[Bug]: WebKit crashes after page reload in 1.56

[mirao]

Version

1.56

Steps to reproduce

• Run npx playwright wk https://playwright.dev
• Click on "Get started"
• Press F5 (page reload) multiple times
• After a few attempts the browser crashes

~/workspace/codeceptjs/tests/s4w$ npx playwright wk https://playwright.dev
/home/mirao/workspace/codeceptjs/node_modules/.pnpm/playwright-core@1.56.0/node_modules/playwright-core/lib/utils/isomorphic/assert.js:26
    throw new Error(message || "Assertion error");
          ^

Error: Assertion error
    at assert (/home/mirao/workspace/codeceptjs/node_modules/.pnpm/playwright-core@1.56.0/node_modules/playwright-core/lib/utils/isomorphic/assert.js:26:11)
    at WKPage._onTargetCreated (/home/mirao/workspace/codeceptjs/node_modules/.pnpm/playwright-core@1.56.0/node_modules/playwright-core/lib/server/webkit/wkPage.js:296:31)
    at WKSession.emit (node:events:524:28)
    at /home/mirao/workspace/codeceptjs/node_modules/.pnpm/playwright-core@1.56.0/node_modules/playwright-core/lib/server/webkit/wkConnection.js:139:41

Node.js v20.19.5

Expected behavior

No crash

Actual behavior

Browser crashes

Additional context

It happens even with our web app in E2E tests (CodeceptJS + Playwright), tested with the headless mode in a docker image (Ubuntu 24.04.3)
Playwright 1.55.1 isn't affected, so it's a regression in 1.56.

Environment

System:
    OS: Linux 6.14 Ubuntu 24.04.3 LTS 24.04.3 LTS (Noble Numbat)
    CPU: (16) x64 AMD Ryzen 7 9700X 8-Core Processor
    Memory: 30.30 GB / 60.49 GB
    Container: Yes
  Binaries:
    Node: 20.19.5 - /home/mirao/.nvm/versions/node/v20.19.5/bin/node
    npm: 10.8.2 - /home/mirao/.nvm/versions/node/v20.19.5/bin/npm
    pnpm: 9.15.9 - /home/mirao/.nvm/versions/node/v20.19.5/bin/pnpm
  IDEs:
    VSCode: 1.104.3 - /usr/bin/code
  Languages:
    Bash: 5.2.21 - /usr/bin/bash

[mirao]

This is a debug output (DEBUG=pw:api,pw:browser) from our test when the browser crashes:

codeceptjs-1  |   S4E - Teacher: Verify the detail of the online assignment - grading changed
codeceptjs-1  | 2025-10-08T11:29:55.294Z pw:api => page.bringToFront started
codeceptjs-1  | 2025-10-08T11:29:55.294Z pw:api <= page.bringToFront succeeded
codeceptjs-1  |   Scenario()
codeceptjs-1  |     I switch to next tab 
codeceptjs-1  | 2025-10-08T11:29:55.295Z pw:api => page.bringToFront started
codeceptjs-1  | 2025-10-08T11:29:55.295Z pw:api <= page.bringToFront succeeded
codeceptjs-1  |     I refresh page 
codeceptjs-1  | 2025-10-08T11:29:55.796Z pw:api => page.reload started
codeceptjs-1  | 2025-10-08T11:29:55.796Z pw:api waiting for navigation until "load"
codeceptjs-1  | 2025-10-08T11:29:56.056Z pw:browser [pid=124][err] /usr/lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/optional:479: _Tp &std::_Optional_base_impl<unsigned long, std::_Optional_base<unsigned long>>::_M_get() [_Tp = unsigned long, _Dp = std::_Optional_base<unsigned long>]: Assertion 'this->_M_is_engaged()' failed.
codeceptjs-1  | ERROR: Page has crashed, closing page!
codeceptjs-1  | 2025-10-08T11:29:56.147Z pw:api => page.close started
codeceptjs-1  | ERROR: Page has crashed, closing page!
codeceptjs-1  | 2025-10-08T11:29:56.147Z pw:api => page.close started
codeceptjs-1  | ERROR: Page has crashed, closing page!
codeceptjs-1  | 2025-10-08T11:29:56.147Z pw:api => page.close started
codeceptjs-1  | ERROR: Page has crashed, closing page!
codeceptjs-1  | 2025-10-08T11:29:56.147Z pw:api => page.close started
codeceptjs-1  | ERROR: Page has crashed, closing page!
codeceptjs-1  | 2025-10-08T11:29:56.147Z pw:api => page.close started
codeceptjs-1  | ERROR: Page has crashed, closing page!

[Skn0tt]

Thanks, can also reproduce this on macOS using the manual method you provided. I'm not able to come up with a programmatic way of triggering it, but it seems like you have? If yes, could you share a small test snippet that triggers the crash?

[Skn0tt]

This seems to be where it regressed: #37473

[mirao]

@Skn0tt My test runs in our private environment (and in CodeceptJS only, not in pure Playwright). However Copilot created for me a test that triggers the crash. Follow https://gist.github.com/mirao/707670c2378576f940c518b6e85b0794

$ npx playwright test

Running 1 test using 1 worker

  ✘  1 …t-reload-crash.spec.ts:14:5 › WebKit crash on page reload (4.6s)


  1) [webkit] › webkit-reload-crash.spec.ts:14:5 › WebKit crash on page reload 

    Error: page.reload: Page crashed
    Call log:
      - waiting for navigation until "load"


      20 |     // The crash typically happens after 2-3 reloads
      21 |     for (let i = 1; i <= 10; i++) {
    > 22 |         await page.reload({ waitUntil: "load" });
         |                    ^
      23 |         await expect(page).toHaveURL(/.*intro/);
      24 |     }
      25 | });
        at /home/mirao/workspace/codeceptjs/playwright-tests/webkit-reload-crash.spec.ts:22:20

  1 failed
    [webkit] › webkit-reload-crash.spec.ts:14:5 › WebKit crash on page reload 

[yury-s]

Stack trace:

* thread #1, name = 'WebKitWebProces', stop reason = signal SIGABRT
  * frame #0: 0x00007f09b86969fc libc.so.6`__GI___pthread_kill [inlined] __pthread_kill_implementation(no_tid=0, signo=6, threadid=139679660424064) at pthread_kill.c:44:76
    frame #1: 0x00007f09b86969b0 libc.so.6`__GI___pthread_kill [inlined] __pthread_kill_internal(signo=6, threadid=139679660424064) at pthread_kill.c:78:10
    frame #2: 0x00007f09b86969b0 libc.so.6`__GI___pthread_kill(threadid=139679660424064, signo=6) at pthread_kill.c:89:10
    frame #3: 0x00007f09b8642476 libc.so.6`__GI_raise(sig=6) at raise.c:26:13
    frame #4: 0x00007f09b86287f3 libc.so.6`__GI_abort at abort.c:79:7
    frame #5: 0x00007f09b8ad836f libstdc++.so.6`std::__glibcxx_assert_fail(char const*, int, char const*, char const*) + 111
    frame #6: 0x00007f09c13b0bb2 libwebkitgtk-6.0.so.4`WebCore::Navigation::initializeForNewWindow(std::optional<WebCore::NavigationNavigationType>, WebCore::LocalDOMWindow*) + 1890
    frame #7: 0x00007f09c123faaf libwebkitgtk-6.0.so.4`WebCore::FrameLoader::didBeginDocument(bool, WebCore::LocalDOMWindow*) + 2751
    frame #8: 0x00007f09c121e5a8 libwebkitgtk-6.0.so.4`WebCore::DocumentWriter::begin(WTF::URL const&, bool, WebCore::Document*, std::optional<WebCore::ProcessQualified<WTF::UUID>>, WebCore::NavigationAction const*) + 2552
    frame #9: 0x00007f09c1215bb9 libwebkitgtk-6.0.so.4`WebCore::DocumentLoader::commitData(WebCore::SharedBuffer const&) + 297
    frame #10: 0x00007f09bf7b43c8 libwebkitgtk-6.0.so.4`WebKit::WebLocalFrameLoaderClient::committedLoad(WebCore::DocumentLoader*, WebCore::SharedBuffer const&) + 24
    frame #11: 0x00007f09c121da89 libwebkitgtk-6.0.so.4`WebCore::DocumentLoader::commitLoad(WebCore::SharedBuffer const&) + 281
    frame #12: 0x00007f09c12bdb6f libwebkitgtk-6.0.so.4`WebCore::CachedRawResource::notifyClientsDataWasReceived(WebCore::SharedBuffer const&) + 223
    frame #13: 0x00007f09c12bd7a6 libwebkitgtk-6.0.so.4`WebCore::CachedRawResource::updateBuffer(WebCore::FragmentedSharedBuffer const&) + 390
    frame #14: 0x00007f09c12a22ce libwebkitgtk-6.0.so.4`WebCore::SubresourceLoader::didReceiveBuffer(WebCore::FragmentedSharedBuffer const&, long long, WebCore::DataPayloadType) + 174
    frame #15: 0x00007f09bf727edb libwebkitgtk-6.0.so.4`WebKit::WebResourceLoader::didReceiveData(IPC::SharedBufferReference&&, unsigned long) + 379
    frame #16: 0x00007f09beed9a4e libwebkitgtk-6.0.so.4`WebKit::WebResourceLoader::didReceiveMessage(IPC::Connection&, IPC::Decoder&) + 142
    frame #17: 0x00007f09bf7163d6 libwebkitgtk-6.0.so.4`WebKit::NetworkProcessConnection::dispatchMessage(IPC::Connection&, IPC::Decoder&) + 646
    frame #18: 0x00007f09beed82be libwebkitgtk-6.0.so.4`WebKit::NetworkProcessConnection::didReceiveMessage(IPC::Connection&, IPC::Decoder&) + 574
    frame #19: 0x00007f09bf2f983e libwebkitgtk-6.0.so.4`IPC::Connection::dispatchMessage(IPC::Decoder&) + 94
    frame #20: 0x00007f09bf2f9b25 libwebkitgtk-6.0.so.4`IPC::Connection::dispatchMessage(WTF::UniqueRef<IPC::Decoder>) + 277
    frame #21: 0x00007f09bf2f9c61 libwebkitgtk-6.0.so.4`IPC::Connection::dispatchOneIncomingMessage() + 161
    frame #22: 0x00007f09bcab2445 libjavascriptcoregtk-6.0.so.1`WTF::RunLoop::performWork() + 549
    frame #23: 0x00007f09bcb6ef26 libjavascriptcoregtk-6.0.so.1`WTF::RunLoop::RunLoop()::$_0::__invoke(void*) + 6
    frame #24: 0x00007f09bcb6e28a libjavascriptcoregtk-6.0.so.1`WTF::RunLoop::$_0::__invoke(_GSource*, int (*)(void*), void*) + 74
    frame #25: 0x00007f09bd1f3c44 libglib-2.0.so.0`g_main_context_dispatch + 372
    frame #26: 0x00007f09bd2492b8 libglib-2.0.so.0`___lldb_unnamed_symbol2709 + 488
    frame #27: 0x00007f09bd1f32b3 libglib-2.0.so.0`g_main_loop_run + 115
    frame #28: 0x00007f09bcb6e7b3 libjavascriptcoregtk-6.0.so.1`WTF::RunLoop::run() + 243
    frame #29: 0x00007f09bf84ea23 libwebkitgtk-6.0.so.4`WebKit::WebProcessMain(int, char**) + 179
    frame #30: 0x00007f09b8629d90 libc.so.6`__libc_start_call_main(main=(WebKitWebProcess`main), argc=3, argv=0x00007fff6bb60218) at libc_start_call_main.h:58:16
    frame #31: 0x00007f09b8629e40 libc.so.6`__libc_start_main_impl(main=(WebKitWebProcess`main), argc=3, argv=0x00007fff6bb60218, init=<unavailable>, fini=<unavailable>, rtld_fini=<unavailable>, stack_end=0x00007fff6bb60208) at libc-start.c:392:3
    frame #32: 0x000056a784adf075 WebKitWebProcess`_start + 37

[yury-s]

This may have something to do with the WebKit roll on Sep 15 and in particular this change WebKit/WebKit@5158da1 which is related to the upstream changes WebKit/WebKit#50566 and WebKit/WebKit#50613

[yury-s]

Filed upstream https://bugs.webkit.org/show_bug.cgi?id=300402

[AndyLysenko]

+1
I also can reproduce it with simple reload in test