218205 2020-10-26 14:03:43 -0700 Assert in BoxTree::layoutBoxForRenderer() under RenderLayer::updateScrollCornerStyle() 2020-10-27 09:59:58 -0700 1 1 1 Unclassified WebKit Layout and Rendering Safari Technology Preview Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 simon.fraser webkit-unassigned ap bfulgham koivisto simon.fraser webkit-bug-importer zalan oldest_to_newest 1701610 0 simon.fraser 2020-10-26 14:03:43 -0700 fast/css-generated-content/text-before-table-col-crash.html can assert: 0 com.apple.JavaScriptCore 0x000000063e2de1ce WTFCrash + 14 1 com.apple.WebCore 0x0000000645a78eeb WTFCrashWithInfo(int, char const*, char const*, int) + 27 2 com.apple.WebCore 0x00000006490662f9 WebCore::LayoutIntegration::BoxTree::layoutBoxForRenderer(WebCore::RenderObject const&) + 217 3 com.apple.WebCore 0x000000064906613d WebCore::LayoutIntegration::BoxTree::updateStyle(WebCore::RenderBoxModelObject const&) + 45 4 com.apple.WebCore 0x000000064906a166 WebCore::LayoutIntegration::LineLayout::updateStyle(WebCore::RenderBoxModelObject const&) + 38 5 com.apple.WebCore 0x0000000649ae77d5 WebCore::RenderBox::styleDidChange(WebCore::StyleDifference, WebCore::RenderStyle const*) + 2661 6 com.apple.WebCore 0x0000000649ae6cae WebCore::RenderBlock::styleDidChange(WebCore::StyleDifference, WebCore::RenderStyle const*) + 62 7 com.apple.WebCore 0x0000000649d0c73d WebCore::RenderScrollbarPart::styleDidChange(WebCore::StyleDifference, WebCore::RenderStyle const*) + 45 8 com.apple.WebCore 0x0000000649b9bec1 WebCore::RenderElement::setStyle(WebCore::RenderStyle&&, WebCore::StyleDifference) + 609 9 com.apple.WebCore 0x0000000649c40517 WebCore::RenderLayer::updateScrollCornerStyle() + 487 10 com.apple.WebCore 0x0000000649c5356f WebCore::RenderLayer::styleChanged(WebCore::StyleDifference, WebCore::RenderStyle const*) + 1263 11 com.apple.WebCore 0x0000000649c82ca6 WebCore::RenderLayerModelObject::styleDidChange(WebCore::StyleDifference, WebCore::RenderStyle const*) + 710 12 com.apple.WebCore 0x0000000649ae6db7 WebCore::RenderBox::styleDidChange(WebCore::StyleDifference, WebCore::RenderStyle const*) + 71 13 com.apple.WebCore 0x0000000649ae6cae WebCore::RenderBlock::styleDidChange(WebCore::StyleDifference, WebCore::RenderStyle const*) + 62 14 com.apple.WebCore 0x0000000649b11103 WebCore::RenderBlockFlow::styleDidChange(WebCore::StyleDifference, WebCore::RenderStyle const*) + 51 15 com.apple.WebCore 0x0000000649b9bec1 WebCore::RenderElement::setStyle(WebCore::RenderStyle&&, WebCore::StyleDifference) + 609 16 com.apple.WebCore 0x0000000649f22953 WebCore::RenderTreeUpdater::updateRendererStyle(WebCore::RenderElement&, WebCore::RenderStyle&&, WebCore::StyleDifference) + 99 17 com.apple.WebCore 0x0000000649f21f76 WebCore::RenderTreeUpdater::updateElementRenderer(WebCore::Element&, WebCore::Style::ElementUpdate const&) + 998 18 com.apple.WebCore 0x0000000649f2141f WebCore::RenderTreeUpdater::updateRenderTree(WebCore::ContainerNode&) + 1087 19 com.apple.WebCore 0x0000000649f20cb3 WebCore::RenderTreeUpdater::commit(std::__1::unique_ptr<WebCore::Style::Update const, std::__1::default_delete<WebCore::Style::Update const> >) + 483 20 com.apple.WebCore 0x000000064857a8ad WebCore::Document::updateRenderTree(std::__1::unique_ptr<WebCore::Style::Update const, std::__1::default_delete<WebCore::Style::Update const> >) + 253 21 com.apple.WebCore 0x000000064857ae1d WebCore::Document::resolveStyle(WebCore::Document::ResolveStyleType) + 1213 22 com.apple.WebCore 0x000000064857b7bd WebCore::Document::updateStyleIfNeeded() + 509 23 com.apple.WebCore 0x000000064933e387 WebCore::FrameView::updateLayoutAndStyleIfNeededRecursive() + 183 24 com.apple.WebCore 0x00000006493b6e6e WebCore::Page::layoutIfNeeded() + 62 25 com.apple.WebCore 0x00000006493b75ac WebCore::Page::updateRendering() + 412 26 com.apple.WebKit 0x0000000629b43fa6 WebKit::WebPage::updateRendering() + 38 27 com.apple.WebKit 0x00000006286b86fb WebKit::RemoteLayerTreeDrawingArea::updateRendering() + 171 28 com.apple.WebKit 0x00000006286c24e7 decltype(*(std::__1::forward<WebKit::RemoteLayerTreeDrawingArea*&>(fp0)).*fp()) std::__1::__invoke<void (WebKit::RemoteLayerTreeDrawingArea::*&)(), WebKit::RemoteLayerTreeDrawingArea*&, void>(void (WebKit::RemoteLayerTreeDrawingArea::*&)(), WebKit::RemoteLayerTreeDrawingArea*&) + 119 29 com.apple.WebKit 0x00000006286c2460 std::__1::__bind_return<void (WebKit::RemoteLayerTreeDrawingArea::*)(), std::__1::tuple<WebKit::RemoteLayerTreeDrawingArea*>, std::__1::tuple<>, __is_valid_bind_return<void (WebKit::RemoteLayerTreeDrawingArea::*)(), std::__1::tuple<WebKit::RemoteLayerTreeDrawingArea*>, std::__1::tuple<> >::value>::type std::__1::__apply_functor<void (WebKit::RemoteLayerTreeDrawingArea::*)(), std::__1::tuple<WebKit::RemoteLayerTreeDrawingArea*>, 0ul, std::__1::tuple<> >(void (WebKit::RemoteLayerTreeDrawingArea::*&)(), std::__1::tuple<WebKit::RemoteLayerTreeDrawingArea*>&, std::__1::__tuple_indices<0ul>, std::__1::tuple<>&&) + 64 30 com.apple.WebKit 0x00000006286c2419 std::__1::__bind_return<void (WebKit::RemoteLayerTreeDrawingArea::*)(), std::__1::tuple<WebKit::RemoteLayerTreeDrawingArea*>, std::__1::tuple<>, __is_valid_bind_return<void (WebKit::RemoteLayerTreeDrawingArea::*)(), std::__1::tuple<WebKit::RemoteLayerTreeDrawingArea*>, std::__1::tuple<> >::value>::type std::__1::__bind<void (WebKit::RemoteLayerTreeDrawingArea::*&)(), WebKit::RemoteLayerTreeDrawingArea*>::operator()<>() + 41 31 com.apple.WebKit 0x00000006286c23be WTF::Detail::CallableWrapper<std::__1::__bind<void (WebKit::RemoteLayerTreeDrawingArea::*&)(), WebKit::RemoteLayerTreeDrawingArea*>, void>::call() + 30 32 com.apple.WebKit 0x00000006280ca5e2 WTF::Function<void ()>::operator()() const + 130 33 com.apple.WebKit 0x00000006286bdb0e WebCore::Timer::fired() + 30 34 com.apple.WebCore 0x0000000649599644 WebCore::ThreadTimers::sharedTimerFiredInternal() + 644 35 com.apple.WebCore 0x00000006495a0b31 WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0::operator()() const + 33 36 com.apple.WebCore 0x00000006495a0ade WTF::Detail::CallableWrapper<WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0, void>::call() + 30 37 com.apple.WebCore 0x0000000645a8ed42 WTF::Function<void ()>::operator()() const + 130 38 com.apple.WebCore 0x0000000649558c4b WebCore::MainThreadSharedTimer::fired() + 139 39 com.apple.WebCore 0x00000006495fe886 WebCore::timerFired(__CFRunLoopTimer*, void*) + 38 40 com.apple.CoreFoundation 0x00000006353be112 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 20 41 com.apple.CoreFoundation 0x00000006353bdbe5 __CFRunLoopDoTimer + 926 42 com.apple.CoreFoundation 0x00000006353bd198 __CFRunLoopDoTimers + 265 43 com.apple.CoreFoundation 0x00000006353b7826 __CFRunLoopRun + 1949 44 com.apple.CoreFoundation 0x00000006353b6b9e CFRunLoopRunSpecific + 567 45 com.apple.Foundation 0x000000010eb80e61 -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 209 46 com.apple.Foundation 0x000000010eb81075 -[NSRunLoop(NSRunLoop) run] + 76 47 libxpc.dylib 0x0000000636cdf506 _xpc_objc_main + 591 48 libxpc.dylib 0x0000000636ce14aa xpc_main + 143 49 com.apple.WebKit 0x0000000628b19175 WebKit::XPCServiceMain(int, char const**) + 1077 50 com.apple.WebKit 0x0000000629f115cb WKXPCServiceMain + 27 51 com.apple.WebKit.WebContent 0x000000010ea62d42 main + 34 52 libdyld.dylib 0x0000000636977415 start + 1 1701611 1 webkit-bug-importer 2020-10-26 14:04:02 -0700 <rdar://problem/70694256> 1701792 2 412399 koivisto 2020-10-27 01:07:10 -0700 Created attachment 412399 patch 1701857 3 ews-feeder 2020-10-27 06:56:34 -0700 Committed r269038: <https://trac.webkit.org/changeset/269038> All reviewed patches have been landed. Closing bug and clearing flags on attachment 412399. 1701889 4 412399 simon.fraser 2020-10-27 08:44:32 -0700 Comment on attachment 412399 patch View in context: https://bugs.webkit.org/attachment.cgi?id=412399&action=review > Source/WebCore/layout/integration/LayoutIntegrationLineLayout.cpp:75 > + if (renderer.isReplica() || renderer.isRenderScrollbarPart()) Maybe we need renderer.isBlah() that covers these two cases? 1701929 5 koivisto 2020-10-27 09:59:58 -0700 > Maybe we need renderer.isBlah() that covers these two cases? "Someone" should just refactor them to not be RenderObjects (or at least not have parent set). 412399 2020-10-27 01:07:10 -0700 2020-10-27 06:56:35 -0700 patch lfc-scroll-corner.patch text/plain 1637 koivisto ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZyBiL1NvdXJjZS9XZWJDb3JlL0No YW5nZUxvZwppbmRleCBiMjYxMDI5MDJmY2UuLjU3NTNiNmUyMTFhNCAxMDA2NDQKLS0tIGEvU291 cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAt MSwzICsxLDE3IEBACisyMDIwLTEwLTI3ICBBbnR0aSBLb2l2aXN0byAgPGFudHRpQGFwcGxlLmNv bT4KKworICAgICAgICBBc3NlcnQgaW4gQm94VHJlZTo6bGF5b3V0Qm94Rm9yUmVuZGVyZXIoKSB1 bmRlciBSZW5kZXJMYXllcjo6dXBkYXRlU2Nyb2xsQ29ybmVyU3R5bGUoKQorICAgICAgICBodHRw czovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjE4MjA1CisgICAgICAgIDxyZGFy Oi8vcHJvYmxlbS83MDY5NDI1Nj4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMh KS4KKworICAgICAgICAqIGxheW91dC9pbnRlZ3JhdGlvbi9MYXlvdXRJbnRlZ3JhdGlvbkxpbmVM YXlvdXQuY3BwOgorICAgICAgICAoV2ViQ29yZTo6TGF5b3V0SW50ZWdyYXRpb246OkxpbmVMYXlv dXQ6OmNvbnRhaW5pbmcpOgorCisgICAgICAgIFNpbWlsYXIgdG8gUmVuZGVyUmVwbGljYSwgUmVu ZGVyU2Nyb2xsYmFyUGFydCBpcyBhIGZha2UgcmVuZGVyZXIgdGhhdCBpcyBub3QgaW4gdGhlIHRy ZWUgZXZlbgorICAgICAgICB0aG91Z2ggaXQgaGFzIHRoZSBwYXJlbnQgcG9pbnRlciBzZXQuCisK IDIwMjAtMTAtMjYgIFNhaWQgQWJvdS1IYWxsYXdhICA8c2Fib3VoYWxsYXdhQGFwcGxlLmNvbT4K IAogICAgICAgICBbR1BVIFByb2Nlc3NdOiBJbnRyb2R1Y2UgUmVtb3RlUmVzb3VyY2VDYWNoZVBy b3h5IHRvIG1hbmFnZSB0aGUgcmVtb3RlIHJlc291cmNlcyBpbiBXZWIgUHJvY2VzcwpkaWZmIC0t Z2l0IGEvU291cmNlL1dlYkNvcmUvbGF5b3V0L2ludGVncmF0aW9uL0xheW91dEludGVncmF0aW9u TGluZUxheW91dC5jcHAgYi9Tb3VyY2UvV2ViQ29yZS9sYXlvdXQvaW50ZWdyYXRpb24vTGF5b3V0 SW50ZWdyYXRpb25MaW5lTGF5b3V0LmNwcAppbmRleCBkMTdjNjg1M2UxZjkuLjVkZTlkYTI0ZTU1 YyAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvbGF5b3V0L2ludGVncmF0aW9uL0xheW91dElu dGVncmF0aW9uTGluZUxheW91dC5jcHAKKysrIGIvU291cmNlL1dlYkNvcmUvbGF5b3V0L2ludGVn cmF0aW9uL0xheW91dEludGVncmF0aW9uTGluZUxheW91dC5jcHAKQEAgLTcxLDcgKzcxLDggQEAg TGluZUxheW91dCogTGluZUxheW91dDo6Y29udGFpbmluZyhSZW5kZXJPYmplY3QmIHJlbmRlcmVy KQogICAgIGlmICghcmVuZGVyZXIuaXNJbmxpbmUoKSkKICAgICAgICAgcmV0dXJuIG51bGxwdHI7 CiAKLSAgICBpZiAocmVuZGVyZXIuaXNSZXBsaWNhKCkpCisgICAgLy8gRklYTUU6IFRoZXNlIGZh a2UgcmVuZGVyZXJzIGhhdmUgdGhlaXIgcGFyZW50IHNldCBidXQgYXJlIG5vdCBhY3R1YWxseSBp biB0aGUgdHJlZS4KKyAgICBpZiAocmVuZGVyZXIuaXNSZXBsaWNhKCkgfHwgcmVuZGVyZXIuaXNS ZW5kZXJTY3JvbGxiYXJQYXJ0KCkpCiAgICAgICAgIHJldHVybiBudWxscHRyOwogICAgIAogICAg IGlmIChhdXRvKiBwYXJlbnQgPSByZW5kZXJlci5wYXJlbnQoKSkgewo=