229740 2021-08-31 14:42:45 -0700 REGRESSION(r281439)[GTK] fast/box-shadow/box-shadow-huge-area-crash.html is flaky fail / crash 2023-02-27 07:03:10 -0800 1 1 1 Unclassified WebKit WebKitGTK WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=228893 P2 Normal --- 1 clopez webkit-unassigned bugs-noreply cgarcia vitaly oldest_to_newest 1789100 0 clopez 2021-08-31 14:42:45 -0700 Since r281439 the test fast/box-shadow/box-shadow-huge-area-crash.html fails on GTK the 99% of the times and the other 1% it crashes. On WPE it passes fine. 1789102 1 clopez 2021-08-31 14:45:01 -0700 This is the diff for when it fails https://people.igalia.com/clopez/wkbug/229740/layout-test-results/results.html I don't have info for when it crashes. On the gtk-release bot it crashed 2 times since r281439 but no backtraces were generated. See https://build.webkit.org/#/builders/57/builds/3420 and https://build.webkit.org/#/builders/57/builds/3395 On the GTK debug bot it has not crashed so far and I have been unable to make it crash locally. 1789113 2 clopez 2021-08-31 14:59:54 -0700 Expectations updated on r281824 1789224 3 cgarcia 2021-08-31 23:34:48 -0700 (In reply to Carlos Alberto Lopez Perez from comment #0) > Since r281439 the test fast/box-shadow/box-shadow-huge-area-crash.html fails > on GTK the 99% of the times and the other 1% it crashes. > > On WPE it passes fine. This is weird, because the change in r281439 is the same for GTK and WPE ports... 1936148 4 vitaly 2023-02-23 06:16:35 -0800 OK, I think I figured this one out. The cause of this issue is `hb_position_t` aka `int32_t`. This type is used to represent advances and offset of a glyph in `hb_buffer`. Its format is 16.16, i.e. 16 bits for the integer part and 16 bits for the fractional precision part. See https://github.com/harfbuzz/harfbuzz/issues/2714 for details. But it is *singed* and the first bit is the sign bit. That means the maximum advance and offset value is 2^15 and not 2^16. This limits the maximum advance and offset value to `std::numeric_limits<short>::max()` i.e 32767. We use HarfBuzz to measure text size only when the complex text code path is taken. Until 259842@main WPE port used the simple code path when possible. This explains why the issue was reproducible only on GTK port. PR is coming :) 1936176 5 vitaly 2023-02-23 07:22:36 -0800 Pull request: https://github.com/WebKit/WebKit/pull/10583 1937003 6 ews-feeder 2023-02-27 07:03:02 -0800 Committed 260882@main (1516848f1a90): <https://commits.webkit.org/260882@main> Reviewed commits have been landed. Closing PR #10583 and removing active labels.