The following API test is a flaky crash on Mojave+ WK2 Debug testers TestWebKitAPI.WKAttachmentTestsMac.InsertDroppedFilePromisesAsAttachments Test was added in r235137 Test appears to have been a flaky crash for quite some time now but it appears we have not noticed it. around 6/07/2019 it started to crash more consistently and around 6/11/2019 started to crash every 3 runs or so. https://build.webkit.org/builders/Apple%20Mojave%20Debug%20WK2%20%28Tests%29?numbuilds=200 I can see a crash back on May 31st as well. https://build.webkit.org/builders/Apple%20Mojave%20Debug%20WK2%20%28Tests%29/builds/2836/steps/run-api-tests/logs/stdio Reproduced locally 2 ways. run-api-tests TestWebKitAPI.WKAttachmentTestsMac.InsertDroppedFilePromisesAsAttachments --iter 200 --debug I can also reproduce it in guard malloc and it fails more consistently in that configuration. I can reproduce the crash in both modes going all the way back to r235137 and it produces the same crash. I don't know if recent jsc changes in this area may have made it more consistent. Attaching the full crash log and the guard malloc crash log to the radar. 0 com.apple.JavaScriptCore 0x000000010bc798cd bmalloc::SmallLine::deref(std::__1::unique_lock<bmalloc::Mutex>&) + 45 1 com.apple.JavaScriptCore 0x000000010bc795fc bmalloc::Heap::derefSmallLine(std::__1::unique_lock<bmalloc::Mutex>&, bmalloc::Object, std::__1::array<bmalloc::List<bmalloc::SmallPage>, 112ul>&) + 60 2 com.apple.JavaScriptCore 0x000000010bc79525 bmalloc::Deallocator::processObjectLog(std::__1::unique_lock<bmalloc::Mutex>&) + 165 3 com.apple.JavaScriptCore 0x000000010bc7976e bmalloc::Deallocator::deallocateSlowCase(void*) + 270 4 com.apple.JavaScriptCore 0x000000010bbe3244 bmalloc::Deallocator::deallocate(void*) + 68 5 com.apple.JavaScriptCore 0x000000010bbe31e5 bmalloc::Cache::deallocate(bmalloc::HeapKind, void*) + 165 6 com.apple.JavaScriptCore 0x000000010bbe277b bmalloc::api::free(void*, bmalloc::HeapKind) + 27 7 com.apple.JavaScriptCore 0x000000010bbe2757 WTF::fastFree(void*) + 23 8 com.apple.JavaScriptCore 0x000000010bc40737 WTF::StringWrapperCFAllocator::deallocate(void*, void*) + 103