226367 2021-05-27 22:00:29 -0700 Release assert in RenderFlexibleBox::computeInnerFlexBaseSizeForChild via RenderFlexibleBox::layoutFlexItems 2021-06-08 16:57:30 -0700 1 1 1 Unclassified WebKit Layout and Rendering WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=226790 InRadar P2 Normal --- 1 rniwa rbuis bfulgham cgarcia darin ews-feeder fred.wang gpoo koivisto product-security rbuis simon.fraser svillar webkit-bug-importer zalan oldest_to_newest 1764667 0 rniwa 2021-05-27 22:00:29 -0700 Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 1 com.apple.WebCore 0x0000000201ae3e5e std::__1::__throw_bad_optional_access() + 14 (optional:193) 2 com.apple.WebCore 0x00000002071ad053 std::__1::optional<WebCore::LayoutUnit>::value() && + 51 (optional:965) 3 com.apple.WebCore 0x000000020736faad WebCore::RenderFlexibleBox::computeInnerFlexBaseSizeForChild(WebCore::RenderBox&, WebCore::LayoutUnit) + 429 (RenderFlexibleBox.cpp:953) 4 com.apple.WebCore 0x00000002073709a5 WebCore::RenderFlexibleBox::constructFlexItem(WebCore::RenderBox&, bool) + 613 (RenderFlexibleBox.cpp:1340) 5 com.apple.WebCore 0x000000020736769d WebCore::RenderFlexibleBox::layoutFlexItems(bool) + 685 (RenderFlexibleBox.cpp:995) 6 com.apple.WebCore 0x0000000207366aa7 WebCore::RenderFlexibleBox::layoutBlock(bool, WebCore::LayoutUnit) + 999 (RenderFlexibleBox.cpp:307) 7 com.apple.WebCore 0x000000020721ef8a WebCore::RenderBlock::layout() + 282 (RenderBlock.cpp:598) 8 com.apple.WebCore 0x00000002072555e5 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) + 1461 (RenderBlockFlow.cpp:764) 9 com.apple.WebCore 0x000000020725200e WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) + 718 (RenderBlockFlow.cpp:675) 10 com.apple.WebCore 0x0000000207250188 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) + 1240 (RenderBlockFlow.cpp:527) 11 com.apple.WebCore 0x000000020721ef8a WebCore::RenderBlock::layout() + 282 (RenderBlock.cpp:598) 12 com.apple.WebCore 0x00000002075d5547 WebCore::RenderView::layout() + 1479 (RenderView.cpp:185) 13 com.apple.WebCore 0x00000002066c77bf WebCore::FrameViewLayoutContext::layout() + 1359 (FrameViewLayoutContext.cpp:233) 14 com.apple.WebCore 0x000000020549fc28 WebCore::Document::implicitClose() + 1064 (Document.cpp:3187) 15 com.apple.WebCore 0x0000000206429bb9 WebCore::FrameLoader::checkCallImplicitClose() + 217 (FrameLoader.cpp:940) 16 com.apple.WebCore 0x0000000206429043 WebCore::FrameLoader::checkCompleted() + 691 (FrameLoader.cpp:881) 17 com.apple.WebCore 0x0000000206425615 WebCore::FrameLoader::finishedParsing() + 453 (FrameLoader.cpp:786) 18 com.apple.WebCore 0x00000002054c0894 WebCore::Document::finishedParsing() + 612 (Document.cpp:6060) 19 com.apple.WebCore 0x0000000205e55075 WebCore::HTMLConstructionSite::finishedParsing() + 37 (HTMLConstructionSite.cpp:419) 20 com.apple.WebCore 0x0000000205eb4d0e WebCore::HTMLTreeBuilder::finished() + 30 (HTMLTreeBuilder.cpp:2843) 21 com.apple.WebCore 0x0000000205e654e8 WebCore::HTMLDocumentParser::end() + 24 (HTMLDocumentParser.cpp:449) 22 com.apple.WebCore 0x0000000205e62da9 WebCore::HTMLDocumentParser::attemptToRunDeferredScriptsAndEnd() + 57 (HTMLDocumentParser.cpp:458) 23 com.apple.WebCore 0x0000000205e62cc1 WebCore::HTMLDocumentParser::prepareToStopParsing() + 273 (HTMLDocumentParser.cpp:152) 24 com.apple.WebCore 0x0000000205e65530 WebCore::HTMLDocumentParser::attemptToEnd() + 64 (HTMLDocumentParser.cpp:470) 25 com.apple.WebCore 0x0000000205e655ca WebCore::HTMLDocumentParser::finish() + 42 (HTMLDocumentParser.cpp:498) 26 com.apple.WebCore 0x00000002063aaad1 WebCore::DocumentWriter::end() + 417 (DocumentWriter.cpp:294) 27 com.apple.WebCore 0x00000002063a9633 WebCore::DocumentLoader::finishedLoading() + 739 (DocumentLoader.cpp:489) 28 com.apple.WebCore 0x00000002063a8e4e WebCore::DocumentLoader::notifyFinished(WebCore::CachedResource&, WebCore::NetworkLoadMetrics const&) + 1262 (DocumentLoader.cpp:433) 29 com.apple.WebCore 0x0000000206589060 WebCore::CachedResource::checkNotify(WebCore::NetworkLoadMetrics const&) + 384 (CachedResource.cpp:336) 30 com.apple.WebCore 0x00000002065835cf WebCore::CachedResource::finishLoading(WebCore::SharedBuffer*, WebCore::NetworkLoadMetrics const&) + 79 (CachedResource.cpp:352) <rdar://78570689> 1764676 1 rbuis 2021-05-27 22:22:30 -0700 Needs a testcase :) 1764680 2 429987 rniwa 2021-05-27 22:39:06 -0700 Created attachment 429987 Test 1764683 3 rniwa 2021-05-27 22:42:08 -0700 (In reply to Rob Buis from comment #1) > Needs a testcase :) Oops, added. 1764694 4 rbuis 2021-05-27 23:11:30 -0700 This seems related to width: intrinsic usage, will have a look. 1764706 5 rniwa 2021-05-28 00:44:44 -0700 (In reply to Rob Buis from comment #4) > This seems related to width: intrinsic usage, will have a look. Huh, is that feature enabled on trunk? 1764707 6 rbuis 2021-05-28 00:47:16 -0700 (In reply to Ryosuke Niwa from comment #5) > (In reply to Rob Buis from comment #4) > > This seems related to width: intrinsic usage, will have a look. > > Huh, is that feature enabled on trunk? I know very little about this keyword. So far I found it is listed as kind of an alias for max-content here: https://developer.mozilla.org/en-US/docs/Web/CSS/width However replacing intrinsic with max-content does not make the test crash, so it is not a pure alias. 1764718 7 429998 rbuis 2021-05-28 03:21:20 -0700 Created attachment 429998 Patch 1764737 8 430004 rbuis 2021-05-28 05:28:26 -0700 Created attachment 430004 Patch 1765362 9 ews-feeder 2021-05-31 02:22:20 -0700 Committed r278275 (238312@main): <https://commits.webkit.org/238312@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 430004. 1765384 10 430004 svillar 2021-05-31 04:27:21 -0700 Comment on attachment 430004 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=430004&action=review > Source/WebCore/rendering/RenderFlexibleBox.cpp:878 > + if (isColumnFlow() && (flexBasis.isIntrinsic() || flexBasis.type() == LengthType::Intrinsic)) Does the attached test case crash with LenghtType::MinIntrinsic. If so can we replaced this second part with flexBasis.isLegacyIntrinsic() ? 429987 2021-05-27 22:39:06 -0700 2021-05-27 22:39:06 -0700 Test repro_655.html text/html 131 rniwa PHN0eWxlPgogIGh0bWwsIGJvZHkgewogICAgZmxleC1mbG93OiBjb2x1bW47CiAgICB3aWR0aDog aW50cmluc2ljOwogICAgd3JpdGluZy1tb2RlOiB2ZXJ0aWNhbC1ybDsKICAgIGRpc3BsYXk6IGZs ZXg7CiAgfQo8L3N0eWxlPgo= 429998 2021-05-28 03:21:20 -0700 2021-05-28 05:28:22 -0700 Patch bug-226367-20210528122119.patch text/plain 1539 rbuis U3VidmVyc2lvbiBSZXZpc2lvbjogMjc4MTU4CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggYTM5ODA0MzRmOWQzOTIw YTI4Y2ZiMmJkYmFkNWMzZjkyOTI2NDQ2MS4uNjg3NTQzYThlODhhNmZjMWQ1ZDAyM2ExMzIwZjcx ZTAzMWE3MWI5YSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE1IEBACisyMDIxLTA1LTI4ICBSb2Ig QnVpcyAgPHJidWlzQGlnYWxpYS5jb20+CisKKyAgICAgICAgUmVsZWFzZSBhc3NlcnQgaW4gUmVu ZGVyRmxleGlibGVCb3g6OmNvbXB1dGVJbm5lckZsZXhCYXNlU2l6ZUZvckNoaWxkIHZpYSBSZW5k ZXJGbGV4aWJsZUJveDo6bGF5b3V0RmxleEl0ZW1zCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJr aXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yMjYzNjcKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JP RFkgKE9PUFMhKS4KKworICAgICAgICBXSVAuCisKKyAgICAgICAgKiByZW5kZXJpbmcvUmVuZGVy RmxleGlibGVCb3guY3BwOgorICAgICAgICAoV2ViQ29yZTo6UmVuZGVyRmxleGlibGVCb3g6OmNo aWxkTWFpblNpemVJc0RlZmluaXRlKToKKwogMjAyMS0wNS0yNyAgWW91ZW5uIEZhYmxldCAgPHlv dWVubkBhcHBsZS5jb20+CiAKICAgICAgICAgU3VwcG9ydCBIMjY0IHByb2ZpbGVzIGluIE1lZGlh UmVjb3JkZXIKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJGbGV4 aWJsZUJveC5jcHAgYi9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyRmxleGlibGVCb3gu Y3BwCmluZGV4IGU5MGRjMWE4YWQyYzEyNDA4ZDgwMjY0ZmZkMTdiY2E5MGQyYTkyMzkuLjY4ZWM5 YmE5ZDA2MmI5ZDc2NjZjODEzZjEyZTFiODE4YTA1OTkxYzMgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9X ZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJGbGV4aWJsZUJveC5jcHAKKysrIGIvU291cmNlL1dlYkNv cmUvcmVuZGVyaW5nL1JlbmRlckZsZXhpYmxlQm94LmNwcApAQCAtODc1LDcgKzg3NSw3IEBAIGJv b2wgUmVuZGVyRmxleGlibGVCb3g6OmNoaWxkTWFpblNpemVJc0RlZmluaXRlKGNvbnN0IFJlbmRl ckJveCYgY2hpbGQsIGNvbnN0IExlCiB7CiAgICAgaWYgKGZsZXhCYXNpcy5pc0F1dG8oKSkKICAg ICAgICAgcmV0dXJuIGZhbHNlOwotICAgIGlmIChpc0NvbHVtbkZsb3coKSAmJiBmbGV4QmFzaXMu aXNJbnRyaW5zaWMoKSkKKyAgICBpZiAoaXNDb2x1bW5GbG93KCkgJiYgKGZsZXhCYXNpcy5pc0lu dHJpbnNpYygpIHx8IGZsZXhCYXNpcy50eXBlKCkgPT0gTGVuZ3RoVHlwZTo6SW50cmluc2ljKSkK ICAgICAgICAgcmV0dXJuIGZhbHNlOwogICAgIGlmIChmbGV4QmFzaXMuaXNQZXJjZW50T3JDYWxj dWxhdGVkKCkpCiAgICAgICAgIHJldHVybiBjYW5Db21wdXRlUGVyY2VudGFnZUZsZXhCYXNpcyhj aGlsZCwgZmxleEJhc2lzLCBVcGRhdGVQZXJjZW50YWdlSGVpZ2h0RGVzY2VuZGFudHM6Ok5vKTsK 430004 2021-05-28 05:28:26 -0700 2021-05-31 02:22:22 -0700 Patch bug-226367-20210528142822.patch text/plain 3357 rbuis U3VidmVyc2lvbiBSZXZpc2lvbjogMjc4MTkzCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggOGE0YzBiNzA2YjU3ZjIw M2NkY2QzZTMyYjU4ZjE2ZDQ0YjNhZTM3Ni4uZGQ4ZmVkNmJmODFhNjI5ZDc0NGRjOTc2YWU3MzE5 NWFjNDBjZDI2ZiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE4IEBACisyMDIxLTA1LTI4ICBSb2Ig QnVpcyAgPHJidWlzQGlnYWxpYS5jb20+CisKKyAgICAgICAgVHJlYXQgd2lkdGg6IGludHJpbnNp YyBhcyBub24gZGVmaW5pdGUKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19i dWcuY2dpP2lkPTIyNjM2NworCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgor CisgICAgICAgIFRyZWF0IHdpZHRoOiBpbnRyaW5zaWMgYXMgbm9uIGRlZmluaXRlIGluCisgICAg ICAgIGNoaWxkTWFpblNpemVJc0RlZmluaXRlLgorCisgICAgICAgIFRlc3Q6IGZhc3QvY3NzL2Zs ZXgtYm94LWludHJpbnNpYy13aWR0aC1jcmFzaC5odG1sCisKKyAgICAgICAgKiByZW5kZXJpbmcv UmVuZGVyRmxleGlibGVCb3guY3BwOgorICAgICAgICAoV2ViQ29yZTo6UmVuZGVyRmxleGlibGVC b3g6OmNoaWxkTWFpblNpemVJc0RlZmluaXRlKToKKwogMjAyMS0wNS0yOCAgTWFydGluIFJvYmlu c29uICA8bXJvYmluc29uQHdlYmtpdC5vcmc+CiAKICAgICAgICAgTW9yZSByZWFkaWx5IGxheW91 dCB3aGVuIHNjcm9sbC1zbmFwIHByb3BlcnRpZXMgY2hhbmdlCmRpZmYgLS1naXQgYS9Tb3VyY2Uv V2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyRmxleGlibGVCb3guY3BwIGIvU291cmNlL1dlYkNvcmUv cmVuZGVyaW5nL1JlbmRlckZsZXhpYmxlQm94LmNwcAppbmRleCA2NzdjNDc4MjY3NGYxZmRlMmZk MzQ4ZjE1ZDNiNzhhYzI1Y2Q5ZDg0Li43YzhkODk4OGFhNmRhYjBlYmZmNGI0NjZiNzgxZjc2M2Jj ZWViZTI0IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyRmxleGli bGVCb3guY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJGbGV4aWJsZUJv eC5jcHAKQEAgLTg3NSw3ICs4NzUsNyBAQCBib29sIFJlbmRlckZsZXhpYmxlQm94OjpjaGlsZE1h aW5TaXplSXNEZWZpbml0ZShjb25zdCBSZW5kZXJCb3gmIGNoaWxkLCBjb25zdCBMZQogewogICAg IGlmIChmbGV4QmFzaXMuaXNBdXRvKCkpCiAgICAgICAgIHJldHVybiBmYWxzZTsKLSAgICBpZiAo aXNDb2x1bW5GbG93KCkgJiYgZmxleEJhc2lzLmlzSW50cmluc2ljKCkpCisgICAgaWYgKGlzQ29s dW1uRmxvdygpICYmIChmbGV4QmFzaXMuaXNJbnRyaW5zaWMoKSB8fCBmbGV4QmFzaXMudHlwZSgp ID09IExlbmd0aFR5cGU6OkludHJpbnNpYykpCiAgICAgICAgIHJldHVybiBmYWxzZTsKICAgICBp ZiAoZmxleEJhc2lzLmlzUGVyY2VudE9yQ2FsY3VsYXRlZCgpKQogICAgICAgICByZXR1cm4gY2Fu Q29tcHV0ZVBlcmNlbnRhZ2VGbGV4QmFzaXMoY2hpbGQsIGZsZXhCYXNpcywgVXBkYXRlUGVyY2Vu dGFnZUhlaWdodERlc2NlbmRhbnRzOjpObyk7CmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9DaGFu Z2VMb2cgYi9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKaW5kZXggYzE2ZWRkZjQ0YjY4MTVjNGIwNGJm ZmY4MjBhMTkyNDJiMzUyZjEyMi4uYWJhZTI2ZWFmOWIxNGY0MWZkOTViOTAzZTZkMjNjZDMxODcy M2EyOSAxMDA2NDQKLS0tIGEvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCisrKyBiL0xheW91dFRlc3Rz L0NoYW5nZUxvZwpAQCAtMSwzICsxLDE1IEBACisyMDIxLTA1LTI4ICBSb2IgQnVpcyAgPHJidWlz QGlnYWxpYS5jb20+CisKKyAgICAgICAgUmVsZWFzZSBhc3NlcnQgaW4gUmVuZGVyRmxleGlibGVC b3g6OmNvbXB1dGVJbm5lckZsZXhCYXNlU2l6ZUZvckNoaWxkIHZpYSBSZW5kZXJGbGV4aWJsZUJv eDo6bGF5b3V0RmxleEl0ZW1zCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3df YnVnLmNnaT9pZD0yMjYzNjcKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4K KworICAgICAgICBBZGQgdGVzdCBmb3IgdGhpcy4KKworICAgICAgICAqIGZhc3QvY3NzL2ZsZXgt Ym94LWludHJpbnNpYy13aWR0aC1jcmFzaC1leHBlY3RlZC50eHQ6IEFkZGVkLgorICAgICAgICAq IGZhc3QvY3NzL2ZsZXgtYm94LWludHJpbnNpYy13aWR0aC1jcmFzaC5odG1sOiBBZGRlZC4KKwog MjAyMS0wNS0yOCAgTWFydGluIFJvYmluc29uICA8bXJvYmluc29uQHdlYmtpdC5vcmc+CiAKICAg ICAgICAgTW9yZSByZWFkaWx5IGxheW91dCB3aGVuIHNjcm9sbC1zbmFwIHByb3BlcnRpZXMgY2hh bmdlCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9mYXN0L2Nzcy9mbGV4LWJveC1pbnRyaW5zaWMt d2lkdGgtY3Jhc2gtZXhwZWN0ZWQudHh0IGIvTGF5b3V0VGVzdHMvZmFzdC9jc3MvZmxleC1ib3gt aW50cmluc2ljLXdpZHRoLWNyYXNoLWV4cGVjdGVkLnR4dApuZXcgZmlsZSBtb2RlIDEwMDY0NApp bmRleCAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwLi5iZmE1OTM2ZmQw MGNlZGFlNjNjMTQyMzAzZmVhODE1ZTQ0NDIzNzJlCi0tLSAvZGV2L251bGwKKysrIGIvTGF5b3V0 VGVzdHMvZmFzdC9jc3MvZmxleC1ib3gtaW50cmluc2ljLXdpZHRoLWNyYXNoLWV4cGVjdGVkLnR4 dApAQCAtMCwwICsxIEBACitQYXNzZXMgaWYgaXQgZG9lc24ndCBjcmFzaCEKZGlmZiAtLWdpdCBh L0xheW91dFRlc3RzL2Zhc3QvY3NzL2ZsZXgtYm94LWludHJpbnNpYy13aWR0aC1jcmFzaC5odG1s IGIvTGF5b3V0VGVzdHMvZmFzdC9jc3MvZmxleC1ib3gtaW50cmluc2ljLXdpZHRoLWNyYXNoLmh0 bWwKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMC4uM2RjYmUzZGI0ZDM0NWYwMWE1ZmVhOWJkZDg0YjhkNmE0YzRjMGUzMQot LS0gL2Rldi9udWxsCisrKyBiL0xheW91dFRlc3RzL2Zhc3QvY3NzL2ZsZXgtYm94LWludHJpbnNp Yy13aWR0aC1jcmFzaC5odG1sCkBAIC0wLDAgKzEsMTMgQEAKKzxzY3JpcHQ+CitpZiAod2luZG93 LnRlc3RSdW5uZXIpCisgICAgdGVzdFJ1bm5lci5kdW1wQXNUZXh0KCk7Cis8L3NjcmlwdD4KKzxz dHlsZT4KKyAgaHRtbCwgYm9keSB7CisgICAgZmxleC1mbG93OiBjb2x1bW47CisgICAgd2lkdGg6 IGludHJpbnNpYzsKKyAgICB3cml0aW5nLW1vZGU6IHZlcnRpY2FsLXJsOworICAgIGRpc3BsYXk6 IGZsZXg7CisgIH0KKzwvc3R5bGU+CitQYXNzZXMgaWYgaXQgZG9lc24ndCBjcmFzaCEK