195629 2019-03-12 10:52:27 -0700 Crash when reloading test with async overflow scrolling 2019-03-18 17:33:45 -0700 1 1 1 Unclassified WebKit Scrolling WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 simon.fraser simon.fraser graouts simon.fraser webkit-bug-importer oldest_to_newest 1515512 0 364406 simon.fraser 2019-03-12 10:52:27 -0700 Created attachment 364406 Testcase Attached testcase can crash in the simulator on reload, accessing a deleted layer: * thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=EXC_I386_GPFLT) frame #0: 0x00000001ac8a5f6c WebCore`WebCore::RenderLayer::isStackingContext(this=0xfbf95304000004f9) const at RenderLayer.h:167:45 frame #1: 0x00000001ac8a5eb4 WebCore`WebCore::RenderLayer::stackingContext(this=0x00000001c8a98690) const at RenderLayer.cpp:614:29 frame #2: 0x00000001ac8a6a92 WebCore`WebCore::RenderLayer::paintOrderParent(this=0x00000001c8a98690) const at RenderLayer.h:1313:44 frame #3: 0x00000001ac8a4ba8 WebCore`WebCore::RenderLayer::setAncestorsHaveCompositingDirtyFlag(this=0x00000001c8a98690, flag=HasDescendantNeedingBackingOrHierarchyTraversal) at RenderLayer.cpp:739:24 frame #4: 0x00000001ac8f650a WebCore`void WebCore::RenderLayer::setBackingAndHierarchyTraversalDirtyBit<(WebCore::RenderLayer::Compositing)256>(this=0x00000001c8a98690) at RenderLayer.h:269:9 frame #5: 0x00000001ac8e0445 WebCore`WebCore::RenderLayer::setNeedsScrollingTreeUpdate(this=0x00000001c8a98690) at RenderLayer.h:275:42 * frame #6: 0x00000001ac8eb658 WebCore`WebCore::RenderLayerCompositor::detachScrollCoordinatedLayerWithRole(this=0x00000001c8a77000, layer=0x00000001c8a98540, scrollingCoordinator=0x00000001c8a9b160, role=Scrolling) at RenderLayerCompositor.cpp:3872:20 frame #7: 0x00000001ac8ea856 WebCore`WebCore::RenderLayerCompositor::detachScrollCoordinatedLayer(this=0x00000001c8a77000, layer=0x00000001c8a98540, roles={ size = 0 }) at RenderLayerCompositor.cpp:3887:9 frame #8: 0x00000001ac8cf0f1 WebCore`WebCore::RenderLayerCompositor::removeFromScrollCoordinatedLayers(this=0x00000001c8a77000, layer=0x00000001c8a98540) at RenderLayerCompositor.cpp:3740:5 frame #9: 0x00000001ac8c7542 WebCore`WebCore::RenderLayerBacking::willBeDestroyed(this=0x00000001c8add3e8) at RenderLayerBacking.cpp:259:18 frame #10: 0x00000001ac8a3e73 WebCore`WebCore::RenderLayer::clearBacking(this=0x00000001c8a98540, layerBeingDestroyed=true) at RenderLayer.cpp:5932:16 frame #11: 0x00000001ac8a38e1 WebCore`WebCore::RenderLayer::~RenderLayer(this=0x00000001c8a98540) at RenderLayer.cpp:371:5 frame #12: 0x00000001ac8a3fa5 WebCore`WebCore::RenderLayer::~RenderLayer(this=0x00000001c8a98540) at RenderLayer.cpp:339:1 frame #13: 0x00000001ac8a3fc9 WebCore`WebCore::RenderLayer::~RenderLayer(this=0x00000001c8a98540) at RenderLayer.cpp:339:1 Deleted layers are being left in m_scrollingNodeToLayerMap. 1515513 1 webkit-bug-importer 2019-03-12 10:52:46 -0700 <rdar://problem/48814045> 1517882 2 simon.fraser 2019-03-18 13:35:18 -0700 Seems to affect these tests: compositing/clipping/border-radius-async-overflow-non-stacking.html scrollingcoordinator/scrolling-tree/remove-coordinated-frame.html 1518024 3 365093 simon.fraser 2019-03-18 17:08:51 -0700 Created attachment 365093 Patch 1518035 4 simon.fraser 2019-03-18 17:33:45 -0700 https://trac.webkit.org/changeset/243120/webkit 364406 2019-03-12 10:52:27 -0700 2019-03-12 10:52:27 -0700 Testcase reparented-node-bad-parent.html text/html 2326 simon.fraser PCFET0NUWVBFIGh0bWw+CjxodG1sPgo8aGVhZD4KICAgIDx0aXRsZT5NdXRhdGVzIHRoZSBzY3Jv bGxpbmcgdHJlZSBhbmQgZmlyZXMgd2hlZWwgZXZlbnRzIHRvIDwvdGl0bGU+CiAgICA8c2NyaXB0 PgogICAgICAgIGlmICh3aW5kb3cudGVzdFJ1bm5lcikgewogICAgICAgICAgICB0ZXN0UnVubmVy LmR1bXBBc1RleHQoKTsKICAgICAgICAgICAgdGVzdFJ1bm5lci53YWl0VW50aWxEb25lKCk7CiAg ICAgICAgfQoKICAgICAgICBpZiAod2luZG93LmludGVybmFscykKICAgICAgICAgICAgd2luZG93 LmludGVybmFscy5zZXR0aW5ncy5zZXRBc3luY092ZXJmbG93U2Nyb2xsaW5nRW5hYmxlZCh0cnVl KTsKCiAgICAgICAgZnVuY3Rpb24gc2Nyb2xsVGVzdCgpCiAgICAgICAgewogICAgICAgICAgICBp ZiAod2luZG93LmV2ZW50U2VuZGVyKQogICAgICAgICAgICAgICAgcmV0dXJuOwoKICAgICAgICAg ICAgZXZlbnRTZW5kZXIubW9uaXRvcldoZWVsRXZlbnRzKCk7CgogICAgICAgICAgICB2YXIgc3Rh cnRQb3NYID0gMjAwOwogICAgICAgICAgICB2YXIgc3RhcnRQb3NZID0gMjAwOwogICAgICAgICAg ICBldmVudFNlbmRlci5tb3VzZU1vdmVUbyhzdGFydFBvc1gsIHN0YXJ0UG9zWSk7CiAgICAgICAg ICAgIGV2ZW50U2VuZGVyLm1vdXNlU2Nyb2xsQnlXaXRoV2hlZWxBbmRNb21lbnR1bVBoYXNlcygw LCAtMSwgJ2JlZ2FuJywgJ25vbmUnKTsKICAgICAgICAgICAgZXZlbnRTZW5kZXIubW91c2VTY3Jv bGxCeVdpdGhXaGVlbEFuZE1vbWVudHVtUGhhc2VzKDAsIC0xLCAnY2hhbmdlZCcsICdub25lJyk7 CiAgICAgICAgICAgIGV2ZW50U2VuZGVyLm1vdXNlU2Nyb2xsQnlXaXRoV2hlZWxBbmRNb21lbnR1 bVBoYXNlcygwLCAwLCAnZW5kZWQnLCAnbm9uZScpOwoKICAgICAgICAgICAgZXZlbnRTZW5kZXIu Y2FsbEFmdGVyU2Nyb2xsaW5nQ29tcGxldGVzKCgpID0+IHsKICAgICAgICAgICAgICAgIGlmICh3 aW5kb3cudGVzdFJ1bm5lcikKICAgICAgICAgICAgICAgICAgICB0ZXN0UnVubmVyLm5vdGlmeURv bmUoKTsKICAgICAgICAgICAgfSk7CiAgICAgICAgfQogICAgICAgIGZ1bmN0aW9uIGRvVGVzdCgp CiAgICAgICAgewogICAgICAgICAgICByZXF1ZXN0QW5pbWF0aW9uRnJhbWUoKCkgPT4gewogICAg ICAgICAgICAgICAgZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoJ3RhcmdldCcpLmNsYXNzTGlzdC5h ZGQoJ2NoYW5nZWQnKTsKICAgICAgICAgICAgICAgIHNjcm9sbFRlc3QoKTsKICAgICAgICAgICAg fSk7CiAgICAgICAgfQoKICAgICAgICB3aW5kb3cuYWRkRXZlbnRMaXN0ZW5lcignbG9hZCcsIGRv VGVzdCwgZmFsc2UpOwogICAgPC9zY3JpcHQ+CiAgICA8c3R5bGU+CiAgICAgICAgLnNjcm9sbGVy IHsKICAgICAgICAgICAgYmFja2dyb3VuZC1jb2xvcjogc2lsdmVyOwogICAgICAgICAgICBib3Jk ZXI6IDFweCBzb2xpZCBibGFjazsKICAgICAgICAgICAgcGFkZGluZzogMTBweDsKICAgICAgICAg ICAgd2lkdGg6IDQwMHB4OwogICAgICAgICAgICBoZWlnaHQ6IDMwMHB4OwogICAgICAgICAgICBv dmVyZmxvdzogc2Nyb2xsOwogICAgICAgIH0KICAgICAgICAKICAgICAgICAjdGFyZ2V0LmNoYW5n ZWQgewogICAgICAgICAgICBvdmVyZmxvdzogdmlzaWJsZTsKICAgICAgICB9CiAgICAgICAgCiAg ICAgICAgLnNjcm9sbGluZy1jb250ZW50IHsKICAgICAgICAgICAgaGVpZ2h0OiAxMDAwcHg7CiAg ICAgICAgfQogICAgPC9zdHlsZT4KPC9oZWFkPgo8Ym9keT4KICAgIDxkaXYgY2xhc3M9InNjcm9s bGVyIj4KICAgICAgICA8ZGl2IGNsYXNzPSJzY3JvbGxpbmctY29udGVudCI+CiAgICAgICAgICAg IFNjcm9sbGluZyBjb250ZW50CiAgICAgICAgICAgIDxkaXYgY2xhc3M9ImludGVybWVkaWF0ZSBz Y3JvbGxlciIgaWQ9InRhcmdldCI+CiAgICAgICAgICAgICAgICA8ZGl2IGNsYXNzPSJzY3JvbGxp bmctY29udGVudCI+CiAgICAgICAgICAgICAgICAgICAgTWlkZGxlIHNjcm9sbGluZyBjb250ZW50 CiAgICAgICAgICAgICAgICAgICAgPGRpdiBjbGFzcz0iaW5uZXIgc2Nyb2xsZXIiPgogICAgICAg ICAgICAgICAgICAgICAgICA8ZGl2IGNsYXNzPSJzY3JvbGxpbmctY29udGVudCI+CiAgICAgICAg ICAgICAgICAgICAgICAgIElubmVyIHNjcm9sbGluZyBjb250ZW50CiAgICAgICAgICAgICAgICAg ICAgICAgIDwvZGl2PgogICAgICAgICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICAgICAg PC9kaXY+CiAgICAgICAgICAgIDwvZGl2PgogICAgICAgIDwvZGl2PgogICAgPC9kaXY+CiAgICA8 cHJlIGlkPSJzY3JvbGxpbmdUcmVlIj48L3ByZT4KPC9ib2R5Pgo8L2h0bWw+Cg== 365093 2019-03-18 17:08:51 -0700 2019-03-18 17:31:35 -0700 Patch bug-195629-20190318170850.patch text/plain 2796 simon.fraser U3VidmVyc2lvbiBSZXZpc2lvbjogMjQzMDc1CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggNWFjNmEyYWZlZTM0NGJm ZmMxMzgyMmY0ODEyMGNjY2YxNDIzZTZjMS4uZTU3NTM4MTYzNjE4NjJmNTk0MzI3Y2QxMzFkMWZk ZjE4ZGUyMzE0ZCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDIzIEBACisyMDE5LTAzLTE4ICBTaW1v biBGcmFzZXIgIDxzaW1vbi5mcmFzZXJAYXBwbGUuY29tPgorCisgICAgICAgIENyYXNoIHdoZW4g cmVsb2FkaW5nIHRlc3Qgd2l0aCBhc3luYyBvdmVyZmxvdyBzY3JvbGxpbmcKKyAgICAgICAgaHR0 cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE5NTYyOQorICAgICAgICA8cmRh cjovL3Byb2JsZW0vNDg4MTQwNDU+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BT ISkuCisKKyAgICAgICAgUmVuZGVyTGF5ZXJDb21wb3NpdG9yOjpyZW1vdmVGcm9tU2Nyb2xsQ29v cmRpbmF0ZWRMYXllcnMgbmVlZHMgdG8gcGFzcyB0aGUgUG9zaXRpb25pbmcKKyAgICAgICAgYml0 IHRvIG1ha2Ugc3VyZSB3ZSByZW1vdmUgUmVuZGVyTGF5ZXJzIGFkZGVkIG1fc2Nyb2xsaW5nTm9k ZVRvTGF5ZXJNYXAgZm9yIFBvc2l0aW9uaW5nCisgICAgICAgIHNjcm9sbGluZyBub2Rlcy4KKwor ICAgICAgICBGaXhlcyBjcmFzaGVzIHNlZW4gaW4gY29tcG9zaXRpbmcvY2xpcHBpbmcvYm9yZGVy LXJhZGl1cy1hc3luYy1vdmVyZmxvdy1ub24tc3RhY2tpbmcuaHRtbAorICAgICAgICBhbmQgc2Ny b2xsaW5nY29vcmRpbmF0b3Ivc2Nyb2xsaW5nLXRyZWUvcmVtb3ZlLWNvb3JkaW5hdGVkLWZyYW1l Lmh0bWwuCisKKyAgICAgICAgKiByZW5kZXJpbmcvUmVuZGVyTGF5ZXJCYWNraW5nLmNwcDoKKyAg ICAgICAgKFdlYkNvcmU6OlJlbmRlckxheWVyQmFja2luZzo6flJlbmRlckxheWVyQmFja2luZyk6 CisgICAgICAgICogcmVuZGVyaW5nL1JlbmRlckxheWVyQ29tcG9zaXRvci5jcHA6CisgICAgICAg IChXZWJDb3JlOjpSZW5kZXJMYXllckNvbXBvc2l0b3I6OnJlbW92ZUZyb21TY3JvbGxDb29yZGlu YXRlZExheWVycyk6CisKIDIwMTktMDMtMTggIFJ5YW4gSGFkZGFkICA8cnlhbmhhZGRhZEBhcHBs ZS5jb20+CiAKICAgICAgICAgVW5yZXZpZXdlZCwgcm9sbGluZyBvdXQgcjI0MzAzNy4KZGlmZiAt LWdpdCBhL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJMYXllckJhY2tpbmcuY3BwIGIv U291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRlckxheWVyQmFja2luZy5jcHAKaW5kZXggNWUw ZDc1MmYwZjE1MDRjOGQyYjljZDk0ZWM2YzBmM2JjZTcwNDc4OC4uMzVlNzM2NzI1ODBmMmY1ZTY1 ZWNjZDI1YWM0MzlkODRmNjdlYjQ5MSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvcmVuZGVy aW5nL1JlbmRlckxheWVyQmFja2luZy5jcHAKKysrIGIvU291cmNlL1dlYkNvcmUvcmVuZGVyaW5n L1JlbmRlckxheWVyQmFja2luZy5jcHAKQEAgLTI1MCw2ICsyNTAsNyBAQCBSZW5kZXJMYXllckJh Y2tpbmc6On5SZW5kZXJMYXllckJhY2tpbmcoKQogICAgIEFTU0VSVCghbV92aWV3cG9ydENvbnN0 cmFpbmVkTm9kZUlEKTsKICAgICBBU1NFUlQoIW1fc2Nyb2xsaW5nTm9kZUlEKTsKICAgICBBU1NF UlQoIW1fZnJhbWVIb3N0aW5nTm9kZUlEKTsKKyAgICBBU1NFUlQoIW1fcG9zaXRpb25pbmdOb2Rl SUQpOwogCiAgICAgZGVzdHJveUdyYXBoaWNzTGF5ZXJzKCk7CiB9CmRpZmYgLS1naXQgYS9Tb3Vy Y2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyTGF5ZXJDb21wb3NpdG9yLmNwcCBiL1NvdXJjZS9X ZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJMYXllckNvbXBvc2l0b3IuY3BwCmluZGV4IGY4ODBlODJi YzY3NDQ1ZjEzYjVhYzg4NWUxMzFjYzNhOTkzMzMxMGMuLjkwMTEwNzQwNjFjZDcxMDRlNzRjOWEw YjJiNTQ1MTU5ZThmNjFkZmUgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9S ZW5kZXJMYXllckNvbXBvc2l0b3IuY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9S ZW5kZXJMYXllckNvbXBvc2l0b3IuY3BwCkBAIC0zODA1LDcgKzM4MDUsNyBAQCB2b2lkIFJlbmRl ckxheWVyQ29tcG9zaXRvcjo6cmVtb3ZlRnJvbVNjcm9sbENvb3JkaW5hdGVkTGF5ZXJzKFJlbmRl ckxheWVyJiBsYXllcgogICAgICAgICBtX2xlZ2FjeVNjcm9sbGluZ0xheWVyQ29vcmRpbmF0b3It PnJlbW92ZUxheWVyKGxheWVyKTsKICNlbmRpZgogCi0gICAgZGV0YWNoU2Nyb2xsQ29vcmRpbmF0 ZWRMYXllcihsYXllciwgeyBTY3JvbGxDb29yZGluYXRpb25Sb2xlOjpTY3JvbGxpbmcsIFNjcm9s bENvb3JkaW5hdGlvblJvbGU6OlZpZXdwb3J0Q29uc3RyYWluZWQsIFNjcm9sbENvb3JkaW5hdGlv blJvbGU6OkZyYW1lSG9zdGluZyB9KTsKKyAgICBkZXRhY2hTY3JvbGxDb29yZGluYXRlZExheWVy KGxheWVyLCB7IFNjcm9sbENvb3JkaW5hdGlvblJvbGU6OlNjcm9sbGluZywgU2Nyb2xsQ29vcmRp bmF0aW9uUm9sZTo6Vmlld3BvcnRDb25zdHJhaW5lZCwgU2Nyb2xsQ29vcmRpbmF0aW9uUm9sZTo6 RnJhbWVIb3N0aW5nLCBTY3JvbGxDb29yZGluYXRpb25Sb2xlOjpQb3NpdGlvbmluZyB9KTsKIH0K IAogRml4ZWRQb3NpdGlvblZpZXdwb3J0Q29uc3RyYWludHMgUmVuZGVyTGF5ZXJDb21wb3NpdG9y Ojpjb21wdXRlRml4ZWRWaWV3cG9ydENvbnN0cmFpbnRzKFJlbmRlckxheWVyJiBsYXllcikgY29u c3QK