<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>180550</bug_id>
          
          <creation_ts>2017-12-07 15:14:31 -0800</creation_ts>
          <short_desc>iOS: Many AMP pages hit a release assertion inside Document::updateStyleIfNeeded</short_desc>
          <delta_ts>2017-12-07 20:50:50 -0800</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>Layout and Rendering</component>
          <version>WebKit Nightly Build</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Ryosuke Niwa">rniwa</reporter>
          <assigned_to name="Ryosuke Niwa">rniwa</assigned_to>
          <cc>bfulgham</cc>
    
    <cc>commit-queue</cc>
    
    <cc>simon.fraser</cc>
    
    <cc>zalan</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1379311</commentid>
    <comment_count>0</comment_count>
    <who name="Ryosuke Niwa">rniwa</who>
    <bug_when>2017-12-07 15:14:31 -0800</bug_when>
    <thetext>e.g.
0   WebCore                       	0x000000018be6f274 WebCore::Document::updateStyleIfNeeded() + 360 (Document.cpp:1955)
1   WebCore                       	0x000000018be6f1f8 WebCore::Document::updateStyleIfNeeded() + 236 (Document.cpp:1933)
2   WebCore                       	0x000000018cd59434 WebCore::LayoutContext::layout() + 780 (LayoutContext.cpp:490)
3   WebCore                       	0x000000018bedb470 WebCore::RenderWidget::updateWidgetPosition() + 212 (RenderWidget.cpp:339)
4   WebCore                       	0x000000018cd5e724 WebCore::FrameView::updateWidgetPositions() + 312 (FrameView.cpp:4893)
5   WebCore                       	0x000000018cd64f3c WebCore::LayoutContext::runOrScheduleAsynchronousTasks() + 444 (LayoutContext.cpp:222)
6   WebCore                       	0x000000018cd597b0 WebCore::LayoutContext::layout() + 1672 (LayoutContext.cpp:207)
7   WebCore                       	0x000000018bedb470 WebCore::RenderWidget::updateWidgetPosition() + 212 (RenderWidget.cpp:339)
8   WebCore                       	0x000000018cfbf608 WebCore::RenderFrameBase:: (bool, bool) + 100 (RenderFrameBase.cpp:80)
9   WebCore                       	0x000000018bee44d0 WebCore::RenderFrameBase::layoutWithFlattening(bool, bool) + 224 (RenderFrameBase.cpp:62)
10  WebCore                       	0x000000018bedae04 WebCore::RenderIFrame::layout() + 76 (RenderIFrame.cpp:111)
11  WebCore                       	0x000000018cf53e58 WebCore::RenderBlock::layoutPositionedObject(WebCore::RenderBox&amp;, bool, bool) + 420 (RenderElement.h:128)
12  WebCore                       	0x000000018be3bf9c WebCore::RenderBlock::layoutPositionedObjects(bool, bool) + 296 (RenderBlock.cpp:1476)
13  WebCore                       	0x000000018be3c4f0 WebCore::RenderBlock::simplifiedLayout() + 552 (RenderBlock.cpp:1335)
14  WebCore                       	0x000000018cf6003c WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) + 72 (RenderBlockFlow.cpp:457)
15  WebCore                       	0x000000018be3bfec WebCore::RenderBlock::layout() + 56 (RenderBlock.cpp:1031)</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1379312</commentid>
    <comment_count>1</comment_count>
    <who name="Ryosuke Niwa">rniwa</who>
    <bug_when>2017-12-07 15:14:44 -0800</bug_when>
    <thetext>&lt;rdar://problem/35410390&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1379316</commentid>
    <comment_count>2</comment_count>
      <attachid>328747</attachid>
    <who name="Ryosuke Niwa">rniwa</who>
    <bug_when>2017-12-07 15:19:48 -0800</bug_when>
    <thetext>Created attachment 328747
Fixes the crash</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1379320</commentid>
    <comment_count>3</comment_count>
      <attachid>328747</attachid>
    <who name="Ryosuke Niwa">rniwa</who>
    <bug_when>2017-12-07 15:25:05 -0800</bug_when>
    <thetext>Comment on attachment 328747
Fixes the crash

Clearing flags on attachment: 328747

Committed r225647: &lt;https://trac.webkit.org/changeset/225647&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1379458</commentid>
    <comment_count>4</comment_count>
      <attachid>328780</attachid>
    <who name="Ryosuke Niwa">rniwa</who>
    <bug_when>2017-12-07 19:31:38 -0800</bug_when>
    <thetext>Created attachment 328780
Add a test</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1379476</commentid>
    <comment_count>5</comment_count>
    <who name="Ryosuke Niwa">rniwa</who>
    <bug_when>2017-12-07 20:50:50 -0800</bug_when>
    <thetext>Committed r225670: &lt;https://trac.webkit.org/changeset/225670&gt;</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>328747</attachid>
            <date>2017-12-07 15:19:48 -0800</date>
            <delta_ts>2017-12-07 15:25:05 -0800</delta_ts>
            <desc>Fixes the crash</desc>
            <filename>bug-180550-20171207151948.patch</filename>
            <type>text/plain</type>
            <size>2777</size>
            <attacher name="Ryosuke Niwa">rniwa</attacher>
            
              <data encoding="base64">U3VidmVyc2lvbiBSZXZpc2lvbjogMjI1NjQyCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D
aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggODQ4NDAxMGQ5YzE2YjI5
YjNhODgwMDI2NjE3NzcwODYxMTE1NmRjYi4uMzRlNjE5MWMwZDExM2QzZDA3ZmY4YTg4ZDYzMTc5
ODIwOTE4MDJmOSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv
dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDIyIEBACisyMDE3LTEyLTA3ICBSeW9z
dWtlIE5pd2EgIDxybml3YUB3ZWJraXQub3JnPgorCisgICAgICAgIGlPUzogTWFueSBBTVAgcGFn
ZXMgY3Jhc2ggaW5zaWRlIERvY3VtZW50Ojp1cGRhdGVTdHlsZUlmTmVlZGVkCisgICAgICAgIGh0
dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xODA1NTAKKyAgICAgICAgPHJk
YXI6Ly9wcm9ibGVtLzM1NDEwMzkwPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09Q
UyEpLgorCisgICAgICAgIFRoZSBjcmFzaCB3YXMgY2F1c2VkIHdoZW4gdXBkYXRpZ24gdGhlIGxh
eW91dCBvZiBhbiBub24tZmxhdHRlbmVkIGZyYW1lIGluc2lkZSBhIGZsYXR0ZW5lZCBmcmFtZS4K
KyAgICAgICAgSW4gdGhvc2UgY2FzZXMsIGlzSW5DaGlsZEZyYW1lV2l0aEZyYW1lRmxhdHRlbmlu
ZyBpcyBmYWxzZSBvbiB0aGUgaW5uZXIgZnJhbWUuCisKKyAgICAgICAgTm8gbmV3IHRlc3RzIGZv
ciBub3cuCisKKyAgICAgICAgKiBkb20vTm9FdmVudERpc3BhdGNoQXNzZXJ0aW9uLmg6CisgICAg
ICAgICogcmVuZGVyaW5nL1JlbmRlckZyYW1lQmFzZS5jcHA6CisgICAgICAgIChXZWJDb3JlOjpS
ZW5kZXJGcmFtZUJhc2U6OnBlcmZvcm1MYXlvdXRXaXRoRmxhdHRlbmluZyk6IERpc2FibGUgdGhl
IGFzc2VydGlvbiB0ZW1wb3JhcmlseSBoZXJlLgorICAgICAgICBJbiB0aGVvcnksIHdlIHNob3Vs
ZCBiZSBhYmxlIHRvIHJlbW92ZSB0aGUgY2hlY2sgZm9yIGlzSW5DaGlsZEZyYW1lV2l0aEZyYW1l
RmxhdHRlbmluZyBidXQgd2UgZXJyCisgICAgICAgIG9uIHRoZSBzYWZlciBzaWRlIGZvciBub3cu
CisKIDIwMTctMTItMDcgIEplciBOb2JsZSAgPGplci5ub2JsZUBhcHBsZS5jb20+CiAKICAgICAg
ICAgW0VNRV0gU3VwcG9ydCB0aGUgJ2VuY3J5cHRlZCcgZXZlbnQgZm9yIEZQUyBlbmNyeXB0ZWQg
c3RyZWFtcwpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvZG9tL05vRXZlbnREaXNwYXRjaEFz
c2VydGlvbi5oIGIvU291cmNlL1dlYkNvcmUvZG9tL05vRXZlbnREaXNwYXRjaEFzc2VydGlvbi5o
CmluZGV4IDNiZjM0YjM4YjY3ODBkNGUyNDg1YjdlOGI1YjZmMmNhNTY5YTdmM2QuLjA0MjllODNh
ZDZhYjc3NTg5NTQ0YzQ1NjhjODEwMmNmZWFjMmU3ODIgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJD
b3JlL2RvbS9Ob0V2ZW50RGlzcGF0Y2hBc3NlcnRpb24uaAorKysgYi9Tb3VyY2UvV2ViQ29yZS9k
b20vTm9FdmVudERpc3BhdGNoQXNzZXJ0aW9uLmgKQEAgLTEyOSw3ICsxMjksOCBAQCBwdWJsaWM6
CiAgICAgfTsKICNlbmRpZgogCi0gICAgLy8gRklYTUU6IFJlbW92ZSB0aGlzIGNsYXNzIG9uY2Ug
dGhlIHN5bmMgbGF5b3V0IGluc2lkZSBTVkdJbWFnZTo6ZHJhdyBpcyByZW1vdmVkLgorICAgIC8v
IEZJWE1FOiBSZW1vdmUgdGhpcyBjbGFzcyBvbmNlIHRoZSBzeW5jIGxheW91dCBpbnNpZGUgU1ZH
SW1hZ2U6OmRyYXcgaXMgcmVtb3ZlZAorICAgIC8vIGFuZCByZWZhY3RvcmVkIHRoZSBjb2RlIGlu
IFJlbmRlckZyYW1lQmFzZTo6cGVyZm9ybUxheW91dFdpdGhGbGF0dGVuaW5nLgogICAgIGNsYXNz
IERpc2FibGVBc3NlcnRpb25zSW5TY29wZSB7CiAgICAgcHVibGljOgogICAgICAgICBEaXNhYmxl
QXNzZXJ0aW9uc0luU2NvcGUoKQpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvcmVuZGVyaW5n
L1JlbmRlckZyYW1lQmFzZS5jcHAgYi9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyRnJh
bWVCYXNlLmNwcAppbmRleCA4NzQ1ZDEwYjNiMzI3MjU2ZTIzOTBiMWFlZDkxZmJjZDQ3MjFmODBk
Li41MjVjNzM2OGYyOTFjY2MxN2RjZThhOTllOGI5OTNjNzAxMDRiNDY1IDEwMDY0NAotLS0gYS9T
b3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyRnJhbWVCYXNlLmNwcAorKysgYi9Tb3VyY2Uv
V2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyRnJhbWVCYXNlLmNwcApAQCAtMjksNiArMjksNyBAQAog
I2luY2x1ZGUgIkZyYW1lLmgiCiAjaW5jbHVkZSAiRnJhbWVWaWV3LmgiCiAjaW5jbHVkZSAiSFRN
TEZyYW1lRWxlbWVudEJhc2UuaCIKKyNpbmNsdWRlICJOb0V2ZW50RGlzcGF0Y2hBc3NlcnRpb24u
aCIKICNpbmNsdWRlICJSZW5kZXJWaWV3LmgiCiAjaW5jbHVkZSA8d3RmL0lzb01hbGxvY0lubGlu
ZXMuaD4KIApAQCAtNzMsNiArNzQsOCBAQCBSZW5kZXJWaWV3KiBSZW5kZXJGcmFtZUJhc2U6OmNo
aWxkUmVuZGVyVmlldygpIGNvbnN0CiAKIHZvaWQgUmVuZGVyRnJhbWVCYXNlOjpwZXJmb3JtTGF5
b3V0V2l0aEZsYXR0ZW5pbmcoYm9vbCBoYXNGaXhlZFdpZHRoLCBib29sIGhhc0ZpeGVkSGVpZ2h0
KQogeworICAgIC8vIEZJWE1FOiBSZWZhY3RvciBmcmFtZSBmbGF0dGVuaW5nIGNvZGUgc28gdGhh
dCB3ZSBkb24ndCBuZWVkIHRvIGRpc2FibGUgYXNzZXJ0aW9ucyBoZXJlLgorICAgIE5vRXZlbnRE
aXNwYXRjaEFzc2VydGlvbjo6RGlzYWJsZUFzc2VydGlvbnNJblNjb3BlIHNjb3BlOwogICAgIGlm
ICghY2hpbGRSZW5kZXJWaWV3KCkpCiAgICAgICAgIHJldHVybjsKIAo=
</data>

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>328780</attachid>
            <date>2017-12-07 19:31:38 -0800</date>
            <delta_ts>2017-12-07 19:32:35 -0800</delta_ts>
            <desc>Add a test</desc>
            <filename>bug-180550-20171207193137.patch</filename>
            <type>text/plain</type>
            <size>2731</size>
            <attacher name="Ryosuke Niwa">rniwa</attacher>
            
              <data encoding="base64">SW5kZXg6IExheW91dFRlc3RzL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9D
aGFuZ2VMb2cJKHJldmlzaW9uIDIyNTY2OCkKKysrIExheW91dFRlc3RzL0NoYW5nZUxvZwkod29y
a2luZyBjb3B5KQpAQCAtMSwzICsxLDE1IEBACisyMDE3LTEyLTA3ICBSeW9zdWtlIE5pd2EgIDxy
bml3YUB3ZWJraXQub3JnPgorCisgICAgICAgIGlPUzogTWFueSBBTVAgcGFnZXMgaGl0IGEgcmVs
ZWFzZSBhc3NlcnRpb24gaW5zaWRlIERvY3VtZW50Ojp1cGRhdGVTdHlsZUlmTmVlZGVkCisgICAg
ICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xODA1NTAKKworICAg
ICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBBZGQgYSB0ZXN0IGZv
ciByMjI1NjQ3LgorCisgICAgICAgICogZmFzdC9mcmFtZXMvZmxhdHRlbmluZy9ub24tZmxhdHRl
bmluZy1mcmFtZS1pbnNpZGUtZmxhdHRlbmluZy1pZnJhbWUtY3Jhc2gtZXhwZWN0ZWQudHh0OiBB
ZGRlZC4KKyAgICAgICAgKiBmYXN0L2ZyYW1lcy9mbGF0dGVuaW5nL25vbi1mbGF0dGVuaW5nLWZy
YW1lLWluc2lkZS1mbGF0dGVuaW5nLWlmcmFtZS1jcmFzaC5odG1sOiBBZGRlZC4KKwogMjAxNy0x
Mi0wNyAgRXJpYyBDYXJsc29uICA8ZXJpYy5jYXJsc29uQGFwcGxlLmNvbT4KIAogICAgICAgICBT
aW1wbGlmeSBsb2cgY2hhbm5lbCBjb25maWd1cmF0aW9uIFVJCkluZGV4OiBMYXlvdXRUZXN0cy9m
YXN0L2ZyYW1lcy9mbGF0dGVuaW5nL25vbi1mbGF0dGVuaW5nLWZyYW1lLWluc2lkZS1mbGF0dGVu
aW5nLWlmcmFtZS1jcmFzaC1leHBlY3RlZC50eHQKPT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMv
ZmFzdC9mcmFtZXMvZmxhdHRlbmluZy9ub24tZmxhdHRlbmluZy1mcmFtZS1pbnNpZGUtZmxhdHRl
bmluZy1pZnJhbWUtY3Jhc2gtZXhwZWN0ZWQudHh0CShub25leGlzdGVudCkKKysrIExheW91dFRl
c3RzL2Zhc3QvZnJhbWVzL2ZsYXR0ZW5pbmcvbm9uLWZsYXR0ZW5pbmctZnJhbWUtaW5zaWRlLWZs
YXR0ZW5pbmctaWZyYW1lLWNyYXNoLWV4cGVjdGVkLnR4dAkod29ya2luZyBjb3B5KQpAQCAtMCww
ICsxLDMgQEAKK1RoaXMgdGVzdHMgdGhhdCBXZWJLaXQgZG9lc24ndCBjcmFzaCB3aGVuIHRoZXJl
IGlzIGFuIG5vbi1mbGF0dGVuZWQgaWZyYW1lIGluc2lkZSBhIGZsYXR0ZW5lZCBpZnJhbWUuCisK
K1BBU1MuIFdlYktpdCBkaWQgbm90IGNyYXNoLgpJbmRleDogTGF5b3V0VGVzdHMvZmFzdC9mcmFt
ZXMvZmxhdHRlbmluZy9ub24tZmxhdHRlbmluZy1mcmFtZS1pbnNpZGUtZmxhdHRlbmluZy1pZnJh
bWUtY3Jhc2guaHRtbAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9mYXN0L2ZyYW1lcy9mbGF0
dGVuaW5nL25vbi1mbGF0dGVuaW5nLWZyYW1lLWluc2lkZS1mbGF0dGVuaW5nLWlmcmFtZS1jcmFz
aC5odG1sCShub25leGlzdGVudCkKKysrIExheW91dFRlc3RzL2Zhc3QvZnJhbWVzL2ZsYXR0ZW5p
bmcvbm9uLWZsYXR0ZW5pbmctZnJhbWUtaW5zaWRlLWZsYXR0ZW5pbmctaWZyYW1lLWNyYXNoLmh0
bWwJKHdvcmtpbmcgY29weSkKQEAgLTAsMCArMSwzNSBAQAorPCFET0NUWVBFIGh0bWw+Cis8aHRt
bD4KKzxib2R5PgorPHA+VGhpcyB0ZXN0cyB0aGF0IFdlYktpdCBkb2Vzbid0IGNyYXNoIHdoZW4g
dGhlcmUgaXMgYW4gbm9uLWZsYXR0ZW5lZCBpZnJhbWUgaW5zaWRlIGEgZmxhdHRlbmVkIGlmcmFt
ZS48L3A+Cis8ZGl2IGlkPSJjb250YWluZXIiPjwvZGl2PgorPHNjcmlwdD4KKworaWYgKHdpbmRv
dy50ZXN0UnVubmVyICYmIHdpbmRvdy5pbnRlcm5hbHMpIHsKKyAgICB0ZXN0UnVubmVyLmR1bXBB
c1RleHQoKTsKKyAgICBpbnRlcm5hbHMuc2V0dGluZ3Muc2V0RnJhbWVGbGF0dGVuaW5nKCJGdWxs
eUVuYWJsZWQiKTsKK30KKworY29uc3QgY29udGFpbmVyID0gZG9jdW1lbnQuZ2V0RWxlbWVudEJ5
SWQoJ2NvbnRhaW5lcicpOworY29uc3Qgb3V0ZXJJRnJhbWUgPSBkb2N1bWVudC5jcmVhdGVFbGVt
ZW50KCdpZnJhbWUnKTsKK2NvbnRhaW5lci5hcHBlbmRDaGlsZChvdXRlcklGcmFtZSk7CisKK2Nv
bnN0IGlubmVySUZyYW1lID0gZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgnaWZyYW1lJyk7Citpbm5l
cklGcmFtZS5zZXRBdHRyaWJ1dGUoJ3Njcm9sbGluZycsICdubycpOworaW5uZXJJRnJhbWUuc3R5
bGUud2lkdGggPSAnMTAwcHgnOworaW5uZXJJRnJhbWUuc3R5bGUuaGVpZ2h0ID0gJzEwMHB4JzsK
Kworb3V0ZXJJRnJhbWUuY29udGVudERvY3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQoaW5uZXJJRnJh
bWUpOworCitsZXQgY29udGVudCA9ICcnOworZm9yIChsZXQgaSA9IDA7IGkgPCA1MDsgaSsrKQor
ICAgIGNvbnRlbnQgKz0gYHNvbWUgdGV4dCAke2l9PGJyPmA7CisKK2lubmVySUZyYW1lLmNvbnRl
bnREb2N1bWVudC5ib2R5LmlubmVySFRNTCA9IGNvbnRlbnQ7CisKK2RvY3VtZW50LmJvZHkuZ2V0
Qm91bmRpbmdDbGllbnRSZWN0KCk7Citjb250YWluZXIudGV4dENvbnRlbnQgPSAnUEFTUy4gV2Vi
S2l0IGRpZCBub3QgY3Jhc2guJzsKKworPC9zY3JpcHQ+Cis8L2JvZHk+Cis8L2h0bWw+Cg==
</data>
<flag name="review"
          id="347945"
          type_id="1"
          status="+"
          setter="simon.fraser"
    />
          </attachment>
      

    </bug>

</bugzilla>