LibWeb: Crash due to unimplemented async loading of favicons in HTMLLinkElement

[theonlyasdk]

How to reproduce:

1. Try to search something in the new tab search page and click on one of the search buttons (I clicked GitHub)
2. While the page is loading, try navigate back to new tab page
3. It will seem that it navigated back successfully, try entering something in the search box and try clicking one of those buttons again
4. Browser crashes with the following backtrace

Backtrace

VERIFICATION FAILED: m_ptr at /home/user/Downloads/serenity/Meta/Lagom/../../Userland/Libraries/LibJS/Heap/GCPtr.h:174
/home/user/Downloads/serenity/Build/lagom/lib/liblagom-ak.so.0(ak_verification_failed+0xc4) [0x7a30262f0bd4]
/home/user/Downloads/serenity/Build/lagom/lib/liblagom-web.so.0(+0x8c22f4) [0x7a3026cc22f4]
/home/user/Downloads/serenity/Build/lagom/lib/liblagom-web.so.0 Web::HTML::HTMLLinkElement::load_favicon_and_use_if_window_is_active() 0x98) [0x7a3026cc23f8]
/home/user/Downloads/serenity/Build/lagom/lib/liblagom-web.so.0 Web::DOM::Document::check_favicon_after_loading_link_resource() 0x154) [0x7a3026b1e724]
/home/user/Downloads/serenity/Build/lagom/lib/liblagom-web.so.0 Web::HTML::HTMLLinkElement::resource_did_load() 0xa8) [0x7a3026cbf2d8]
/home/user/Downloads/serenity/Build/lagom/lib/liblagom-web.so.0 Web::Resource::for_each_client(AK::Function<void (Web::ResourceClient&)>) 0x294) [0x7a3026e8b504]
/home/user/Downloads/serenity/Build/lagom/lib/liblagom-web.so.0 Web::Resource::did_load(AK::Badge<Web::ResourceLoader>, AK::Span<unsigned char const>, AK::HashMap<AK::ByteString, AK::ByteString, AK::CaseInsensitiveStringTraits, AK::Traits<AK::ByteString>, false> const&, AK::Optional<unsigned int>) 0x524) [0x7a3026e8be34]
/home/user/Downloads/serenity/Build/lagom/lib/liblagom-web.so.0(+0xa98a69) [0x7a3026e98a69]
/home/user/Downloads/serenity/Build/lagom/lib/liblagom-web.so.0(+0xa93b71) [0x7a3026e93b71]
/home/user/Downloads/serenity/Build/lagom/lib/liblagom-web.so.0(+0xa943ed) [0x7a3026e943ed]
/home/user/Downloads/serenity/Build/lagom/lib/liblagom-webview.so.0(+0xa4f58) [0x7a3028d35f58]
/home/user/Downloads/serenity/Build/lagom/lib/liblagom-protocol.so.0(+0xdfff) [0x7a302830efff]
/home/user/Downloads/serenity/Build/lagom/lib/liblagom-protocol.so.0(+0xbf1a) [0x7a302830cf1a]
/home/user/Downloads/serenity/Build/lagom/lib/liblagom-protocol.so.0(+0xc15a) [0x7a302830d15a]
/home/user/Downloads/serenity/Build/lagom/lib/liblagom-core.so.0 Core::Notifier::event(Core::Event&) 0x62) [0x7a3026388c32]
/home/user/Downloads/serenity/Build/lagom/lib/liblagom-core.so.0 Core::EventReceiver::dispatch_event(Core::Event&, Core::EventReceiver*) 0x70) [0x7a30263839e0]
/home/user/Downloads/serenity/Build/lagom/libexec/WebContent(+0x11d28c) [0x59cd93ff628c]
/lib/x86_64-linux-gnu/libQt6Core.so.6(+0x1ac023) [0x7a30285ac023]
/lib/x86_64-linux-gnu/libQt6Core.so.6 QSocketNotifier::activated(QSocketDescriptor, QSocketNotifier::Type, QSocketNotifier::QPrivateSignal) 0x5a) [0x7a30285b8baa]
/lib/x86_64-linux-gnu/libQt6Core.so.6 QSocketNotifier::event(QEvent*) 0x59) [0x7a30285b9199]
/lib/x86_64-linux-gnu/libQt6Core.so.6 QCoreApplication::notifyInternal2(QObject*, QEvent*) 0xfd) [0x7a3028553a2d]
/lib/x86_64-linux-gnu/libQt6Core.so.6(+0x37cbd7) [0x7a302877cbd7]
/lib/x86_64-linux-gnu/libglib-2.0.so.0(g_main_context_dispatch+0x26b) [0x7a302531bd3b]
/lib/x86_64-linux-gnu/libglib-2.0.so.0(+0xab258) [0x7a3025371258]
/lib/x86_64-linux-gnu/libglib-2.0.so.0(g_main_context_iteration+0x33) [0x7a30253193e3]
/lib/x86_64-linux-gnu/libQt6Core.so.6 QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) 0xcc) [0x7a302877bf0c]
/home/user/Downloads/serenity/Build/lagom/libexec/WebContent(+0x11d039) [0x59cd93ff6039]
/home/user/Downloads/serenity/Build/lagom/lib/liblagom-core.so.0 Core::EventLoop::spin_until(AK::Function<bool ()>) 0xb2) [0x7a302637c382]
/home/user/Downloads/serenity/Build/lagom/lib/liblagom-web.so.0 Web::Platform::EventLoopPluginSerenity::spin_until(JS::SafeFunction<bool ()>) 0x125) [0x7a3026f081b5]
/home/user/Downloads/serenity/Build/lagom/lib/liblagom-web.so.0 Web::HTML::Navigable::populate_session_history_entry_document(JS::GCPtr<Web::HTML::SessionHistoryEntry>, Web::HTML::SourceSnapshotParams const&, Web::HTML::TargetSnapshotParams const&, AK::Optional<AK::String>, AK::Variant<AK::Empty, JS::NonnullGCPtr<Web::HTML::NavigationParams>, JS::NonnullGCPtr<Web::HTML::NonFetchSchemeNavigationParams> >, Web::HTML::CSPNavigationType, bool, JS::SafeFunction<void ()>) 0xf3c) [0x7a3026d2711c]
/home/user/Downloads/serenity/Build/lagom/lib/liblagom-web.so.0(+0x9cfef5) [0x7a3026dcfef5]
/home/user/Downloads/serenity/Build/lagom/lib/liblagom-web.so.0(+0xb08f24) [0x7a3026f08f24]
/home/user/Downloads/serenity/Build/lagom/lib/liblagom-core.so.0 Core::ThreadEventQueue::process() 0x3cc) [0x7a302639e11c]
/home/user/Downloads/serenity/Build/lagom/libexec/WebContent(+0x11d024) [0x59cd93ff6024]
/home/user/Downloads/serenity/Build/lagom/lib/liblagom-core.so.0 Core::EventLoop::spin_until(AK::Function<bool ()>) 0xb2) [0x7a302637c382]
/home/user/Downloads/serenity/Build/lagom/lib/liblagom-web.so.0 Web::Platform::EventLoopPluginSerenity::spin_until(JS::SafeFunction<bool ()>) 0x125) [0x7a3026f081b5]
/home/user/Downloads/serenity/Build/lagom/lib/liblagom-web.so.0 Web::HTML::EventLoop::spin_until(JS::SafeFunction<bool ()>) 0xf9) [0x7a3026c5a8d9]
/home/user/Downloads/serenity/Build/lagom/lib/liblagom-web.so.0 Web::HTML::TraversableNavigable::apply_the_history_step(int, bool, AK::Optional<Web::HTML::SourceSnapshotParams>, JS::GCPtr<Web::HTML::Navigable>, AK::Optional<Web::HTML::UserNavigationInvolvement>, AK::Optional<Web::Bindings::NavigationType>, Web::HTML::TraversableNavigable::SynchronousNavigation) 0xc4f) [0x7a3026dd4dcf]
/home/user/Downloads/serenity/Build/lagom/lib/liblagom-web.so.0 Web::HTML::TraversableNavigable::apply_the_traverse_history_step(int, AK::Optional<Web::HTML::SourceSnapshotParams>, JS::GCPtr<Web::HTML::Navigable>, Web::HTML::UserNavigationInvolvement) 0x73) [0x7a3026dd5353]
/home/user/Downloads/serenity/Build/lagom/lib/liblagom-web.so.0(+0x9d5438) [0x7a3026dd5438]
/home/user/Downloads/serenity/Build/lagom/lib/liblagom-web.so.0(+0x9a7824) [0x7a3026da7824]
/home/user/Downloads/serenity/Build/lagom/lib/liblagom-core.so.0 Core::Timer::timer_event(Core::TimerEvent&) 0x72) [0x7a302639ecc2]
/home/user/Downloads/serenity/Build/lagom/lib/liblagom-core.so.0 Core::EventReceiver::dispatch_event(Core::Event&, Core::EventReceiver*) 0x70) [0x7a30263839e0]
/home/user/Downloads/serenity/Build/lagom/libexec/WebContent(+0x11d48d) [0x59cd93ff648d]
/lib/x86_64-linux-gnu/libQt6Core.so.6(+0x1ac023) [0x7a30285ac023]
/lib/x86_64-linux-gnu/libQt6Core.so.6 QTimer::timeout(QTimer::QPrivateSignal) 0x3e) [0x7a30285ba4be]
/lib/x86_64-linux-gnu/libQt6Core.so.6 QObject::event(QEvent*) 0x1df) [0x7a30285a062f]
/lib/x86_64-linux-gnu/libQt6Core.so.6 QCoreApplication::notifyInternal2(QObject*, QEvent*) 0xfd) [0x7a3028553a2d]
/lib/x86_64-linux-gnu/libQt6Core.so.6 QTimerInfoList::activateTimers() 0x333) [0x7a30286bc203]
/lib/x86_64-linux-gnu/libQt6Core.so.6(+0x37bbfc) [0x7a302877bbfc]
/lib/x86_64-linux-gnu/libglib-2.0.so.0(g_main_context_dispatch+0x26b) [0x7a302531bd3b]
/lib/x86_64-linux-gnu/libglib-2.0.so.0(+0xab258) [0x7a3025371258]
/lib/x86_64-linux-gnu/libglib-2.0.so.0(g_main_context_iteration+0x33) [0x7a30253193e3]
/lib/x86_64-linux-gnu/libQt6Core.so.6 QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) 0xcc) [0x7a302877bf0c]
/home/user/Downloads/serenity/Build/lagom/libexec/WebContent(+0x11d039) [0x59cd93ff6039]
/home/user/Downloads/serenity/Build/lagom/lib/liblagom-core.so.0 Core::EventLoop::spin_until(AK::Function<bool ()>) 0xb2) [0x7a302637c382]
/home/user/Downloads/serenity/Build/lagom/lib/liblagom-web.so.0 Web::Platform::EventLoopPluginSerenity::spin_until(JS::SafeFunction<bool ()>) 0x125) [0x7a3026f081b5]
/home/user/Downloads/serenity/Build/lagom/lib/liblagom-web.so.0 Web::HTML::EventLoop::spin_until(JS::SafeFunction<bool ()>) 0xf9) [0x7a3026c5a8d9]
/home/user/Downloads/serenity/Build/lagom/lib/liblagom-web.so.0 Web::HTML::HTMLParser::the_end(JS::NonnullGCPtr<Web::DOM::Document>, JS::GCPtr<Web::HTML::HTMLParser>) 0x149) [0x7a3026d60299]
/home/user/Downloads/serenity/Build/lagom/lib/liblagom-web.so.0 Web::HTML::HTMLParser::run(URL::URL const&, Web::HTML::HTMLTokenizer::StopAtInsertionPoint) 0x389) [0x7a3026d60ae9]
/home/user/Downloads/serenity/Build/lagom/lib/liblagom-web.so.0(+0xb08f24) [0x7a3026f08f24]
/home/user/Downloads/serenity/Build/lagom/lib/liblagom-core.so.0 Core::ThreadEventQueue::process() 0x3cc) [0x7a302639e11c]
/home/user/Downloads/serenity/Build/lagom/libexec/WebContent(+0x11d61d) [0x59cd93ff661d]
/home/user/Downloads/serenity/Build/lagom/libexec/WebContent(+0x11e6d2) [0x59cd93ff76d2]
/lib/x86_64-linux-gnu/libQt6Core.so.6 QCoreApplication::notifyInternal2(QObject*, QEvent*) 0xfd) [0x7a3028553a2d]
/lib/x86_64-linux-gnu/libQt6Core.so.6 QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) 0x19a) [0x7a302855736a]
/lib/x86_64-linux-gnu/libQt6Core.so.6(+0x37c637) [0x7a302877c637]
/lib/x86_64-linux-gnu/libglib-2.0.so.0(g_main_context_dispatch+0x26b) [0x7a302531bd3b]
/lib/x86_64-linux-gnu/libglib-2.0.so.0(+0xab258) [0x7a3025371258]
/lib/x86_64-linux-gnu/libglib-2.0.so.0(g_main_context_iteration+0x33) [0x7a30253193e3]
/lib/x86_64-linux-gnu/libQt6Core.so.6 QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) 0x6e) [0x7a302877beae]
/lib/x86_64-linux-gnu/libQt6Core.so.6 QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) 0x17b) [0x7a3028560adb]
/home/user/Downloads/serenity/Build/lagom/lib/liblagom-core.so.0 Core::EventLoop::exec() 0x4a) [0x7a302637c51a]
/home/user/Downloads/serenity/Build/lagom/libexec/WebContent(+0x1296fe) [0x59cd940026fe]
/home/user/Downloads/serenity/Build/lagom/libexec/WebContent(+0x439b6) [0x59cd93f1c9b6]
/lib/x86_64-linux-gnu/libc.so.6(+0x29d90) [0x7a3025029d90]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0x80) [0x7a3025029e40]
/home/user/Downloads/serenity/Build/lagom/libexec/WebContent(+0x43ae5) [0x59cd93f1cae5]
8984.035 Ladybird(9698): WebContent process crashed!
8984.171 WebContent(9716): FontDatabase::load_all_fonts_from_uri('file:///home/user/.local/share/fonts'): stat: No such file or directory (errno=2)
8984.191 Ladybird(9698): ProcessManager::add_process(WebContent, 9716)

By reading the backtrace, I figured it out that the following code in HTMLLinkElement.cpp is causing the issue:

bool HTMLLinkElement::load_favicon_and_use_if_window_is_active()
{
    if (!has_loaded_icon())
        return false;

    // FIXME: Refactor the caller(s) to handle the async nature of image loading
    auto promise = decode_favicon(resource()->encoded_data(), resource()->url(), navigable());
    auto result = promise->await();
    return !result.is_error();
}