178116 2017-10-10 00:21:15 -0700 El Capitan: Assertion failure inside RenderBlockFlow::ensureLineBoxes() 2023-09-05 15:39:06 -0700 1 1 1 Unclassified WebKit Layout and Rendering WebKit Nightly Build Unspecified Unspecified RESOLVED CONFIGURATION CHANGED P2 Normal --- 1 rniwa webkit-unassigned ahmad.saleem792 ap bfulgham koivisto simon.fraser zalan oldest_to_newest 1358658 0 rniwa 2017-10-10 00:21:15 -0700 stderr: ASSERTION FAILED: didNeedLayout || logicalHeight() == oldHeight /Volumes/Data/git-webkit/Source/WebCore/rendering/RenderBlockFlow.cpp(3661) : void WebCore::RenderBlockFlow::ensureLineBoxes() 1 0x120978ecd WTFCrash 2 0x1144cf8bd WebCore::RenderBlockFlow::ensureLineBoxes() 3 0x11479b4c0 WebCore::RenderText::ensureLineBoxes() 4 0x114405a0a WebCore::ensureLineBoxesIfNeeded(WebCore::RenderObject&) 5 0x114403bcf WebCore::Position::downstream(WebCore::EditingBoundaryCrossingRule) const 6 0x112a71d36 WebCore::previousVisuallyDistinctCandidate(WebCore::Position const&) 7 0x114ef5e6a WebCore::VisiblePosition::previous(WebCore::EditingBoundaryCrossingRule, bool*) const 8 0x114f02ff0 WebCore::isStartOfDocument(WebCore::VisiblePosition const&) 9 0x112cf5960 WebCore::FrameSelection::selectFrameElementInParentIfFullySelected() 10 0x112cf5507 WebCore::FrameSelection::setSelectionWithoutUpdatingAppearance(WebCore::VisibleSelection const&, unsigned int, WebCore::FrameSelection::CursorAlignOnScroll, WebCore::TextGranularity) 11 0x112cf3b34 WebCore::FrameSelection::setSelection(WebCore::VisibleSelection const&, unsigned int, WebCore::AXTextStateChangeIntent, WebCore::FrameSelection::CursorAlignOnScroll, WebCore::TextGranularity) 12 0x112cfe603 WebCore::FrameSelection::selectAll() 13 0x112aa7cf8 WebCore::executeSelectAll(WebCore::Frame&, WebCore::Event*, WebCore::EditorCommandSource, WTF::String const&) 14 0x112aa3993 WebCore::Editor::Command::execute(WTF::String const&, WebCore::Event*) const 15 0x1128f0819 WebCore::Document::execCommand(WTF::String const&, bool, WTF::String const&) 16 0x1134d1339 WebCore::jsDocumentPrototypeFunctionExecCommandBody(JSC::ExecState*, WebCore::JSDocument*, JSC::ThrowScope&) 17 0x1134bb3de long long WebCore::IDLOperation<WebCore::JSDocument>::call<&(WebCore::jsDocumentPrototypeFunctionExecCommandBody(JSC::ExecState*, WebCore::JSDocument*, JSC::ThrowScope&)), (WebCore::CastedThisErrorBehavior)0>(JSC::ExecState&, char const*) 18 0x1134bb16c WebCore::jsDocumentPrototypeFunctionExecCommand(JSC::ExecState*) 19 0x2983fee01028 20 0x11f554081 llint_entry 21 0x11f554081 llint_entry 22 0x11f54c447 vmEntryToJavaScript 23 0x12025fb6e JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) 24 0x1202070eb JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::ExecState*, JSC::JSObject*) 25 0x1204804b7 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) 26 0x120480650 JSC::profiledEvaluate(JSC::ExecState*, JSC::ProfilingReason, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) 27 0x1148b0d2b WebCore::JSMainThreadExecState::profiledEvaluate(JSC::ExecState*, JSC::ProfilingReason, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) 28 0x1148b0b18 WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld&, WebCore::ExceptionDetails*) 29 0x1148b0e0d WebCore::ScriptController::evaluate(WebCore::ScriptSourceCode const&, WebCore::ExceptionDetails*) 30 0x1148c6032 WebCore::ScriptElement::executeClassicScript(WebCore::ScriptSourceCode const&) 31 0x1148c463f WebCore::ScriptElement::prepareScript(WTF::TextPosition const&, WebCore::ScriptElement::LegacyTypeSupport) 1358659 1 323286 rniwa 2017-10-10 00:22:47 -0700 Created attachment 323286 crash.html Place this file inside LayoutTests and run: ./Tools/Scripts/run-webkit-tests --debug --no-retry --no-new-test-results crash.html As far as I've tested, you can only reproduce this on OS X El Capitan (10.11). e.g. 15G31 / 10.11.6. 1360080 2 ap 2017-10-13 10:46:03 -0700 Weird that this appears to be OS version dependent. I tried, and couldn't reproduce on High Sierra indeed. We should probably at least land the test case skipped on 10.11. 1360173 3 rniwa 2017-10-13 13:16:13 -0700 (In reply to Alexey Proskuryakov from comment #2) > Weird that this appears to be OS version dependent. I tried, and couldn't > reproduce on High Sierra indeed. > > We should probably at least land the test case skipped on 10.11. Yeah, it's super weird. I had to install El Capitan in order to reproduce this. 1360525 4 rniwa 2017-10-14 17:48:00 -0700 My guess is that it's something to do with the render theme of buttons because it's asserting as the editing code traverses into the button. If I add another div between the editable element and the button, the assertion goes away. In fact, that's how I worked around this in https://trac.webkit.org/r223195. 1360569 5 koivisto 2017-10-15 10:49:04 -0700 That assert is saying that results from the simple line layout path and the line box path don't match. This may be due to a bug on either path or it may be some rare case where we should not be using simple lines but are. On release something would be misrendered as a result. 1975243 6 ahmad.saleem792 2023-09-03 03:47:45 -0700 I know it might not be direct assertion link but 'FrameSelection::selectAll', Blink fixed this potential assertion: https://chromium.googlesource.com/chromium/src.git/+/526d14e61982c269e32bb2dd9869cd9185ab3da0 https://searchfox.org/wubkat/source/Source/WebCore/editing/FrameSelection.cpp#2128 1975686 7 zalan 2023-09-05 15:39:06 -0700 This is certainly not valid anymore. 323286 2017-10-10 00:22:47 -0700 2017-10-10 00:22:47 -0700 crash.html crash.html text/html 642 rniwa PCFET0NUWVBFIGh0bWw+CjxodG1sPgo8Ym9keT4KPHNjcmlwdCBzcmM9InJlc291cmNlcy9qcy10 ZXN0LXByZS5qcyI+PC9zY3JpcHQ+CjxzY3JpcHQ+CgpkZXNjcmlwdGlvbignVGhpcyB0ZXN0cyBz ZWxlY3RBbGwgaW5zaWRlIGFuIGlmcmFtZS4nKTsKanNUZXN0SXNBc3luYyA9IHRydWU7Cgpjb25z dCBpZnJhbWUgPSBkb2N1bWVudC5jcmVhdGVFbGVtZW50KCdpZnJhbWUnKTsKZG9jdW1lbnQuYm9k eS5hcHBlbmRDaGlsZChpZnJhbWUpOwppZnJhbWUuc3JjID0gYGRhdGE6dGV4dC9odG1sO2NoYXJz ZXQ9dXRmLTgsPCFET0NUWVBFIGh0bWw+CjxidXR0b24+MS4gQ29weTwvYnV0dG9uPgo8ZGl2IGlk PSJzb3VyY2UiIGNvbnRlbnRlZGl0YWJsZT5zb21lIHRleHQ8L2Rpdj4KPHNjcmlwdD4KCmZ1bmN0 aW9uIHJ1blRlc3QoKSB7CiAgICBkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgnc291cmNlJykuZm9j dXMoKTsKICAgIGRvY3VtZW50LmV4ZWNDb21tYW5kKCdzZWxlY3RBbGwnKTsKfQoKcnVuVGVzdCgp OwoKPC9zY3JpYCArICdwdD4nOwoKc2V0VGltZW91dChmaW5pc2hKU1Rlc3QsIDEwMCk7Cgo8L3Nj cmlwdD4KPHNjcmlwdCBzcmM9InJlc291cmNlcy9qcy10ZXN0LXBvc3QuanMiPjwvc2NyaXB0Pgo8 L2JvZHk+CjwvaHRtbD4K