165652 2016-12-09 05:38:12 -0800 CrashTracer: com.apple.WebKit.WebContent.Development at com.apple.WebCore: WTF::match_constness<WebCore::CSSValue, WebCore::CSSContentDistributionValue>::type& WTF::downcast<WebCore::CSSContentDistributionValue, WebCore::CSSValue> + 65 2016-12-10 01:58:38 -0800 1 1 1 Unclassified WebKit CSS WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 koivisto webkit-unassigned commit-queue oldest_to_newest 1258123 0 koivisto 2016-12-09 05:38:12 -0800 25/09/2016, 14.20 CrashTracer System: * APPLICATION: com.apple.WebKit.WebContent.Development * SIGNATURE: com.apple.WebCore: WTF::match_constness<WebCore::CSSValue, WebCore::CSSContentDistributionValue>::type& WTF::downcast<WebCore::CSSContentDistributionValue, WebCore::CSSValue> + 65 * MORE INFORMATION: https://crashtracer.apple.com/signature/show/54148905?app=com.apple.WebKit.WebContent.Development&build=16B2326&users=internal Summary of a selection of backtraces attributed to this bug. The stack frame considered to be the unique "crash signature" is highlighted ==> like this <==. This frame is used for aggregation when filing these bugs and does not necessarily imply fault. 8 JavaScriptCore: WTFCrash 8 JavaScriptCore: WTFCrashWithSecurityImplication ==> 8 WebCore: WTF::match_constness<WebCore::CSSValue, WebCore::CSSContentDistributionValue>::type& WTF::downcast<WebCore::CSSContentDistributionValue, WebCore::CSSValue>(WebCore::CSSValue&) <== 8 WebCore: WebCore::StyleBuilderConverter::convertContentAlignmentData(WebCore::StyleResolver&, WebCore::CSSValue&) 8 WebCore: WebCore::StyleBuilderFunctions::applyValueJustifyContent(WebCore::StyleResolver&, WebCore::CSSValue&) 8 WebCore: WebCore::StyleBuilder::applyProperty(WebCore::CSSPropertyID, WebCore::StyleResolver&, WebCore::CSSValue&, bool, bool) 8 WebCore: WebCore::StyleResolver::applyProperty(WebCore::CSSPropertyID, WebCore::CSSValue*, WebCore::SelectorChecker::LinkMatchMask, WebCore::StyleResolver::MatchResult const*) 8 WebCore: WebCore::StyleResolver::CascadedProperties::Property::apply(WebCore::StyleResolver&, WebCore::StyleResolver::MatchResult const*) 8 WebCore: WebCore::StyleResolver::applyCascadedProperties(WebCore::StyleResolver::CascadedProperties&, int, int, WebCore::StyleResolver::MatchResult const*) 8 WebCore: WebCore::StyleResolver::applyMatchedProperties(WebCore::StyleResolver::MatchResult const&, WebCore::Element const&, WebCore::StyleResolver::ShouldUseMatchedPropertiesCache) 8 WebCore: WebCore::StyleResolver::styleForElement(WebCore::Element const&, WebCore::RenderStyle const*, WebCore::RuleMatchingBehavior, WebCore::RenderRegion const*, WebCore::SelectorFilter const*) 6 WebCore: WebCore::Style::TreeResolver::styleForElement(WebCore::Element&, WebCore::RenderStyle const&) | 6 WebCore: WebCore::Style::TreeResolver::resolveElement(WebCore::Element&) | 6 WebCore: WebCore::Style::TreeResolver::resolveComposedTree() | 6 WebCore: WebCore::Style::TreeResolver::resolve(WebCore::Style::Change) | 6 WebCore: WebCore::Document::recalcStyle(WebCore::Style::Change) | 6 WebCore: WebCore::Document::updateStyleIfNeeded() | 6 WebCore: WebCore::Document::updateLayout() | 6 WebCore: WebCore::Document::updateLayoutIgnorePendingStylesheets(WebCore::Document::RunPostLayoutTasks) | 4 WebCore: WebCore::Element::getBoundingClientRect() | | 4 WebCore: WebCore::jsElementPrototypeFunctionGetBoundingClientRect(JSC::ExecState*) | | 4 | | 4 JavaScriptCore: llint_entry | | 4 JavaScriptCore: llint_entry | | 4 JavaScriptCore: llint_entry | | 4 JavaScriptCore: llint_entry | | 4 JavaScriptCore: llint_entry | | 4 JavaScriptCore: llint_entry | | 4 JavaScriptCore: llint_entry | | 4 JavaScriptCore: llint_entry | | 4 JavaScriptCore: vmEntryToJavaScript | | 4 JavaScriptCore: JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) | | 4 JavaScriptCore: JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) | | 4 JavaScriptCore: JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) | | 4 WebCore: WebCore::HTMLMediaElement::didAddUserAgentShadowRoot(WebCore::ShadowRoot*) | | 4 WebCore: WebCore::Element::addShadowRoot(WTF::Ref<WebCore::ShadowRoot>&&) | | 4 WebCore: WebCore::Element::ensureUserAgentShadowRoot() | | 4 WebCore: WebCore::HTMLMediaElement::ensureMediaControlsShadowRoot() | | 4 WebCore: WebCore::HTMLMediaElement::configureMediaControls() | | 4 WebCore: WebCore::HTMLMediaElement::insertedInto(WebCore::ContainerNode&) | | 4 WebCore: WebCore::notifyNodeInsertedIntoDocument(WebCore::ContainerNode&, WebCore::Node&, WTF::Vector<WTF::Ref<WebCore::Node>, 11ul, WTF::CrashOnOverflow, 16ul>&) | | 4 WebCore: WebCore::notifyDescendantInsertedIntoDocument(WebCore::ContainerNode&, WebCore::ContainerNode&, WTF::Vector<WTF::Ref<WebCore::Node>, 11ul, WTF::CrashOnOverflow, 16ul>&) | | 4 WebCore: WebCore::notifyNodeInsertedIntoDocument(WebCore::ContainerNode&, WebCore::Node&, WTF::Vector<WTF::Ref<WebCore::Node>, 11ul, WTF::CrashOnOverflow, 16ul>&) | | 4 WebCore: WebCore::notifyChildNodeInserted(WebCore::ContainerNode&, WebCore::Node&, WTF::Vector<WTF::Ref<WebCore::Node>, 11ul, WTF::CrashOnOverflow, 16ul>&) | | 4 WebCore: WebCore::ContainerNode::notifyChildInserted(WebCore::Node&, WebCore::ContainerNode::ChildChangeSource) | | 4 WebCore: WebCore::ContainerNode::updateTreeAfterInsertion(WebCore::Node&) | | 4 WebCore: WebCore::ContainerNode::appendChildWithoutPreInsertionValidityCheck(WebCore::Node&, int&) | | 4 WebCore: WebCore::ContainerNode::insertBefore(WebCore::Node&, WebCore::Node*, int&) | | 4 WebCore: WebCore::Node::insertBefore(WebCore::Node&, WebCore::Node*, int&) | | 4 WebCore: WebCore::JSNode::insertBefore(JSC::ExecState&) | | 4 WebCore: WebCore::jsNodePrototypeFunctionInsertBefore(JSC::ExecState*) | | 4 | | truncating... | pruning: 2 WebCore: WebCore::HTMLBodyElement::scrollHeight() pruning: 2 WebCore: WebCore::Element::resolveStyle(WebCore::RenderStyle const*) 1258124 1 koivisto 2016-12-09 05:38:48 -0800 rdar://problem/28465278 1258125 2 296650 koivisto 2016-12-09 05:44:59 -0800 Created attachment 296650 patch 1258657 3 296650 commit-queue 2016-12-10 01:58:36 -0800 Comment on attachment 296650 patch Clearing flags on attachment: 296650 Committed r209659: <http://trac.webkit.org/changeset/209659> 1258658 4 commit-queue 2016-12-10 01:58:38 -0800 All reviewed patches have been landed. Closing bug. 296650 2016-12-09 05:44:59 -0800 2016-12-10 01:58:36 -0800 patch CSSContentDistributionValue-crash.patch text/plain 2075 koivisto SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDIwOTYwMykKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE4IEBACisyMDE2LTEyLTA5ICBBbnR0aSBL b2l2aXN0byAgPGFudHRpQGFwcGxlLmNvbT4KKworICAgICAgICBDcmFzaFRyYWNlcjogY29tLmFw cGxlLldlYktpdC5XZWJDb250ZW50LkRldmVsb3BtZW50IGF0IGNvbS5hcHBsZS5XZWJDb3JlOiBX VEY6Om1hdGNoX2NvbnN0bmVzczxXZWJDb3JlOjpDU1NWYWx1ZSwgV2ViQ29yZTo6Q1NTQ29udGVu dERpc3RyaWJ1dGlvblZhbHVlPjo6dHlwZSYgV1RGOjpkb3duY2FzdDxXZWJDb3JlOjpDU1NDb250 ZW50RGlzdHJpYnV0aW9uVmFsdWUsIFdlYkNvcmU6OkNTU1ZhbHVlPiArIDY1CisgICAgICAgIGh0 dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNjU2NTIKKyAgICAgICAgcmRh cjovL3Byb2JsZW0vMjg0NjUyNzgKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMh KS4KKworICAgICAgICBObywgdGVzdCBkb24ndCBrbm93IGhvdyB0byBnZXQgaGVyZS4KKworICAg ICAgICAqIGNzcy9TdHlsZUJ1aWxkZXJDb252ZXJ0ZXIuaDoKKyAgICAgICAgKFdlYkNvcmU6OlN0 eWxlQnVpbGRlckNvbnZlcnRlcjo6Y29udmVydENvbnRlbnRBbGlnbm1lbnREYXRhKToKKworICAg ICAgICBBZGQgdHlwZSBjaGVja3MuCisKIDIwMTYtMTItMDkgIFBlciBBcm5lIFZvbGxhbiAgPHB2 b2xsYW5AYXBwbGUuY29tPgogCiAgICAgICAgIEZpeCBjb21waWxlIGVycm9ycyBvbiBXaW5kb3dz IHdoZW4gYnVpbGRpbmcgd2l0aCAucHJvaiBmaWxlcy4KSW5kZXg6IFNvdXJjZS9XZWJDb3JlL2Nz cy9TdHlsZUJ1aWxkZXJDb252ZXJ0ZXIuaAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2ViQ29yZS9j c3MvU3R5bGVCdWlsZGVyQ29udmVydGVyLmgJKHJldmlzaW9uIDIwOTQ1NCkKKysrIFNvdXJjZS9X ZWJDb3JlL2Nzcy9TdHlsZUJ1aWxkZXJDb252ZXJ0ZXIuaAkod29ya2luZyBjb3B5KQpAQCAtMTM1 Nyw2ICsxMzU3LDggQEAgaW5saW5lIFN0eWxlQ29udGVudEFsaWdubWVudERhdGEgU3R5bGVCdQog ICAgIFN0eWxlQ29udGVudEFsaWdubWVudERhdGEgYWxpZ25tZW50RGF0YSA9IFJlbmRlclN0eWxl Ojppbml0aWFsQ29udGVudEFsaWdubWVudCgpOwogI2lmIEVOQUJMRShDU1NfR1JJRF9MQVlPVVQp CiAgICAgaWYgKFJ1bnRpbWVFbmFibGVkRmVhdHVyZXM6OnNoYXJlZEZlYXR1cmVzKCkuaXNDU1NH cmlkTGF5b3V0RW5hYmxlZCgpKSB7CisgICAgICAgIGlmICghaXM8Q1NTQ29udGVudERpc3RyaWJ1 dGlvblZhbHVlPih2YWx1ZSkpCisgICAgICAgICAgICByZXR1cm4gYWxpZ25tZW50RGF0YTsKICAg ICAgICAgYXV0byYgY29udGVudFZhbHVlID0gZG93bmNhc3Q8Q1NTQ29udGVudERpc3RyaWJ1dGlv blZhbHVlPih2YWx1ZSk7CiAgICAgICAgIGlmIChjb250ZW50VmFsdWUuZGlzdHJpYnV0aW9uKCkt PnZhbHVlSUQoKSAhPSBDU1NWYWx1ZUludmFsaWQpCiAgICAgICAgICAgICBhbGlnbm1lbnREYXRh LnNldERpc3RyaWJ1dGlvbihjb250ZW50VmFsdWUuZGlzdHJpYnV0aW9uKCkuZ2V0KCkpOwpAQCAt MTM2Nyw2ICsxMzY5LDggQEAgaW5saW5lIFN0eWxlQ29udGVudEFsaWdubWVudERhdGEgU3R5bGVC dQogICAgICAgICByZXR1cm4gYWxpZ25tZW50RGF0YTsKICAgICB9CiAjZW5kaWYKKyAgICBpZiAo IWlzPENTU1ByaW1pdGl2ZVZhbHVlPih2YWx1ZSkpCisgICAgICAgIHJldHVybiBhbGlnbm1lbnRE YXRhOwogICAgIGF1dG8mIHByaW1pdGl2ZVZhbHVlID0gZG93bmNhc3Q8Q1NTUHJpbWl0aXZlVmFs dWU+KHZhbHVlKTsKICAgICBzd2l0Y2ggKHByaW1pdGl2ZVZhbHVlLnZhbHVlSUQoKSkgewogICAg IGNhc2UgQ1NTVmFsdWVTdHJldGNoOgo=