174131 2017-07-04 08:11:48 -0700 ASSERTION FAILED: !needsLayout() in WebCore::RenderMathMLScripts::firstLineBaseline 2017-11-21 01:19:24 -0800 1 1 1 Unclassified WebKit MathML WebKit Local Build Unspecified Unspecified RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=179754 InRadar P2 Normal --- 116980 1 hodovan fred.wang alex bfulgham fred.wang koivisto lambda mrobinson simon.fraser webkit-bug-importer zalan oldest_to_newest 1325442 0 hodovan 2017-07-04 08:11:48 -0700 Load the attached test with debug WebKitTestRunner: Checked version: 52ec9f7 OS: macOS Sierra (10.12.5) <math><mtr><mtd><mi></mtd><msub> Backtrace: ASSERTION FAILED: !needsLayout() WebKit/Source/WebCore/rendering/mathml/RenderMathMLScripts.cpp(476) : virtual std::optional<int> WebCore::RenderMathMLScripts::firstLineBaseline() const 1 0x12e8cbf11 WTFCrash 2 0x11592b665 WebCore::RenderMathMLScripts::firstLineBaseline() const 3 0x11536d439 WebCore::RenderBlock::firstLineBaseline() const 4 0x11543d4ff WebCore::RenderBlockFlow::firstLineBaseline() const 5 0x115c01bbe WebCore::RenderTableCell::cellBaselinePosition() const 6 0x115c029a6 WebCore::RenderTableCell::layout() 7 0x115c2241d WebCore::RenderTableRow::layout() 8 0x111371a2c WebCore::RenderElement::layoutIfNeeded() 9 0x115c2a961 WebCore::RenderTableSection::layout() 10 0x111371a2c WebCore::RenderElement::layoutIfNeeded() 11 0x115bd94c3 WebCore::RenderTable::layout() 12 0x111371a2c WebCore::RenderElement::layoutIfNeeded() 13 0x11547d0e8 WebCore::RenderBlockFlow::layoutLineBoxes(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 14 0x1153f78f4 WebCore::RenderBlockFlow::layoutInlineChildren(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 15 0x1153f4201 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) 16 0x1153344d4 WebCore::RenderBlock::layout() 17 0x111371a2c WebCore::RenderElement::layoutIfNeeded() 18 0x11591b53d WebCore::RenderMathMLRow::computeLineVerticalStretch(WebCore::LayoutUnit&, WebCore::LayoutUnit&) 19 0x11591f264 WebCore::RenderMathMLRow::layoutBlock(bool, WebCore::LayoutUnit) 20 0x1153344d4 WebCore::RenderBlock::layout() 21 0x111371a2c WebCore::RenderElement::layoutIfNeeded() 22 0x11547d0e8 WebCore::RenderBlockFlow::layoutLineBoxes(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 23 0x1153f78f4 WebCore::RenderBlockFlow::layoutInlineChildren(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 24 0x1153f4201 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) 25 0x1153344d4 WebCore::RenderBlock::layout() 26 0x115401744 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 27 0x1153f808f WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) 28 0x1153f4278 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) 29 0x1153344d4 WebCore::RenderBlock::layout() 30 0x115401744 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 31 0x1153f808f WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) ASAN:DEADLYSIGNAL ================================================================= ==20026==ERROR: AddressSanitizer: SEGV on unknown address 0x0000bbadbeef (pc 0x00012e8cbf49 bp 0x7fff58cf8f10 sp 0x7fff58cf8f00 T0) #0 0x12e8cbf48 in WTFCrash (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x3554f48) #1 0x11592b664 in WebCore::RenderMathMLScripts::firstLineBaseline() const (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x5e49664) #2 0x11536d438 in WebCore::RenderBlock::firstLineBaseline() const (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x588b438) #3 0x11543d4fe in WebCore::RenderBlockFlow::firstLineBaseline() const (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x595b4fe) #4 0x115c01bbd in WebCore::RenderTableCell::cellBaselinePosition() const (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x611fbbd) #5 0x115c029a5 in WebCore::RenderTableCell::layout() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x61209a5) #6 0x115c2241c in WebCore::RenderTableRow::layout() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x614041c) #7 0x111371a2b in WebCore::RenderElement::layoutIfNeeded() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x188fa2b) #8 0x115c2a960 in WebCore::RenderTableSection::layout() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x6148960) #9 0x111371a2b in WebCore::RenderElement::layoutIfNeeded() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x188fa2b) #10 0x115bd94c2 in WebCore::RenderTable::layout() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x60f74c2) #11 0x111371a2b in WebCore::RenderElement::layoutIfNeeded() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x188fa2b) #12 0x11547d0e7 in WebCore::RenderBlockFlow::layoutLineBoxes(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x599b0e7) #13 0x1153f78f3 in WebCore::RenderBlockFlow::layoutInlineChildren(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x59158f3) #14 0x1153f4200 in WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x5912200) #15 0x1153344d3 in WebCore::RenderBlock::layout() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x58524d3) #16 0x111371a2b in WebCore::RenderElement::layoutIfNeeded() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x188fa2b) #17 0x11591b53c in WebCore::RenderMathMLRow::computeLineVerticalStretch(WebCore::LayoutUnit&, WebCore::LayoutUnit&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x5e3953c) #18 0x11591f263 in WebCore::RenderMathMLRow::layoutBlock(bool, WebCore::LayoutUnit) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x5e3d263) #19 0x1153344d3 in WebCore::RenderBlock::layout() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x58524d3) #20 0x111371a2b in WebCore::RenderElement::layoutIfNeeded() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x188fa2b) #21 0x11547d0e7 in WebCore::RenderBlockFlow::layoutLineBoxes(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x599b0e7) #22 0x1153f78f3 in WebCore::RenderBlockFlow::layoutInlineChildren(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x59158f3) #23 0x1153f4200 in WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x5912200) #24 0x1153344d3 in WebCore::RenderBlock::layout() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x58524d3) #25 0x115401743 in WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x591f743) #26 0x1153f808e in WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x591608e) #27 0x1153f4277 in WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x5912277) #28 0x1153344d3 in WebCore::RenderBlock::layout() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x58524d3) #29 0x115401743 in WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x591f743) #30 0x1153f808e in WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x591608e) #31 0x1153f4277 in WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x5912277) #32 0x1153344d3 in WebCore::RenderBlock::layout() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x58524d3) #33 0x115d3ac75 in WebCore::RenderView::layoutContent(WebCore::LayoutState const&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x6258c75) #34 0x115d3d0d5 in WebCore::RenderView::layout() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x625b0d5) #35 0x111707847 in WebCore::FrameView::layout(bool) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1c25847) #36 0x110cf56fe in WebCore::Document::implicitClose() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x12136fe) #37 0x111681482 in WebCore::FrameLoader::checkCallImplicitClose() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1b9f482) #38 0x111680c02 in WebCore::FrameLoader::checkCompleted() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1b9ec02) #39 0x11167ccbb in WebCore::FrameLoader::finishedParsing() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1b9acbb) #40 0x110d27ecc in WebCore::Document::finishedParsing() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1245ecc) #41 0x111adef95 in WebCore::HTMLConstructionSite::finishedParsing() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1ffcf95) #42 0x111df5f27 in WebCore::HTMLTreeBuilder::finished() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x2313f27) #43 0x111b5983b in WebCore::HTMLDocumentParser::end() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x207783b) #44 0x111b53f06 in WebCore::HTMLDocumentParser::attemptToRunDeferredScriptsAndEnd() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x2071f06) #45 0x111b53abd in WebCore::HTMLDocumentParser::prepareToStopParsing() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x2071abd) #46 0x111b5995b in WebCore::HTMLDocumentParser::attemptToEnd() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x207795b) #47 0x111b59a97 in WebCore::HTMLDocumentParser::finish() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x2077a97) #48 0x110efe7af in WebCore::DocumentWriter::end() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x141c7af) #49 0x110e49696 in WebCore::DocumentLoader::finishedLoading() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1367696) #50 0x110e49092 in WebCore::DocumentLoader::notifyFinished(WebCore::CachedResource&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x1367092) #51 0x1100fc2e3 in WebCore::CachedResource::checkNotify() (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x61a2e3) #52 0x1100fc973 in WebCore::CachedResource::finishLoading(WebCore::SharedBuffer*) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x61a973) #53 0x1100ed401 in WebCore::CachedRawResource::finishLoading(WebCore::SharedBuffer*) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x60b401) #54 0x1167957e1 in WebCore::SubresourceLoader::didFinishLoading(WebCore::NetworkLoadMetrics const&) (WebKit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore+0x6cb37e1) #55 0x108e4d56b in WebKit::WebResourceLoader::didFinishResourceLoad(WebCore::NetworkLoadMetrics const&) (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x1f3956b) #56 0x108e5a2b9 in void IPC::callMemberFunctionImpl<WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&), std::__1::tuple<WebCore::NetworkLoadMetrics>, 0ul>(WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&), std::__1::tuple<WebCore::NetworkLoadMetrics>&&, std::__1::integer_sequence<unsigned long, 0ul>) (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x1f462b9) #57 0x108e59ec4 in void IPC::callMemberFunction<WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&), std::__1::tuple<WebCore::NetworkLoadMetrics>, std::__1::integer_sequence<unsigned long, 0ul> >(std::__1::tuple<WebCore::NetworkLoadMetrics>&&, WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)) (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x1f45ec4) #58 0x108e56f68 in void IPC::handleMessage<Messages::WebResourceLoader::DidFinishResourceLoad, WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)>(IPC::Decoder&, WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)) (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x1f42f68) #59 0x108e5512a in WebKit::WebResourceLoader::didReceiveWebResourceLoaderMessage(IPC::Connection&, IPC::Decoder&) (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x1f4112a) #60 0x1077cb2ac in WebKit::NetworkProcessConnection::didReceiveMessage(IPC::Connection&, IPC::Decoder&) (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x8b72ac) #61 0x10711faaa in IPC::Connection::dispatchMessage(IPC::Decoder&) (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x20baaa) #62 0x107104104 in IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >) (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x1f0104) #63 0x107120795 in IPC::Connection::dispatchOneMessage() (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x20c795) #64 0x10715f39c in IPC::Connection::enqueueIncomingMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >)::$_14::operator()() (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x24b39c) #65 0x10715f2c8 in WTF::Function<void ()>::CallableWrapper<IPC::Connection::enqueueIncomingMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >)::$_14>::call() (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/WebKit+0x24b2c8) #66 0x12e956a30 in WTF::Function<void ()>::operator()() const (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x35dfa30) #67 0x12e9a57d0 in WTF::RunLoop::performWork() (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x362e7d0) #68 0x12e9a6801 in WTF::RunLoop::performWork(void*) (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x362f801) #69 0x7fffabc81320 in __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0xa7320) #70 0x7fffabc6221c in __CFRunLoopDoSources0 (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0x8821c) #71 0x7fffabc61715 in __CFRunLoopRun (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0x87715) #72 0x7fffabc61113 in CFRunLoopRunSpecific (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0x87113) #73 0x7fffab1c2ebb in RunCurrentEventLoopInMode (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox+0x30ebb) #74 0x7fffab1c2cf0 in ReceiveNextEventCommon (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox+0x30cf0) #75 0x7fffab1c2b25 in _BlockUntilNextEventMatchingListInModeWithFilter (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox+0x30b25) #76 0x7fffa975ba53 in _DPSNextEvent (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit+0x46a53) #77 0x7fffa9ed77ed in -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit+0x7c27ed) #78 0x7fffa97503da in -[NSApplication run] (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit+0x3b3da) #79 0x7fffa971ae0d in NSApplicationMain (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit+0x5e0d) #80 0x7fffc16348c6 in _xpc_objc_main (/usr/lib/system/libxpc.dylib+0x108c6) #81 0x7fffc16332e3 in xpc_main (/usr/lib/system/libxpc.dylib+0xf2e3) #82 0x106ef9f22 in main (WebKit/WebKitBuild/Debug/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent.Development+0x100001f22) #83 0x7fffc13db234 in start (/usr/lib/system/libdyld.dylib+0x5234) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV (WebKit/WebKitBuild/Debug/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x3554f48) in WTFCrash ==20026==ABORTING #CRASHED - com.apple.WebKit.WebContent.Development (pid 20026) LEAK: 1 WebProcessPool LEAK: 1 WebPageProxy 1325443 1 314565 hodovan 2017-07-04 08:11:49 -0700 Created attachment 314565 Test 1371341 2 fred.wang 2017-11-14 02:12:53 -0800 OK, I hit it with the torture test https://mdn.mozillademos.org/en-US/docs/Mozilla/MathML_Project/MathML_Torture_Test$samples/MathML_Torture_Test ; I obtain the following trace: ASSERTION FAILED: !needsLayout() /Users/fred/WebKit/Source/WebCore/rendering/mathml/RenderMathMLScripts.cpp(479) : virtual std::optional<int> WebCore::RenderMathMLScripts::firstLineBaseline() const 1 0x10eeed24d WTFCrash 2 0x11639fbac WebCore::RenderMathMLScripts::firstLineBaseline() const 3 0x11638b0d8 WebCore::RenderMathMLBlock::ascentForChild(WebCore::RenderBox const&) 4 0x11639b909 WebCore::RenderMathMLRow::firstLineBaseline() const 5 0x11638b0d8 WebCore::RenderMathMLBlock::ascentForChild(WebCore::RenderBox const&) 6 0x11639b909 WebCore::RenderMathMLRow::firstLineBaseline() const 7 0x115ff77a4 WebCore::RenderBlock::firstLineBaseline() const 8 0x116019045 WebCore::RenderBlockFlow::firstLineBaseline() const 9 0x11629a8e6 WebCore::RenderTableCell::cellBaselinePosition() const 10 0x11629ab1b WebCore::RenderTableCell::layout() 11 0x1162b8dcd WebCore::RenderTableRow::layout() 12 0x115f8cdfc WebCore::RenderElement::layoutIfNeeded() 13 0x1162bd020 WebCore::RenderTableSection::layout() 14 0x115f8cdfc WebCore::RenderElement::layoutIfNeeded() 15 0x1162913ba WebCore::RenderTable::layout() This ASSERT was added in bug 153918 and was not present in RenderMathMLScripts::firstLineBaseline before. I wonder whether it is actually valid, none of the other firstLineBaseline functions have it. 1371400 3 326883 fred.wang 2017-11-14 09:22:07 -0800 Created attachment 326883 Testcase (using mtr, invalid markup) This is like attachment 314565, but with the mtd removed and the open/close markup explicit. This is invalid MathML. 1371401 4 326884 fred.wang 2017-11-14 09:24:01 -0800 Created attachment 326884 Testcase (using HTML table, display math) This is a testcase extracted from the MathML torture test. It is different from the initial testcase since it uses a HTML table and display math. Also, it is valid MathML markup. 1371762 5 326973 fred.wang 2017-11-15 01:23:42 -0800 Created attachment 326973 Testcase (using HTML table and grid) This testcase follows similar path as attachment 326884 but arrives on RenderGrid::firstLineBaseline() with needsLayout() == true. So I think this situation is not specific to MathML... RenderMathMLScripts seems to be the only firstLineBaseline implementation requiring needsLayout and I suspect I was a bit too strict when I added that in bug 153918. 1371767 6 326974 fred.wang 2017-11-15 01:50:57 -0800 Created attachment 326974 Patch 1372555 7 fred.wang 2017-11-16 01:44:30 -0800 I moved the more general issue to bug 179754. 1373940 8 326974 alex 2017-11-21 00:33:02 -0800 Comment on attachment 326974 Patch LGTM, we probably made the mistake of adding the assert trying to be too protective. 1373941 9 fred.wang 2017-11-21 00:38:07 -0800 Committed r225069: <https://trac.webkit.org/changeset/225069> 1373942 10 webkit-bug-importer 2017-11-21 00:39:20 -0800 <rdar://problem/35654156> 1373946 11 fred.wang 2017-11-21 01:19:24 -0800 Committed r225070: <https://trac.webkit.org/changeset/225070> 314565 2017-07-04 08:11:49 -0700 2017-07-04 08:11:49 -0700 Test test.html application/octet-stream 32 hodovan PG1hdGg+PG10cj48bXRkPjxtaT48L210ZD48bXN1Yj4= 326883 2017-11-14 09:22:07 -0800 2017-11-14 09:22:07 -0800 Testcase (using mtr, invalid markup) 174131-mtr-invalid.html text/html 66 fred.wang PCFET0NUWVBFIGh0bWw+CjxtYXRoPgogIDxtdHI+CiAgICA8bXN1Yj48L21zdWI+CiAgPC9tdHI+ CjwvbWF0aD4K 326884 2017-11-14 09:24:01 -0800 2017-11-14 09:24:01 -0800 Testcase (using HTML table, display math) 174131-table-display-block.html text/html 199 fred.wang PCFET0NUWVBFIGh0bWw+Cjx0YWJsZT4KICA8dHI+CiAgICA8dGQ+CiAgICAgIDxtYXRoIGRpc3Bs YXk9ImJsb2NrIj4KICAgICAgICA8bXVuZGVyPgogICAgICAgICAgPG10ZXh0PmE8L210ZXh0Pgog ICAgICAgICAgPG10ZXh0PmI8L210ZXh0PgogICAgICAgIDwvbXVuZGVyPgogICAgICA8L21hdGg+ CiAgICA8L3RkPgogIDwvdHI+CjwvdGFibGU+Cg== 326973 2017-11-15 01:23:42 -0800 2017-11-15 01:23:42 -0800 Testcase (using HTML table and grid) grid-firstLineBaseline-needsLayout.html text/html 835 fred.wang PCFET0NUWVBFIGh0bWw+CjxodG1sPgogIDxoZWFkPgogICAgPHRpdGxlPmNlbGwgYW5kIGdyaWQ8 L3RpdGxlPgogICAgPG1ldGEgY2hhcnNldD0idXRmLTgiLz4KICAgIDxzdHlsZT4KICAgICAgLndy YXBwZXIgewogICAgICAgIGRpc3BsYXk6IGdyaWQ7CiAgICAgICAgZ3JpZC10ZW1wbGF0ZS1jb2x1 bW5zOiAxMDBweCAxMDBweCAxMDBweDsKICAgICAgICBncmlkLWdhcDogMTBweDsKICAgICAgICBi YWNrZ3JvdW5kLWNvbG9yOiAjZmZmOwogICAgICAgIGNvbG9yOiAjNDQ0OwogICAgICB9CiAgICAg IC5ib3ggewogICAgICAgIGJhY2tncm91bmQtY29sb3I6ICM0NDQ7CiAgICAgICAgY29sb3I6ICNm ZmY7CiAgICAgICAgYm9yZGVyLXJhZGl1czogNXB4OwogICAgICAgIHBhZGRpbmc6IDIwcHg7CiAg ICAgICAgZm9udC1zaXplOiAxNTAlOwogICAgICB9CiAgICA8L3N0eWxlPgogIDwvaGVhZD4KICA8 Ym9keT4KCiAgICA8cD4KICAgICAgPHRhYmxlPgogICAgICAgIDx0cj4KICAgICAgICAgIDx0ZD4K CSAgICA8ZGl2IGNsYXNzPSJ3cmFwcGVyIj4KCSAgICAgIDxkaXYgY2xhc3M9ImJveCBhIj5BPC9k aXY+CgkgICAgICA8ZGl2IGNsYXNzPSJib3ggYiI+QjwvZGl2PgoJICAgICAgPGRpdiBjbGFzcz0i Ym94IGMiPkM8L2Rpdj4KCSAgICAgIDxkaXYgY2xhc3M9ImJveCBkIj5EPC9kaXY+CgkgICAgICA8 ZGl2IGNsYXNzPSJib3ggZSI+RTwvZGl2PgoJICAgICAgPGRpdiBjbGFzcz0iYm94IGYiPkY8L2Rp dj4KCSAgICA8L2Rpdj4KICAgICAgICAgIDwvdGQ+CiAgICAgICAgPC90cj4KICAgICAgPC90YWJs ZT4KICAgIDwvcD4KICAgICAgCiAgPC9ib2R5Pgo8L2h0bWw+Cg== 326974 2017-11-15 01:50:57 -0800 2017-11-21 00:33:02 -0800 Patch bug-174131-20171115105056.patch text/plain 4529 fred.wang U3VidmVyc2lvbiBSZXZpc2lvbjogMjI0ODcxCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggOWE5ZDJkN2U2YWQ4MzY1 YmRlNWE0OWRiYjI1NDk3NjExMDg1MzgxOS4uMDhmZDEwODY1MGNkNjZmNDU3NmEwYjQ4ZTNiYTYx OGNkNGU2YWQwOSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDI0IEBACisyMDE3LTExLTE1ICBGcmVk ZXJpYyBXYW5nICA8ZndhbmdAaWdhbGlhLmNvbT4KKworICAgICAgICBBU1NFUlRJT04gRkFJTEVE OiAhbmVlZHNMYXlvdXQoKSBpbiBXZWJDb3JlOjpSZW5kZXJNYXRoTUxTY3JpcHRzOjpmaXJzdExp bmVCYXNlbGluZQorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/ aWQ9MTc0MTMxCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAg ICAgUmVuZGVyTWF0aE1MU2NyaXB0czo6Zmlyc3RMaW5lQmFzZWxpbmUoKSBoYXMgYW4gQVNTRVJU IGF0IHRoZSBiZWdpbm5pbmcgdG8gZW5zdXJlIHRoYXQgdGhlIGZ1bmN0aW9uCisgICAgICAgIGlz IGNhbGxlZCBhZnRlciB0aGUgZWxlbWVudCB3YXMgbGFpZCBvdXQuIEhvd2V2ZXIsIHRoaXMgaXMg bm90IHJlc3BlY3RlZCBieSBIVE1MIHRhYmxlIGxheW91dCBhcworICAgICAgICBSZW5kZXJCbG9j azo6Zmlyc3RMaW5lQmFzZWxpbmUoKSBpcyBjYWxsZWQgZm9yIGVsZW1lbnRzIGluIGEgdGFibGUg Y2VsbCBiZWZvcmUgdGhleSBhcmUgbGFpZCBvdXQuCisgICAgICAgIFRoaXMgaGFwcGVucyBmb3Ig ZXhhbXBsZSBmb3IgUmVuZGVyR3JpZDo6Zmlyc3RMaW5lQmFzZWxpbmUoKSBhbmQgcHJvYmFibHkg Zm9yIG90aGVyIHJlbmRlcmVycy4KKyAgICAgICAgQWRkaXRpb25hbGx5LCBSZW5kZXJNYXRoTUxT Y3JpcHRzOjpmaXJzdExpbmVCYXNlbGluZSgpIG9ubHkgaW52b2x2ZXMgY2FsbGluZyBmaXJzdExp bmVCYXNlbGluZSgpOworICAgICAgICBsb2dpY2FsVG9wKCkgb3IgbG9naWNhbEhlaWdodCgpIG9u IHRoZSBmaXJzdCBjaGlsZCBib3ggc28gaXQgaXMgc2FmZSB0byBjYWxsIGl0IGJlZm9yZSBsYXlv dXQsIGV2ZW4KKyAgICAgICAgaWYgdGhlIHJldHVybiB2YWx1ZSBtaWdodCBiZSB3cm9uZyBhdCB0 aGF0IHRpbWUuIFRoaXMgcGF0Y2ggcmVtb3ZlcyB0aGlzIHRvbyByZXN0cmljdGl2ZSBBU1NFUlQg Zm9yCisgICAgICAgIFJlbmRlck1hdGhNTFNjcmlwdHMsIGZvciBjb25zaXN0ZW5jeSB3aXRoIG90 aGVyIGltcGxlbWVudGF0aW9ucyBvZiBmaXJzdExpbmVCYXNlbGluZSgpLgorCisgICAgICAgIFRl c3Q6IG1hdGhtbC9jZWxscy1hbmQtc2NyaXB0cy1jcmFzaC5odG1sCisKKyAgICAgICAgKiByZW5k ZXJpbmcvbWF0aG1sL1JlbmRlck1hdGhNTFNjcmlwdHMuY3BwOgorICAgICAgICAoV2ViQ29yZTo6 UmVuZGVyTWF0aE1MU2NyaXB0czo6Zmlyc3RMaW5lQmFzZWxpbmUgY29uc3QpOiBSZW1vdmUgdGhl IEFTU0VSVC4KKwogMjAxNy0xMS0xNCAgTmFuIFdhbmcgIDxuX3dhbmdAYXBwbGUuY29tPgogCiAg ICAgICAgIEFYOiBBT006IEltcGxlbWVudCBBY2Nlc3NpYmxlTm9kZSBjbGFzcyBhbmQgc3VwcG9y dCBsYWJlbCBhbmQgcm9sZSBhdHRyaWJ1dGVzCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9y ZW5kZXJpbmcvbWF0aG1sL1JlbmRlck1hdGhNTFNjcmlwdHMuY3BwIGIvU291cmNlL1dlYkNvcmUv cmVuZGVyaW5nL21hdGhtbC9SZW5kZXJNYXRoTUxTY3JpcHRzLmNwcAppbmRleCA2NjY1MDE0YjRh NzY5NzhiOWRlYmRkYzk2MTM3OTZkZDk5Y2ZkMjBhLi45OWJlYmZlM2UyNmIwZTMyZDRhZDExNDQ1 MzQ3ZmVkMWRlOGQ2Zjc1IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvbWF0 aG1sL1JlbmRlck1hdGhNTFNjcmlwdHMuY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmlu Zy9tYXRobWwvUmVuZGVyTWF0aE1MU2NyaXB0cy5jcHAKQEAgLTQ3Niw3ICs0NzYsNiBAQCB2b2lk IFJlbmRlck1hdGhNTFNjcmlwdHM6OmxheW91dEJsb2NrKGJvb2wgcmVsYXlvdXRDaGlsZHJlbiwg TGF5b3V0VW5pdCkKIAogc3RkOjpvcHRpb25hbDxpbnQ+IFJlbmRlck1hdGhNTFNjcmlwdHM6OmZp cnN0TGluZUJhc2VsaW5lKCkgY29uc3QKIHsKLSAgICBBU1NFUlQoIW5lZWRzTGF5b3V0KCkpOwog ICAgIGF1dG8qIGJhc2UgPSBmaXJzdENoaWxkQm94KCk7CiAgICAgaWYgKCFiYXNlKQogICAgICAg ICByZXR1cm4gc3RkOjpvcHRpb25hbDxpbnQ+KCk7CmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9D aGFuZ2VMb2cgYi9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKaW5kZXggNjcwYzk4ZTBlZTkwNjg5N2Fk Y2NlYjkyOGI4Nzk4MzNmZjk1YWNkNS4uNDM0NWIwZGFiNjRjYTIxODE4MmE0NDY5MGI2NWQ1NzFh ZDEzNmUyNCAxMDA2NDQKLS0tIGEvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCisrKyBiL0xheW91dFRl c3RzL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE1IEBACisyMDE3LTExLTE1ICBGcmVkZXJpYyBXYW5n ICA8ZndhbmdAaWdhbGlhLmNvbT4KKworICAgICAgICBBU1NFUlRJT04gRkFJTEVEOiAhbmVlZHNM YXlvdXQoKSBpbiBXZWJDb3JlOjpSZW5kZXJNYXRoTUxTY3JpcHRzOjpmaXJzdExpbmVCYXNlbGlu ZQorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTc0MTMx CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgQWRkIHRl c3RzIGZvciBjYWxsaW5nIFJlbmRlck1hdGhNTFNjcmlwdHM6OmZpcnN0TGluZUJhc2VsaW5lIHdp dGggbmVlZHNMYXlvdXQoKSA9PSB0cnVlLgorCisgICAgICAgICogbWF0aG1sL2NlbGxzLWFuZC1z Y3JpcHRzLWNyYXNoLWV4cGVjdGVkLnR4dDogQWRkZWQuCisgICAgICAgICogbWF0aG1sL2NlbGxz LWFuZC1zY3JpcHRzLWNyYXNoLmh0bWw6IEFkZGVkLgorCiAyMDE3LTExLTE0ICBOYW4gV2FuZyAg PG5fd2FuZ0BhcHBsZS5jb20+CiAKICAgICAgICAgQVg6IEFPTTogSW1wbGVtZW50IEFjY2Vzc2li bGVOb2RlIGNsYXNzIGFuZCBzdXBwb3J0IGxhYmVsIGFuZCByb2xlIGF0dHJpYnV0ZXMKZGlmZiAt LWdpdCBhL0xheW91dFRlc3RzL21hdGhtbC9jZWxscy1hbmQtc2NyaXB0cy1jcmFzaC1leHBlY3Rl ZC50eHQgYi9MYXlvdXRUZXN0cy9tYXRobWwvY2VsbHMtYW5kLXNjcmlwdHMtY3Jhc2gtZXhwZWN0 ZWQudHh0Cm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAuLjg1ZDJjMDc3YjkzZDk0NzI5MjFmZGJlMjVlMWQzOTVmNzIzNzg0 Y2IKLS0tIC9kZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0cy9tYXRobWwvY2VsbHMtYW5kLXNjcmlw dHMtY3Jhc2gtZXhwZWN0ZWQudHh0CkBAIC0wLDAgKzEsNSBAQAorVGhpcyB0ZXN0IHBhc3NlcyBp ZiBpdCBkb2VzIG5vdCBjcmFzaAorCithCitiCisKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL21h dGhtbC9jZWxscy1hbmQtc2NyaXB0cy1jcmFzaC5odG1sIGIvTGF5b3V0VGVzdHMvbWF0aG1sL2Nl bGxzLWFuZC1zY3JpcHRzLWNyYXNoLmh0bWwKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMC4uZTU3YzkyOGU5ODFmZmI1N2M1 MmZmM2I0MDBmYmQyYTU3ZmIwNzUyMQotLS0gL2Rldi9udWxsCisrKyBiL0xheW91dFRlc3RzL21h dGhtbC9jZWxscy1hbmQtc2NyaXB0cy1jcmFzaC5odG1sCkBAIC0wLDAgKzEsMzkgQEAKKzwhRE9D VFlQRSBodG1sPgorPGh0bWw+CisgIDxoZWFkPgorICAgIDx0aXRsZT5BU1NFUlRJT04gd2l0aCBj ZWxsIGxheW91dCBhbmQgbWF0aCBzY3JpcHRzPC90aXRsZT4KKyAgICA8bWV0YSBjaGFyc2V0PSJ1 dGYtOCIvPgorICAgIDxzY3JpcHQ+CisgICAgICBpZiAod2luZG93LnRlc3RSdW5uZXIpCisgICAg ICAgICAgdGVzdFJ1bm5lci5kdW1wQXNUZXh0KCk7CisgICAgPC9zY3JpcHQ+CisgIDwvaGVhZD4K KyAgPGJvZHk+CisKKyAgICA8cD5UaGlzIHRlc3QgcGFzc2VzIGlmIGl0IGRvZXMgbm90IGNyYXNo PC9wPgorCisgICAgPHA+CisgICAgICA8dGFibGU+CisgICAgICAgIDx0cj4KKyAgICAgICAgICA8 dGQ+CisgICAgICAgICAgICA8bWF0aCBkaXNwbGF5PSJibG9jayI+CisgICAgICAgICAgICAgIDxt dW5kZXI+CisgICAgICAgICAgICAgICAgPG10ZXh0PmE8L210ZXh0PgorICAgICAgICAgICAgICAg IDxtdGV4dD5iPC9tdGV4dD4KKyAgICAgICAgICAgICAgPC9tdW5kZXI+CisgICAgICAgICAgICA8 L21hdGg+CisgICAgICAgICAgPC90ZD4KKyAgICAgICAgPC90cj4KKyAgICAgIDwvdGFibGU+Cisg ICAgPC9wPgorCisgICAgPHA+CisgICAgICA8bWF0aD4KKyAgICAgICAgPG10cj4KKyAgICAgICAg ICA8bXN1Yj48L21zdWI+CisgICAgICAgIDwvbXRyPgorICAgICAgPC9tYXRoPgorICAgIDwvcD4K KyAgICAKKyAgPC9ib2R5PgorPC9odG1sPgo=