206337 2020-01-15 21:56:55 -0800 REGRESSION (r251110): Crash on https://developer.apple.com/tutorials/swiftui/creating-and-combining-views 2020-03-26 00:31:39 -0700 1 1 1 Unclassified WebKit Forms WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=209585 InRadar P2 Normal --- 1 rniwa rniwa cdumez dbates esprehn+autocc ews-watchlist ggaren kangil.han koivisto wenson_hsieh zalan oldest_to_newest 1607347 0 rniwa 2020-01-15 21:56:55 -0800 WebKit crashes with the following backtrace when visiting https://developer.apple.com/tutorials/swiftui/creating-and-combining-views. 0 WebCore 0x00000001b88af7b0 WebCore::RadioButtonGroups::hasCheckedButton(WebCore::HTMLInputElement const&) const + 136 1 WebCore 0x00000001b88af74c WebCore::RadioButtonGroups::hasCheckedButton(WebCore::HTMLInputElement const&) const + 36 2 WebCore 0x00000001b8ae7310 WebCore::RadioInputType::matchesIndeterminatePseudoClass() const + 48 3 ??? 0x0000000caf0068a0 0 + 54475647136 4 WebCore 0x00000001b9238b0c WebCore::Style::ElementRuleCollector::collectMatchingRulesForList(WTF::Vector<WebCore::Style::RuleData, 1ul, WTF::CrashOnOverflow, 16ul> const*, WebCore::Style::MatchRequest const&) + 384 5 WebCore 0x00000001b9238840 WebCore::Style::ElementRuleCollector::collectMatchingRules(WebCore::Style::MatchRequest const&) + 740 6 WebCore 0x00000001b9239930 WebCore::Style::ElementRuleCollector::matchUARules() + 104 7 WebCore 0x00000001b9239f60 WebCore::Style::ElementRuleCollector::matchAllRules(bool, bool) + 40 8 WebCore 0x00000001b9250990 WebCore::Style::Resolver::styleForElement(WebCore::Element const&, WebCore::RenderStyle const*, WebCore::RenderStyle const*, WebCore::RuleMatchingBehavior, WebCore::SelectorFilter const*) + 488 9 WebCore 0x00000001b925b9e4 WebCore::Style::TreeResolver::styleForElement(WebCore::Element&, WebCore::RenderStyle const&) + 228 10 WebCore 0x00000001b925bd20 WebCore::Style::TreeResolver::resolveElement(WebCore::Element&) + 112 11 WebCore 0x00000001b925cd9c WebCore::Style::TreeResolver::resolveComposedTree() + 1388 12 WebCore 0x00000001b925d8f0 WebCore::Style::TreeResolver::resolve() + 700 <rdar://problem/58441241> 1607350 1 387895 rniwa 2020-01-15 22:07:18 -0800 Created attachment 387895 Fixes the bug 1607535 2 387895 ggaren 2020-01-16 10:34:26 -0800 Comment on attachment 387895 Fixes the bug r=me 1607562 3 387895 wenson_hsieh 2020-01-16 11:32:12 -0800 Comment on attachment 387895 Fixes the bug View in context: https://bugs.webkit.org/attachment.cgi?id=387895&action=review > LayoutTests/fast/forms/match-pseudo-on-radio-before-finalizing-tree-insertion-crash.html:18 > +script.textContent = 'document.getElementById("result").textContent = getComputedStyle(input).color ? "PASS" : "PASS"'; Nit - this could just be document.getElementById("result").textContent = "PASS"; 1607566 4 387895 rniwa 2020-01-16 11:36:58 -0800 Comment on attachment 387895 Fixes the bug View in context: https://bugs.webkit.org/attachment.cgi?id=387895&action=review >> LayoutTests/fast/forms/match-pseudo-on-radio-before-finalizing-tree-insertion-crash.html:18 >> +script.textContent = 'document.getElementById("result").textContent = getComputedStyle(input).color ? "PASS" : "PASS"'; > > Nit - this could just be document.getElementById("result").textContent = "PASS"; Ah, no, no, getComputedStyle(input).color is what triggers the crash. Without it, the test won't do anything useful. Perhaps I should split into a separate line to make it clear. 1607567 5 387895 wenson_hsieh 2020-01-16 11:38:24 -0800 Comment on attachment 387895 Fixes the bug View in context: https://bugs.webkit.org/attachment.cgi?id=387895&action=review >>> LayoutTests/fast/forms/match-pseudo-on-radio-before-finalizing-tree-insertion-crash.html:18 >>> +script.textContent = 'document.getElementById("result").textContent = getComputedStyle(input).color ? "PASS" : "PASS"'; >> >> Nit - this could just be document.getElementById("result").textContent = "PASS"; > > Ah, no, no, getComputedStyle(input).color is what triggers the crash. > Without it, the test won't do anything useful. > Perhaps I should split into a separate line to make it clear. Oh, I see! Yep, I think that splitting it out clarifies things. 1607570 6 387895 rniwa 2020-01-16 11:39:42 -0800 Comment on attachment 387895 Fixes the bug View in context: https://bugs.webkit.org/attachment.cgi?id=387895&action=review > LayoutTests/fast/forms/match-pseudo-on-radio-before-finalizing-tree-insertion-crash.html:26 > + Oh weird, this doesn't have the second input which makes this test hang in the trunk. Will fix that before landing it. 1607778 7 rniwa 2020-01-16 16:47:12 -0800 Committed r254722: <https://trac.webkit.org/changeset/254722> 387895 2020-01-15 22:07:18 -0800 2020-01-16 10:34:26 -0800 Fixes the bug bug-206337-20200115220717.patch text/plain 4680 rniwa SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDI1NDY2OCkKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDIyIEBACisyMDIwLTAxLTE1ICBSeW9zdWtl IE5pd2EgIDxybml3YUB3ZWJraXQub3JnPgorCisgICAgICAgIFJFR1JFU1NJT04gKHIyNTExMTAp OiBDcmFzaCBvbiBodHRwczovL2RldmVsb3Blci5hcHBsZS5jb20vdHV0b3JpYWxzL3N3aWZ0dWkv Y3JlYXRpbmctYW5kLWNvbWJpbmluZy12aWV3cworICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0 Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjA2MzM3CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZ IChPT1BTISkuCisKKyAgICAgICAgVGhlIGNyYXNoIHdhcyBjYXVzZWQgYnkgUmFkaW9CdXR0b25H cm91cHM6Omhhc0NoZWNrZWRCdXR0b24gZ2V0dGluZyBjYWxsZWQgYnkgUmFkaW9JbnB1dFR5cGUn cworICAgICAgICBtYXRjaGVzSW5kZXRlcm1pbmF0ZVBzZXVkb0NsYXNzIGR1cmluZyBhIHN0eWxl IHVwZGF0ZSB3aGljaCBoYXBwZW5zIGJlZm9yZSB0aGUgaW5wdXQgZWxlbWVudCBoYWQgYSBjaGFu Y2UKKyAgICAgICAgdG8gcmVnaXN0ZXIgaXRzZWxmIHdpdGggUmFkaW9CdXR0b25Hcm91cHMgaW4g SFRNTElucHV0RWxlbWVudDo6ZGlkRmluaXNoSW5zZXJ0aW5nTm9kZS4KKworICAgICAgICBUaGlz IGhhcHBlbnMsIGluIHBhcnRpY3VsYXIsIHdoZW4gZGlkRmluaXNoSW5zZXJ0aW5nTm9kZSBvZiBv dGhlciBub2RlcyB0aGF0IGFwcGVhciBiZWZvcmUgdGhlIGlucHV0IGVsZW1lbnQKKyAgICAgICAg ZXhlY3V0ZXMgYXJiaXRyYXJ5IGF1dGhvciBzY3JpcHRzIG9yIG90aGVyd2lzZSB1cGRhdGUgdGhl IHN0eWxlLgorCisgICAgICAgIFRlc3Q6IGZhc3QvZm9ybXMvbWF0Y2gtcHNldWRvLW9uLXJhZGlv LWJlZm9yZS1maW5hbGl6aW5nLXRyZWUtaW5zZXJ0aW9uLWNyYXNoLmh0bWwKKworICAgICAgICAq IGRvbS9SYWRpb0J1dHRvbkdyb3Vwcy5jcHA6CisgICAgICAgIChXZWJDb3JlOjpSYWRpb0J1dHRv bkdyb3Vwczo6aGFzQ2hlY2tlZEJ1dHRvbiBjb25zdCk6CisKIDIwMjAtMDEtMTUgIERvbiBPbG1z dGVhZCAgPGRvbi5vbG1zdGVhZEBzb255LmNvbT4KIAogICAgICAgICBbTEZDXSBGaXggQ01ha2Ug QnVpbGQKSW5kZXg6IFNvdXJjZS9XZWJDb3JlL2RvbS9SYWRpb0J1dHRvbkdyb3Vwcy5jcHAKPT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PQotLS0gU291cmNlL1dlYkNvcmUvZG9tL1JhZGlvQnV0dG9uR3JvdXBzLmNwcAkocmV2 aXNpb24gMjU0NjY3KQorKysgU291cmNlL1dlYkNvcmUvZG9tL1JhZGlvQnV0dG9uR3JvdXBzLmNw cAkod29ya2luZyBjb3B5KQpAQCAtMjU0LDcgKzI1NCwxMCBAQCBib29sIFJhZGlvQnV0dG9uR3Jv dXBzOjpoYXNDaGVja2VkQnV0dG9uCiAgICAgY29uc3QgQXRvbVN0cmluZyYgbmFtZSA9IGVsZW1l bnQubmFtZSgpOwogICAgIGlmIChuYW1lLmlzRW1wdHkoKSkKICAgICAgICAgcmV0dXJuIGVsZW1l bnQuY2hlY2tlZCgpOwotICAgIHJldHVybiBtX25hbWVUb0dyb3VwTWFwLmdldChuYW1lLmltcGwo KSktPmNoZWNrZWRCdXR0b24oKTsKKyAgICBhdXRvKiBncm91cCA9IG1fbmFtZVRvR3JvdXBNYXAu Z2V0KG5hbWUuaW1wbCgpKTsKKyAgICBpZiAoIWdyb3VwKQorICAgICAgICByZXR1cm4gZmFsc2U7 IC8vIEZJWE1FOiBVcGRhdGUgdGhlIHJhZGlvIGJ1dHRvbiBncm91cCBiZWZvcmUgYXV0aG9yIHNj cmlwdCBoYWQgYSBjaGFuY2UgdG8gcnVuIGluIGRpZEZpbmlzaEluc2VydGluZ05vZGUoKS4KKyAg ICByZXR1cm4gZ3JvdXAtPmNoZWNrZWRCdXR0b24oKTsKIH0KIAogYm9vbCBSYWRpb0J1dHRvbkdy b3Vwczo6aXNJblJlcXVpcmVkR3JvdXAoSFRNTElucHV0RWxlbWVudCYgZWxlbWVudCkgY29uc3QK SW5kZXg6IExheW91dFRlc3RzL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9D aGFuZ2VMb2cJKHJldmlzaW9uIDI1NDY2NykKKysrIExheW91dFRlc3RzL0NoYW5nZUxvZwkod29y a2luZyBjb3B5KQpAQCAtMSwzICsxLDE1IEBACisyMDIwLTAxLTE1ICBSeW9zdWtlIE5pd2EgIDxy bml3YUB3ZWJraXQub3JnPgorCisgICAgICAgIFJFR1JFU1NJT04gKHIyNTExMTApOiBDcmFzaCBv biBodHRwczovL2RldmVsb3Blci5hcHBsZS5jb20vdHV0b3JpYWxzL3N3aWZ0dWkvY3JlYXRpbmct YW5kLWNvbWJpbmluZy12aWV3cworICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93 X2J1Zy5jZ2k/aWQ9MjA2MzM3CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISku CisKKyAgICAgICAgQWRkZWQgYSByZWdyZXNzaW9uIHRlc3QuIFRoZSB0ZXN0IGNyYXNoZXMgb24g dHJ1bmsgYW5kIGNhdXNlcyBhbiBpbmZpbml0ZSBsb29wIGJlZm9yZSByMjUxMTEwLgorCisgICAg ICAgICogZmFzdC9mb3Jtcy9tYXRjaC1wc2V1ZG8tb24tcmFkaW8tYmVmb3JlLWZpbmFsaXppbmct dHJlZS1pbnNlcnRpb24tY3Jhc2gtZXhwZWN0ZWQudHh0OiBBZGRlZC4KKyAgICAgICAgKiBmYXN0 L2Zvcm1zL21hdGNoLXBzZXVkby1vbi1yYWRpby1iZWZvcmUtZmluYWxpemluZy10cmVlLWluc2Vy dGlvbi1jcmFzaC5odG1sOiBBZGRlZC4KKwogMjAyMC0wMS0xNSAgTGF1cm8gTW91cmEgIDxsbW91 cmFAaWdhbGlhLmNvbT4KIAogICAgICAgICBbR1RLXSBHYXJkZW5pbmcgdGVzdHMgdXNpbmcgbGFu Z3VhZ2Ugb3ZlcnJpZGUKSW5kZXg6IExheW91dFRlc3RzL2Zhc3QvZm9ybXMvbWF0Y2gtcHNldWRv LW9uLXJhZGlvLWJlZm9yZS1maW5hbGl6aW5nLXRyZWUtaW5zZXJ0aW9uLWNyYXNoLWV4cGVjdGVk LnR4dAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9mYXN0L2Zvcm1zL21hdGNoLXBzZXVkby1v bi1yYWRpby1iZWZvcmUtZmluYWxpemluZy10cmVlLWluc2VydGlvbi1jcmFzaC1leHBlY3RlZC50 eHQJKG5vbmV4aXN0ZW50KQorKysgTGF5b3V0VGVzdHMvZmFzdC9mb3Jtcy9tYXRjaC1wc2V1ZG8t b24tcmFkaW8tYmVmb3JlLWZpbmFsaXppbmctdHJlZS1pbnNlcnRpb24tY3Jhc2gtZXhwZWN0ZWQu dHh0CSh3b3JraW5nIGNvcHkpCkBAIC0wLDAgKzEsNSBAQAorVGhpcyB0ZXN0cyB1cGRhdGluZyB0 aGUgcHNldWRvIGNsYXNzIHN0YXRlIG9mIGEgcmFkaW8gYnV0dG9uIGluIHRoZSBtaWRkbGUgb2Yg bm9kZSBpbnNlcnRpb25zLgorVGhlIHRlc3QgcGFzc2VzIGlmIFdlYktpdCBkb2VzIG5vdCBjcmFz aCBvciBoYW5nLgorCitQQVNTCisKSW5kZXg6IExheW91dFRlc3RzL2Zhc3QvZm9ybXMvbWF0Y2gt cHNldWRvLW9uLXJhZGlvLWJlZm9yZS1maW5hbGl6aW5nLXRyZWUtaW5zZXJ0aW9uLWNyYXNoLmh0 bWwKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvZmFzdC9mb3Jtcy9tYXRjaC1wc2V1ZG8tb24t cmFkaW8tYmVmb3JlLWZpbmFsaXppbmctdHJlZS1pbnNlcnRpb24tY3Jhc2guaHRtbAkobm9uZXhp c3RlbnQpCisrKyBMYXlvdXRUZXN0cy9mYXN0L2Zvcm1zL21hdGNoLXBzZXVkby1vbi1yYWRpby1i ZWZvcmUtZmluYWxpemluZy10cmVlLWluc2VydGlvbi1jcmFzaC5odG1sCSh3b3JraW5nIGNvcHkp CkBAIC0wLDAgKzEsMzEgQEAKKzwhRE9DVFlQRSBodG1sPgorPGh0bWw+Cis8Ym9keT4KKzxwPlRo aXMgdGVzdHMgdXBkYXRpbmcgdGhlIHBzZXVkbyBjbGFzcyBzdGF0ZSBvZiBhIHJhZGlvIGJ1dHRv biBpbiB0aGUgbWlkZGxlIG9mIG5vZGUgaW5zZXJ0aW9ucy48YnI+CitUaGUgdGVzdCBwYXNzZXMg aWYgV2ViS2l0IGRvZXMgbm90IGNyYXNoIG9yIGhhbmcuPC9wPgorPGRpdiBpZD0icmVzdWx0Ij48 L2Rpdj4KKzxzdHlsZT4KKzppbmRldGVybWluYXRlIHsgY29sb3I6IGdyZWVuOyB9Cis8L3N0eWxl PgorPHNjcmlwdD4KKworaWYgKHdpbmRvdy50ZXN0UnVubmVyKQorICAgIHRlc3RSdW5uZXIuZHVt cEFzVGV4dCgpOworCitjb25zdCBkaXYgPSBkb2N1bWVudC5jcmVhdGVFbGVtZW50KCdkaXYnKTsK KworY29uc3Qgc2NyaXB0ID0gZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgnc2NyaXB0Jyk7CitzY3Jp cHQudGV4dENvbnRlbnQgPSAnZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoInJlc3VsdCIpLnRleHRD b250ZW50ID0gZ2V0Q29tcHV0ZWRTdHlsZShpbnB1dCkuY29sb3IgPyAiUEFTUyIgOiAiUEFTUyIn OworZGl2LmFwcGVuZENoaWxkKHNjcmlwdCk7CisKK2NvbnN0IGlucHV0ID0gZG9jdW1lbnQuY3Jl YXRlRWxlbWVudCgnaW5wdXQnKTsKK2lucHV0LnR5cGUgPSAncmFkaW8nOworaW5wdXQubmFtZSA9 ICdiYXonOworaW5wdXQuZm9ybSA9ICdmb28nOworZGl2LmFwcGVuZENoaWxkKGlucHV0KTsKKwor ZG9jdW1lbnQuYm9keS5hcHBlbmRDaGlsZChkaXYpOworCis8L3NjcmlwdD4KKzwvYm9keT4KKzwv aHRtbD4K