.org/show_bug.cgi?id=310325
rdar://172949195
Reviewed by Wenson Hsieh.
Root cause: In Tools/TestRunnerShared/cocoa/LayoutTestSpellChecker.mm:
requestProofreadingReviewOfString:range:language:options:(completionHandler:
when the LayoutTestSpellChecker has
override results for a string, the original code was:
if (RetainPtr overrideResult = [_results objectForKey:stringToCheck])
completionHandler(overrideResult.get());
return [super
requestProofreadingReviewOfString:...completionHandler:completionHandler];
The if body only covers the completionHandler(...) call. Execution then
unconditionally falls through to call [super
requestProofreadingReviewOfString:...], which eventually calls the same
completion handler a second time.
In TextCheckerIOS.mm, the completion handler moves the
Ref<TextCheckerCompletion> via
WTF::move(textCheckerCompletion). The first call succeeds and moves the ref
out. The second call tries to move from
the now-null ref, hitting ASSERTION FAILED: m_ptr.
Why it's flaky: It only crashes when LayoutTestSpellChecker has matching
override results set for the checked string.
When there are no overrides, only super is called (once), so no crash.
Fix: Add an early return after calling the completion handler with override
results, so super is only called when
there are no overrides. This matches the pattern used by
requestGrammarCheckingOfString on the Mac side
requestGrammarCheckingOfString:range:language:options:completionHandler:.
* LayoutTests/platform/ios/TestExpectations:
* Tools/TestRunnerShared/cocoa/LayoutTestSpellChecker.mm:
(-[LayoutTestSpellChecker
requestProofreadingReviewOfString:range:language:options:completionHandler:]):
Canonical link: https://commits.webkit.org/309602@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
