249571 2022-12-18 23:13:56 -0800 ASSERTION FAILED: rangesIntersect(m_renderer->logicalTopForFloat(floatingObject), m_renderer->logicalBottomForFloat(floatingObject), m_lineTop, m_lineBottom) 2022-12-22 13:30:04 -0800 1 1 1 Unclassified WebKit Layout and Rendering WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=244594 https://bugs.webkit.org/show_bug.cgi?id=244591 https://bugs.webkit.org/show_bug.cgi?id=125831 InRadar P2 Normal --- 1 fujii fujii bfulgham changseok darin esprehn+autocc ews-watchlist glenn hodovan kondapallykalyan pdr simon.fraser webkit-bug-importer zalan zzzssspro0202 oldest_to_newest 1920421 0 fujii 2022-12-18 23:13:56 -0800 ASSERTION FAILED: rangesIntersect(m_renderer->logicalTopForFloat(floatingObject), m_renderer->logicalBottomForFloat(floatingObject), m_lineTop, m_lineBottom) WinCairo WK2 Debug reports an assertion failure for fast/css/intruding-floats-crash.html. > python.exe ./Tools/Scripts/run-webkit-tests --wincairo --debug --no-retry-failures fast/css/intruding-floats-crash.html --iterations=100 -f C:\home\webkit\gc\Source\WebKit\NetworkProcess/Classifier/ResourceLoadStatisticsDatabaseStore.cpp(318) : WebKit::ResourceLoadStatisticsDatabaseStore::ResourceLoadStatisticsDatabaseStore ASSERTION FAILED: rangesIntersect(m_renderer->logicalTopForFloat(floatingObject), m_renderer->logicalBottomForFloat(floatingObject), m_lineTop, m_lineBottom) C:\home\webkit\gc\Source\WebCore\rendering/FloatingObjects.cpp(484) : WebCore::ComputeFloatOffsetAdapter<2>::collectIfNeeded 1 00007FFB56DA248B WTFCrash 2 00007FFAFADDDA5E WTFCrashWithInfo 3 00007FFAFEBAD9DA WebCore::ComputeFloatOffsetAdapter<2>::collectIfNeeded 4 00007FFAFEBA6D44 WebCore::PODIntervalTree<WebCore::LayoutUnit,WebCore::FloatingObject *>::searchForOverlapsFrom<WebCore::ComputeFloatOffsetForLineLayoutAdapter<2> > 5 00007FFAFEB9FE4B WebCore::PODIntervalTree<WebCore::LayoutUnit,WebCore::FloatingObject *>::allOverlapsWithAdapter<WebCore::ComputeFloatOffsetForLineLayoutAdapter<2> > 6 00007FFAFEB7EAAC WebCore::FloatingObjects::logicalRightOffset 7 00007FFAFEC6188E WebCore::RenderBlockFlow::logicalRightFloatOffsetForLine 8 00007FFAFECCFEED WebCore::RenderBlock::logicalRightOffsetForLine 9 00007FFAFECCFF80 WebCore::RenderBlock::logicalRightOffsetForLine 10 00007FFAFEC430B6 WebCore::RenderBlock::logicalRightSelectionOffset 11 00007FFAFEC4031B WebCore::RenderBlock::logicalLeftSelectionGap 12 00007FFAFEC751CA `WebCore::RenderBlockFlow::inlineSelectionGaps'::`2'::<lambda_2>::operator() 13 00007FFAFEC646CB WebCore::RenderBlockFlow::inlineSelectionGaps 14 00007FFAFEC4F2CD WebCore::RenderBlock::selectionGaps 15 00007FFAFEC4016E WebCore::RenderBlock::selectionGapRectsForRepaint 16 00007FFAFEEAB12A WebCore::RenderBlockSelectionInfo::RenderBlockSelectionInfo 17 00007FFAFEF2CA84 std::make_unique<WebCore::RenderBlockSelectionInfo,WebCore::RenderBlock &,0> 18 00007FFAFEF2C2E6 WTF::makeUnique<WebCore::RenderBlockSelectionInfo,WebCore::RenderBlock &> 19 00007FFAFEEF58A6 WebCore::SelectionRangeData::apply 20 00007FFAFEEF437F WebCore::SelectionRangeData::set 21 00007FFAFDAE8BF7 WebCore::FrameSelection::updateAppearance 22 00007FFAFDAEA9D4 WebCore::FrameSelection::updateAndRevealSelection 23 00007FFAFDAF0748 WebCore::FrameSelection::updateAppearanceAfterLayoutOrStyleChange 24 00007FFAFDAE4107 WebCore::FrameSelection::updateAppearanceAfterLayout 25 00007FFAFE56DBC7 WebCore::FrameView::performPostLayoutTasks 26 00007FFAFE5F15F1 WebCore::FrameViewLayoutContext::runAsynchronousTasks 27 00007FFAFE5F16E4 WebCore::FrameViewLayoutContext::runOrScheduleAsynchronousTasks 28 00007FFAFE5F11E4 WebCore::FrameViewLayoutContext::performLayout 29 00007FFAFE5EF6BF WebCore::FrameViewLayoutContext::layout 30 00007FFAFE559E66 WebCore::FrameView::updateContentsSize 31 00007FFAFE7D5D8A WebCore::ScrollView::updateScrollbars 1920425 1 fujii 2022-12-18 23:23:21 -0800 Similar problems has been reported. But, they are not reproduced for me. Bug 132725 – ASSERTION FAILED: rangesIntersect(m_renderer.logicalTopForFloat(floatingObject), m_renderer.logicalBottomForFloat(floatingObject), m_lineTop, m_lineBottom) Bug 164082 – ASSERTION FAILED: rangesIntersect(m_renderer.logicalTopForFloat(floatingObject), m_renderer.logicalBottomForFloat(floatingObject), m_belowLogicalHeight, m_aboveLogicalHeight) in WebCore::FindNextFloatLogicalBottomAdapter::collectIfNeeded Bug 164082 – ASSERTION FAILED: rangesIntersect(m_renderer.logicalTopForFloat(floatingObject), m_renderer.logicalBottomForFloat(floatingObject), m_belowLogicalHeight, m_aboveLogicalHeight) in WebCore::FindNextFloatLogicalBottomAdapter::collectIfNeeded Bug 212267 – [css-grid] imported/w3c/web-platform-tests/css/css-grid/alignment/grid-item-self-baseline-001.html asserts on Debug Bug 244591 – ASSERTION FAILED: rangesIntersect(m_renderer->logicalTopForFloat(floatingObject), m_renderer->logicalBottomForFloat(floatingObject), m_lineTop, m_lineBottom) Bug 244594 – ASSERTION FAILED: rangesIntersect(m_renderer->logicalTopForFloat(floatingObject), m_renderer->logicalBottomForFloat(floatingObject), m_belowLogicalHeight, LayoutUnit::max()) 1920426 2 fujii 2022-12-18 23:28:03 -0800 Mac WK1 Debug is also reporting the assertion failures. For example, Buildbot: builder Apple-Ventura-Debug-AppleSilicon-WK1-Tests build 572 https://build.webkit.org/#/builders/705/builds/572 ASSERTION FAILED: rangesIntersect(m_renderer->logicalTopForFloat(floatingObject), m_renderer->logicalBottomForFloat(floatingObject), m_lineTop, m_lineBottom) rendering/FloatingObjects.cpp(484) : void WebCore::ComputeFloatOffsetAdapter<WebCore::FloatingObject::FloatRight>::collectIfNeeded(const WebCore::ComputeFloatOffsetAdapter::IntervalType &) [FloatTypeValue = WebCore::FloatingObject::FloatRight] 1921307 3 464159 fujii 2022-12-21 21:56:37 -0800 Created attachment 464159 Patch 1921358 4 ews-feeder 2022-12-22 06:31:15 -0800 Committed 258241@main (c982868aec77): <https://commits.webkit.org/258241@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 464159. 1921359 5 webkit-bug-importer 2022-12-22 06:32:16 -0800 <rdar://problem/103636568> 1921475 6 fujii 2022-12-22 13:28:15 -0800 *** Bug 132725 has been marked as a duplicate of this bug. *** 1921478 7 fujii 2022-12-22 13:28:49 -0800 *** Bug 164082 has been marked as a duplicate of this bug. *** 1921481 8 fujii 2022-12-22 13:29:48 -0800 *** Bug 244591 has been marked as a duplicate of this bug. *** 1921483 9 fujii 2022-12-22 13:30:04 -0800 *** Bug 244594 has been marked as a duplicate of this bug. *** 464159 2022-12-21 21:56:37 -0800 2022-12-22 06:31:16 -0800 Patch bug-249571-20221222145636.patch text/plain 3692 fujii RnJvbSBjZmVkMDNkMGMxOWQ5MDY3NTBlYmYzYzExYTZiNjhmYzlhYzhjYjU1IE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiBGdWppaSBIaXJvbm9yaSA8SGlyb25vcmkuRnVqaWlAc29ueS5j b20+CkRhdGU6IFRodSwgMjIgRGVjIDIwMjIgMTQ6Mzg6MTAgKzA5MDAKU3ViamVjdDogW1BBVENI XSBBU1NFUlRJT04gRkFJTEVEOgogcmFuZ2VzSW50ZXJzZWN0KG1fcmVuZGVyZXItPmxvZ2ljYWxU b3BGb3JGbG9hdChmbG9hdGluZ09iamVjdCksCiBtX3JlbmRlcmVyLT5sb2dpY2FsQm90dG9tRm9y RmxvYXQoZmxvYXRpbmdPYmplY3QpLCBtX2xpbmVUb3AsIG1fbGluZUJvdHRvbSkKIGh0dHBzOi8v YnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yNDk1NzEKClJldmlld2VkIGJ5IE5PQk9E WSAoT09QUyEpLgoKbV9wbGFjZWRGbG9hdHNUcmVlIG9mIEZsb2F0aW5nT2JqZWN0cyBjbGFzcyBp cyBhIHJlZC1ibGFjayB0cmVlIHRoYXQKaXMgb3JkZXJpbmcgZmxvYXRpbmcgb2JqZWN0cyB3aXRo IHRoZWlyIGxvZ2ljYWwgdG9wIGFuZCBib3R0b20KaW50ZXJ2YWwuIEl0IHRydW5jYXRlcyBmcmFj dGlvbmFsIHBhcnQgd2hlbiBhZGRpbmcgYSBuZXcgaW50ZXJ2YWwgZHVlCnRvIGEgY2VydGFpbiBy ZWFzb24gKGJ1ZyMxMjU4MzEpLgoKSG93ZXZlciwgdHdvIGFzc2VydGlvbnMgaW4gdGhpcyBjbGFz cyBkaWRuJ3QgdGFrZSB0aGUgdHJ1bmNhdGlvbiBpbnRvCmFjY291bnQuIFRoZSBsb2dpY2FsIHRv cCBhbmQgYm90dG9tIGluIHRoZSBhc3NlcnRpb25zIHNob3VsZCBiZQp0cnVuY2F0ZWQuCgoqIFNv dXJjZS9XZWJDb3JlL3JlbmRlcmluZy9GbG9hdGluZ09iamVjdHMuY3BwOgooV2ViQ29yZTo6Rmlu ZE5leHRGbG9hdExvZ2ljYWxCb3R0b21BZGFwdGVyOjpjb2xsZWN0SWZOZWVkZWQpOgooV2ViQ29y ZTo6RmxvYXRpbmdPYmplY3RzOjppbnRlcnZhbEZvckZsb2F0aW5nT2JqZWN0KToKKFdlYkNvcmU6 OkNvbXB1dGVGbG9hdE9mZnNldEFkYXB0ZXI8RmxvYXRUeXBlVmFsdWU+Ojpjb2xsZWN0SWZOZWVk ZWQpOgotLS0KIFNvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9GbG9hdGluZ09iamVjdHMuY3BwIHwg MTAgKysrKysrLS0tLQogMSBmaWxlIGNoYW5nZWQsIDYgaW5zZXJ0aW9ucygrKSwgNCBkZWxldGlv bnMoLSkKCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvRmxvYXRpbmdPYmpl Y3RzLmNwcCBiL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9GbG9hdGluZ09iamVjdHMuY3BwCmlu ZGV4IGU1MmY0ZTNhM2IzZi4uOTcyMmUxODAzNTAyIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29y ZS9yZW5kZXJpbmcvRmxvYXRpbmdPYmplY3RzLmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9yZW5k ZXJpbmcvRmxvYXRpbmdPYmplY3RzLmNwcApAQCAtMjQwLDcgKzI0MCw4IEBAIGlubGluZSB2b2lk IEZpbmROZXh0RmxvYXRMb2dpY2FsQm90dG9tQWRhcHRlcjo6Y29sbGVjdElmTmVlZGVkKGNvbnN0 IEludGVydmFsVHlwCiAKICAgICAvLyBBbGwgdGhlIG9iamVjdHMgcmV0dXJuZWQgZnJvbSB0aGUg dHJlZSBzaG91bGQgYmUgYWxyZWFkeSBwbGFjZWQuCiAgICAgQVNTRVJUKGZsb2F0aW5nT2JqZWN0 LmlzUGxhY2VkKCkpOwotICAgIEFTU0VSVChyYW5nZXNJbnRlcnNlY3QobV9yZW5kZXJlci0+bG9n aWNhbFRvcEZvckZsb2F0KGZsb2F0aW5nT2JqZWN0KSwgbV9yZW5kZXJlci0+bG9naWNhbEJvdHRv bUZvckZsb2F0KGZsb2F0aW5nT2JqZWN0KSwgbV9iZWxvd0xvZ2ljYWxIZWlnaHQsIExheW91dFVu aXQ6Om1heCgpKSk7CisgICAgLy8gRklYTUU6IFJlbW92ZSBmbG9vcigpLiBTZWUgPGh0dHBzOi8v d2Via2l0Lm9yZy9iLzEyNTgzMT4uCisgICAgQVNTRVJUKHJhbmdlc0ludGVyc2VjdChtX3JlbmRl cmVyLT5sb2dpY2FsVG9wRm9yRmxvYXQoZmxvYXRpbmdPYmplY3QpLmZsb29yKCksIG1fcmVuZGVy ZXItPmxvZ2ljYWxCb3R0b21Gb3JGbG9hdChmbG9hdGluZ09iamVjdCkuZmxvb3IoKSwgbV9iZWxv d0xvZ2ljYWxIZWlnaHQsIExheW91dFVuaXQ6Om1heCgpKSk7CiAKICAgICBMYXlvdXRVbml0IGZs b2F0Qm90dG9tID0gbV9yZW5kZXJlci0+bG9naWNhbEJvdHRvbUZvckZsb2F0KGZsb2F0aW5nT2Jq ZWN0KTsKICAgICBpZiAobV9uZXh0TG9naWNhbEJvdHRvbSAmJiBtX25leHRMb2dpY2FsQm90dG9t LnZhbHVlKCkgPCBmbG9hdEJvdHRvbSkKQEAgLTMyOCw4ICszMjksOCBAQCB2b2lkIEZsb2F0aW5n T2JqZWN0czo6ZGVjcmVhc2VPYmplY3RzQ291bnQoRmxvYXRpbmdPYmplY3Q6OlR5cGUgdHlwZSkK IAogRmxvYXRpbmdPYmplY3RJbnRlcnZhbCBGbG9hdGluZ09iamVjdHM6OmludGVydmFsRm9yRmxv YXRpbmdPYmplY3QoRmxvYXRpbmdPYmplY3QqIGZsb2F0aW5nT2JqZWN0KQogewotICAgIC8vIEZJ WE1FIFRoZSBlbmRwb2ludHMgb2YgdGhlIGZsb2F0aW5nIG9iamVjdCBpbnRlcnZhbCBzaG91bGRu J3QgbmVlZCB0byBiZQotICAgIC8vIGZsb29yZWQuIFNlZSBodHRwOi8vd2tiLnVnLzEyNTgzMSBm b3IgbW9yZSBkZXRhaWxzLgorICAgIC8vIEZJWE1FOiBUaGUgZW5kcG9pbnRzIG9mIHRoZSBmbG9h dGluZyBvYmplY3QgaW50ZXJ2YWwgc2hvdWxkbid0IG5lZWQgdG8gYmUKKyAgICAvLyBmbG9vcmVk LiBTZWUgPGh0dHBzOi8vd2Via2l0Lm9yZy9iLzEyNTgzMT4gZm9yIG1vcmUgZGV0YWlscy4KICAg ICBpZiAobV9ob3Jpem9udGFsV3JpdGluZ01vZGUpCiAgICAgICAgIHJldHVybiBGbG9hdGluZ09i amVjdEludGVydmFsKGZsb2F0aW5nT2JqZWN0LT5mcmFtZVJlY3QoKS55KCkuZmxvb3IoKSwgZmxv YXRpbmdPYmplY3QtPmZyYW1lUmVjdCgpLm1heFkoKS5mbG9vcigpLCBmbG9hdGluZ09iamVjdCk7 CiAgICAgcmV0dXJuIEZsb2F0aW5nT2JqZWN0SW50ZXJ2YWwoZmxvYXRpbmdPYmplY3QtPmZyYW1l UmVjdCgpLngoKS5mbG9vcigpLCBmbG9hdGluZ09iamVjdC0+ZnJhbWVSZWN0KCkubWF4WCgpLmZs b29yKCksIGZsb2F0aW5nT2JqZWN0KTsKQEAgLTQ4MSw3ICs0ODIsOCBAQCBpbmxpbmUgdm9pZCBD b21wdXRlRmxvYXRPZmZzZXRBZGFwdGVyPEZsb2F0VHlwZVZhbHVlPjo6Y29sbGVjdElmTmVlZGVk KGNvbnN0IEludAogCiAgICAgLy8gQWxsIHRoZSBvYmplY3RzIHJldHVybmVkIGZyb20gdGhlIHRy ZWUgc2hvdWxkIGJlIGFscmVhZHkgcGxhY2VkLgogICAgIEFTU0VSVChmbG9hdGluZ09iamVjdC5p c1BsYWNlZCgpKTsKLSAgICBBU1NFUlQocmFuZ2VzSW50ZXJzZWN0KG1fcmVuZGVyZXItPmxvZ2lj YWxUb3BGb3JGbG9hdChmbG9hdGluZ09iamVjdCksIG1fcmVuZGVyZXItPmxvZ2ljYWxCb3R0b21G b3JGbG9hdChmbG9hdGluZ09iamVjdCksIG1fbGluZVRvcCwgbV9saW5lQm90dG9tKSk7CisgICAg Ly8gRklYTUU6IFJlbW92ZSBmbG9vcigpLiBTZWUgPGh0dHBzOi8vd2Via2l0Lm9yZy9iLzEyNTgz MT4uCisgICAgQVNTRVJUKHJhbmdlc0ludGVyc2VjdChtX3JlbmRlcmVyLT5sb2dpY2FsVG9wRm9y RmxvYXQoZmxvYXRpbmdPYmplY3QpLmZsb29yKCksIG1fcmVuZGVyZXItPmxvZ2ljYWxCb3R0b21G b3JGbG9hdChmbG9hdGluZ09iamVjdCkuZmxvb3IoKSwgbV9saW5lVG9wLCBtX2xpbmVCb3R0b20p KTsKIAogICAgIGJvb2wgZmxvYXRJc05ld0V4dHJlbWUgPSB1cGRhdGVPZmZzZXRJZk5lZWRlZChm bG9hdGluZ09iamVjdCk7CiAgICAgaWYgKGZsb2F0SXNOZXdFeHRyZW1lKQo=