217143 2020-09-30 13:18:23 -0700 REGRESSION(r267781): ASSERTION FAILED: Optional.h(525) : T *WTF::Optional<WebCore::Layout::LineRun::Text>::operator->() on 16 fast/layoutformattingcontext/* tests 2020-10-01 10:42:40 -0700 1 1 1 Unclassified WebKit Layout and Rendering WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 hector_i_lopez simon.fraser bfulgham simon.fraser webkit-bot-watchers-bugzilla webkit-bug-importer zalan oldest_to_newest 1693501 0 hector_i_lopez 2020-09-30 13:18:23 -0700 fast/layoutformattingcontext/block-only/replaced-as-inline-block-simple.html fast/layoutformattingcontext/br-and-wbr-simple.html fast/layoutformattingcontext/br-in-inline-content-simple.html fast/layoutformattingcontext/float-and-br-inline-content-only.html fast/layoutformattingcontext/inline-box-overlaps-multiple-lines.html fast/layoutformattingcontext/replaced-box-with-margin-on-baseline.html fast/layoutformattingcontext/subframe-with-display-none-html.html fast/layoutformattingcontext/table-basic-row-baseline-align.html fast/layoutformattingcontext/table-basic-row-vertical-align-baseline.html fast/layoutformattingcontext/table-cell-vertical-alignment-simple.html fast/layoutformattingcontext/table-min-max-width-simple.html fast/layoutformattingcontext/vertical-align-bottom-nested.html fast/layoutformattingcontext/vertical-align-top-nested.html fast/layoutformattingcontext/out-of-flow-positioned-line-breaks.html fast/layoutformattingcontext/fit-content-width-simple.html fast/layoutformattingcontext/simple-inline-block.html Test are all constant crashes according to history on macOS wk2 Debug. First occurrence of constant crashes is at https://trac.webkit.org/changeset/267781/webkit Also, the last three are associated with https://bugs.webkit.org/show_bug.cgi?id=216668 and corresponding rdar://69101155 History: https://results.webkit.org/?suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&test=fast%2Flayoutformattingcontext%2Fblock-only%2Freplaced-as-inline-block-simple.html&test=fast%2Flayoutformattingcontext%2Fbr-and-wbr-simple.html&test=fast%2Flayoutformattingcontext%2Fbr-in-inline-content-simple.html&test=fast%2Flayoutformattingcontext%2Ffit-content-width-simple.html&test=fast%2Flayoutformattingcontext%2Ffloat-and-br-inline-content-only.html&test=fast%2Flayoutformattingcontext%2Finline-box-overlaps-multiple-lines.html&test=fast%2Flayoutformattingcontext%2Fout-of-flow-positioned-line-breaks.html&test=fast%2Flayoutformattingcontext%2Freplaced-box-with-margin-on-baseline.html&test=fast%2Flayoutformattingcontext%2Fsimple-inline-block.html&test=fast%2Flayoutformattingcontext%2Fsubframe-with-display-none-html.html&test=fast%2Flayoutformattingcontext%2Ftable-basic-row-baseline-align.html&test=fast%2Flayoutformattingcontext%2Ftable-basic-row-vertical-align-baseline.html&test=fast%2Flayoutformattingcontext%2Ftable-cell-vertical-alignment-simple.html&test=fast%2Flayoutformattingcontext%2Ftable-min-max-width-simple.html&test=fast%2Flayoutformattingcontext%2Fvertical-align-bottom-nested.html&test=fast%2Flayoutformattingcontext%2Fvertical-align-top-nested.html&style=debug&flavor=wk2 Crash log for one example, fast/layoutformattingcontext/block-only/replaced-as-inline-block-simple.html: Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.JavaScriptCore 0x00000001a5b01abe WTFCrash + 14 (Assertions.cpp:295) 1 com.apple.WebCore 0x0000000188aa6da9 WTF::Optional<WebCore::Layout::LineRun::Text>::operator->() + 73 (Optional.h:525) 2 com.apple.WebCore 0x0000000188ab91ab WebCore::Display::TextBox::debugDescription() const + 235 (DisplayTextBox.cpp:49) 3 com.apple.WebCore 0x0000000188aab478 WebCore::Display::outputDisplayBox(WTF::TextStream&, WebCore::Display::Box const&, unsigned int) + 56 (DisplayTreeBuilder.cpp:203) 4 com.apple.WebCore 0x0000000188aa5ac3 WebCore::Display::outputDisplayTree(WTF::TextStream&, WebCore::Display::Box const&, unsigned int) + 35 (DisplayTreeBuilder.cpp:211) 5 com.apple.WebCore 0x0000000188aa5b20 WebCore::Display::outputDisplayTree(WTF::TextStream&, WebCore::Display::Box const&, unsigned int) + 128 (DisplayTreeBuilder.cpp:213) 6 com.apple.WebCore 0x0000000188aa5b20 WebCore::Display::outputDisplayTree(WTF::TextStream&, WebCore::Display::Box const&, unsigned int) + 128 (DisplayTreeBuilder.cpp:213) 7 com.apple.WebCore 0x0000000188aa5b20 WebCore::Display::outputDisplayTree(WTF::TextStream&, WebCore::Display::Box const&, unsigned int) + 128 (DisplayTreeBuilder.cpp:213) 1693502 1 webkit-bug-importer 2020-09-30 13:19:05 -0700 <rdar://problem/69805462> 1693506 2 410150 simon.fraser 2020-09-30 13:35:40 -0700 Created attachment 410150 Patch 1693792 3 ews-feeder 2020-10-01 10:42:39 -0700 Committed r267842: <https://trac.webkit.org/changeset/267842> All reviewed patches have been landed. Closing bug and clearing flags on attachment 410150. 410150 2020-09-30 13:35:40 -0700 2020-10-01 10:42:40 -0700 Patch bug-217143-20200930133540.patch text/plain 2373 simon.fraser U3VidmVyc2lvbiBSZXZpc2lvbjogMjY3Nzk2CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggN2Q5YTZlN2FjYzhmMDJk N2ViMjhiZGQzYmE1ZjU0NDE2NzdhMzhlZi4uMzlmMTQ3ZjBmMzQ2MDhmNDAyNjBkMDkxNGU5OWFi ODcxMjFiNjBhOCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE1IEBACisyMDIwLTA5LTMwICBTaW1v biBGcmFzZXIgIDxzaW1vbi5mcmFzZXJAYXBwbGUuY29tPgorCisgICAgICAgIFJFR1JFU1NJT04o cjI2Nzc4MSk6IEFTU0VSVElPTiBGQUlMRUQ6IE9wdGlvbmFsLmgoNTI1KSA6IFQgKldURjo6T3B0 aW9uYWw8V2ViQ29yZTo6TGF5b3V0OjpMaW5lUnVuOjpUZXh0Pjo6b3BlcmF0b3ItPigpIG9uIDE2 IGZhc3QvbGF5b3V0Zm9ybWF0dGluZ2NvbnRleHQvKiB0ZXN0cworICAgICAgICBodHRwczovL2J1 Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjE3MTQzCisKKyAgICAgICAgUmV2aWV3ZWQg YnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgTmVlZCB0byB0ZXN0IHRoZSBPcHRpb25hbDw+ IHRleHQoKSBpbiBkdW1waW5nIGNvZGUuCisKKyAgICAgICAgKiBkaXNwbGF5L2Nzcy9EaXNwbGF5 VGV4dEJveC5jcHA6CisgICAgICAgIChXZWJDb3JlOjpEaXNwbGF5OjpUZXh0Qm94OjpkZWJ1Z0Rl c2NyaXB0aW9uIGNvbnN0KToKKwogMjAyMC0wOS0zMCAgU2FtIFdlaW5pZyAgPHdlaW5pZ0BhcHBs ZS5jb20+CiAKICAgICAgICAgUmVtb3ZlIGNvZGUgYmVoaW5kIEVOQUJMRShNRURJQV9TRVNTSU9O KSwgbm8gcG9ydHMgZW5hYmxlIGl0CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9kaXNwbGF5 L2Nzcy9EaXNwbGF5VGV4dEJveC5jcHAgYi9Tb3VyY2UvV2ViQ29yZS9kaXNwbGF5L2Nzcy9EaXNw bGF5VGV4dEJveC5jcHAKaW5kZXggNjY5OTA0MWM1YTdkNTVhYWI4ZTkyYWMzYmMxMWI2NDM0NDZi MzI5ZS4uMTJlMDkxOTI2YTAzY2IxZWFhMTExMGJjY2ZlNWE1YTE1OGQ1M2EwNyAxMDA2NDQKLS0t IGEvU291cmNlL1dlYkNvcmUvZGlzcGxheS9jc3MvRGlzcGxheVRleHRCb3guY3BwCisrKyBiL1Nv dXJjZS9XZWJDb3JlL2Rpc3BsYXkvY3NzL0Rpc3BsYXlUZXh0Qm94LmNwcApAQCAtNDYsMTYgKzQ2 LDE4IEBAIFN0cmluZyBUZXh0Qm94OjpkZWJ1Z0Rlc2NyaXB0aW9uKCkgY29uc3QKICAgICBUZXh0 U3RyZWFtIHN0cmVhbTsKIAogICAgIHN0cmVhbSA8PCAidGV4dCBib3ggIiA8PCBib3JkZXJCb3hG cmFtZSgpIDw8ICIgKCIgPDwgdGhpcyA8PCAiKSI7Ci0gICAgYXV0byB0ZXh0Q29udGVudCA9IHRl eHQoKS0+Y29udGVudCgpLnN1YnN0cmluZyh0ZXh0KCktPnN0YXJ0KCksIHRleHQoKS0+bGVuZ3Ro KCkpOwotICAgIHRleHRDb250ZW50LnJlcGxhY2VXaXRoTGl0ZXJhbCgnXFwnLCAiXFxcXCIpOwot ICAgIHRleHRDb250ZW50LnJlcGxhY2VXaXRoTGl0ZXJhbCgnXG4nLCAiXFxuIik7Ci0gICAgY29u c3Qgc2l6ZV90IG1heFByaW50ZWRMZW5ndGggPSA4MDsKLSAgICBpZiAodGV4dENvbnRlbnQubGVu Z3RoKCkgPiBtYXhQcmludGVkTGVuZ3RoKSB7Ci0gICAgICAgIGF1dG8gc3Vic3RyaW5nID0gdGV4 dENvbnRlbnQuc3Vic3RyaW5nKDAsIG1heFByaW50ZWRMZW5ndGgpOwotICAgICAgICBzdHJlYW0g PDwgIiBcIiIgPDwgc3Vic3RyaW5nIDw8ICJcIuKApiI7Ci0gICAgfSBlbHNlCi0gICAgICAgIHN0 cmVhbSA8PCAiIFwiIiA8PCB0ZXh0Q29udGVudCA8PCAiXCIiOwotCisgICAgaWYgKHRleHQoKSkg eworICAgICAgICBhdXRvIHRleHRDb250ZW50ID0gdGV4dCgpLT5jb250ZW50KCkuc3Vic3RyaW5n KHRleHQoKS0+c3RhcnQoKSwgdGV4dCgpLT5sZW5ndGgoKSk7CisgICAgICAgIHRleHRDb250ZW50 LnJlcGxhY2VXaXRoTGl0ZXJhbCgnXFwnLCAiXFxcXCIpOworICAgICAgICB0ZXh0Q29udGVudC5y ZXBsYWNlV2l0aExpdGVyYWwoJ1xuJywgIlxcbiIpOworICAgICAgICBjb25zdCBzaXplX3QgbWF4 UHJpbnRlZExlbmd0aCA9IDgwOworICAgICAgICBpZiAodGV4dENvbnRlbnQubGVuZ3RoKCkgPiBt YXhQcmludGVkTGVuZ3RoKSB7CisgICAgICAgICAgICBhdXRvIHN1YnN0cmluZyA9IHRleHRDb250 ZW50LnN1YnN0cmluZygwLCBtYXhQcmludGVkTGVuZ3RoKTsKKyAgICAgICAgICAgIHN0cmVhbSA8 PCAiIFwiIiA8PCBzdWJzdHJpbmcgPDwgIlwi4oCmIjsKKyAgICAgICAgfSBlbHNlCisgICAgICAg ICAgICBzdHJlYW0gPDwgIiBcIiIgPDwgdGV4dENvbnRlbnQgPDwgIlwiIjsKKyAgICB9CisgICAg CiAgICAgcmV0dXJuIHN0cmVhbS5yZWxlYXNlKCk7CiB9CiAK