253182 2023-03-01 11:49:05 -0800 Release crash + ASSERTION FAILED: !nextSibling() in WebCore::RenderBox *WebCore::RenderBox::nextSiblingBox() const 2023-12-20 15:01:56 -0800 1 1 1 Unclassified WebKit Layout and Rendering WebKit Nightly Build Unspecified Unspecified RESOLVED DUPLICATE 253165 InRadar P2 Normal --- 1 sgill26 sgill26 bfulgham mmaxfield simon.fraser webkit-bug-importer wenson_hsieh zalan oldest_to_newest 1937871 0 465249 sgill26 2023-03-01 11:49:05 -0800 Created attachment 465249 Testcase The assertion gets triggered with the attached test case. The next sibling is a RenderText so nextSiblingBox returns nullptr 1937916 1 webkit-bug-importer 2023-03-01 14:05:48 -0800 <rdar://problem/106105433> 1938958 2 ap 2023-03-05 12:02:51 -0800 This isn't just an assertion failure, but a 100% reproducible crash in production builds. Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 WebCore 0x1bed1fecc WebCore::RenderBlock::computeBlockPreferredLogicalWidths(WebCore::LayoutUnit&, WebCore::LayoutUnit&) const + 512 1 WebCore 0x1bed2035c WebCore::RenderBlock::computeBlockPreferredLogicalWidths(WebCore::LayoutUnit&, WebCore::LayoutUnit&) const + 1680 2 WebCore 0x1c0bc4bdc WebCore::RenderBlockFlow::computeIntrinsicLogicalWidths(WebCore::LayoutUnit&, WebCore::LayoutUnit&) const + 796 3 WebCore 0x1becf0534 WebCore::RenderBlock::computePreferredLogicalWidths() + 452 4 WebCore 0x1becccb74 WebCore::RenderBox::minPreferredLogicalWidth() const + 76 5 WebCore 0x1c0bbcfac WebCore::RenderBlock::computeChildIntrinsicLogicalWidths(WebCore::RenderObject&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) const + 80 6 WebCore 0x1c0bbcd38 WebCore::RenderBlock::computeChildPreferredLogicalWidths(WebCore::RenderObject&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) const + 128 7 WebCore 0x1bed20298 WebCore::RenderBlock::computeBlockPreferredLogicalWidths(WebCore::LayoutUnit&, WebCore::LayoutUnit&) const + 1484 8 WebCore 0x1c0bc4bdc WebCore::RenderBlockFlow::computeIntrinsicLogicalWidths(WebCore::LayoutUnit&, WebCore::LayoutUnit&) const + 796 9 WebCore 0x1becf0534 WebCore::RenderBlock::computePreferredLogicalWidths() + 452 10 WebCore 0x1becccb74 WebCore::RenderBox::minPreferredLogicalWidth() const + 76 11 WebCore 0x1c0bea950 WebCore::RenderBox::computeLogicalWidthInFragmentUsing(WebCore::SizeType, WebCore::Length, WebCore::LayoutUnit, WebCore::RenderBlock const&, WebCore::RenderFragmentContainer*) const + 596 12 WebCore 0x1c0bf5624 WebCore::RenderBox::computeLogicalWidthInFragment(WebCore::RenderBox::LogicalExtentComputedValues&, WebCore::RenderFragmentContainer*) const + 1544 13 WebCore 0x1bec83f80 WebCore::RenderBox::updateLogicalWidth() + 44 14 WebCore 0x1c0bc6a88 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) + 412 15 WebCore 0x1c0cd4a00 WebCore::RenderRubyRun::layoutBlock(bool, WebCore::LayoutUnit) + 72 16 WebCore 0x1bec81b5c WebCore::RenderBlock::layout() + 120 17 WebCore 0x1c0ba2f14 WebCore::LegacyLineLayout::layoutLineBoxes(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&) + 9296 18 WebCore 0x1c0bc9398 WebCore::RenderBlockFlow::layoutInlineChildren(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&) + 436 19 WebCore 0x1c0bc6d9c WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) + 1200 20 WebCore 0x1bec81b5c WebCore::RenderBlock::layout() + 120 21 WebCore 0x1c0bc9ccc WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) + 1920 22 WebCore 0x1c0bc6dd0 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) + 1252 23 WebCore 0x1bec81b5c WebCore::RenderBlock::layout() + 120 24 WebCore 0x1c0bc9ccc WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) + 1920 25 WebCore 0x1c0bc6dd0 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) + 1252 26 WebCore 0x1bec81b5c WebCore::RenderBlock::layout() + 120 27 WebCore 0x1bec815d4 WebCore::RenderView::layout() + 496 28 WebCore 0x1c0805cdc WebCore::FrameViewLayoutContext::performLayout() + 736 29 WebCore 0x1c0805930 WebCore::FrameViewLayoutContext::layout() + 44 30 WebCore 0x1becd26b4 WebCore::Document::updateLayout() + 476 31 WebCore 0x1c02c7b10 WebCore::Editor::appliedEditing(WebCore::CompositeEditCommand&) + 48 32 WebCore 0x1bed9be1c WebCore::CompositeEditCommand::apply() + 500 33 WebCore 0x1c02c5f78 WebCore::Editor::applyStyle(WTF::RefPtr<WebCore::EditingStyle, WTF::RawPtrTraits<WebCore::EditingStyle>, WTF::DefaultRefDerefTraits<WebCore::EditingStyle>>&&, WebCore::EditAction, WebCore::Editor::ColorFilterMode) + 496 34 WebCore 0x1c02f19b4 WebCore::executeToggleStyle(WebCore::Frame&, WebCore::EditorCommandSource, WebCore::EditAction, WebCore::CSSPropertyID, WTF::ASCIILiteral, WTF::ASCIILiteral) + 240 35 WebCore 0x1bedefe7c WebCore::Document::execCommand(WTF::String const&, bool, WTF::String const&) + 100 36 WebCore 0x1bf2a0ac4 WebCore::jsDocumentPrototypeFunction_execCommand(JSC::JSGlobalObject*, JSC::CallFrame*) + 532 37 ??? 0x110810204 ??? 38 ??? 0x110808248 ??? 39 ??? 0x110808248 ??? 40 ??? 0x110808728 ??? 41 JavaScriptCore 0x1bbf75420 JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 520 42 JavaScriptCore 0x1bc269c54 JSC::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) + 104 43 WebCore 0x1bfe59f6c WebCore::JSExecState::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) + 132 44 WebCore 0x1bfe75ab0 WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext&, WebCore::Event&) + 1080 45 WebCore 0x1c02049e4 WebCore::EventTarget::innerInvokeEventListeners(WebCore::Event&, WTF::Vector<WTF::RefPtr<WebCore::RegisteredEventListener, WTF::RawPtrTraits<WebCore::RegisteredEventListener>, WTF::DefaultRefDerefTraits<WebCore::RegisteredEventListener>>, 1ul, WTF::CrashOnOverflow, 2ul, WTF::FastMalloc>, WebCore::EventTarget::EventInvokePhase) + 444 46 WebCore 0x1c01fcbdc WebCore::EventTarget::fireEventListeners(WebCore::Event&, WebCore::EventTarget::EventInvokePhase) + 336 47 WebCore 0x1c07b0d24 WebCore::DOMWindow::dispatchEvent(WebCore::Event&, WebCore::EventTarget*) + 368 48 WebCore 0x1becafd50 WebCore::DOMWindow::dispatchLoadEvent() + 316 49 WebCore 0x1bec7d738 WebCore::Document::implicitClose() + 476 50 WebCore 0x1bec7d210 WebCore::FrameLoader::checkCompleted() + 312 51 WebCore 0x1bec7c598 WebCore::FrameLoader::finishedParsing() + 340 52 WebCore 0x1bec7b354 WebCore::Document::finishedParsing() + 608 53 WebCore 0x1bec74300 WebCore::HTMLDocumentParser::prepareToStopParsing() + 296 54 WebCore 0x1bec73fa0 WebCore::HTMLDocumentParser::finish() + 236 55 WebCore 0x1bec73bd4 WebCore::DocumentWriter::end() + 148 56 WebCore 0x1c06cfa2c WebCore::DocumentLoader::finishedLoading() + 308 1938960 3 zalan 2023-03-05 12:48:49 -0800 Not crashing on 261244@main. 1938963 4 zalan 2023-03-05 12:50:27 -0800 (must have progressed at 261063@main) 2001188 5 sgill26 2023-12-20 15:01:56 -0800 I don't think this bugzilla should have ever been created and must have been a mistake on my end. Quite literally a duplicate of https://bugs.webkit.org/show_bug.cgi?id=253165 considering the exact same test case was used *** This bug has been marked as a duplicate of bug 253165 *** 465249 2023-03-01 11:49:05 -0800 2023-03-01 11:49:05 -0800 Testcase ruby-with-edited-text-crash.html text/html 559 sgill26 PHN0eWxlPgoqIHsgCiAgICAtd2Via2l0LXVzZXItbW9kaWZ5OiByZWFkLXdyaXRlOwp9Cjwvc3R5 bGU+CjxzY3JpcHQ+CiAgICBmdW5jdGlvbiBtYWluKCkgewogICAgICAgIGlmICh3aW5kb3cudGVz dFJ1bm5lcikKICAgICAgICAgICAgdGVzdFJ1bm5lci5kdW1wQXNUZXh0KCk7CiAgICAgICAgY29u c29sZS5sb2coJ1RoZSB0ZXN0IFBBU1MgaWYgaXQgZG9lcyBub3QgY3Jhc2guJykKICAgICAgICBk b2N1bWVudC5kZXNpZ25Nb2RlID0gIm9uIjsKICAgICAgICBkb2N1bWVudC5leGVjQ29tbWFuZCgi c2VsZWN0QWxsIiwgZmFsc2UsIG51bGwpOwogICAgICAgIGRvY3VtZW50LmV4ZWNDb21tYW5kKCJp dGFsaWMiLCBmYWxzZSwgbnVsbCk7CiAgICAgICAgZG9jdW1lbnQuZXhlY0NvbW1hbmQoIml0YWxp YyIsIGZhbHNlLCBudWxsKTsKICAgIH0KPC9zY3JpcHQ+Cgo8Ym9keSBvbmxvYWQ9Im1haW4oKSI+ CjxydWJ5Pgo8aDE+PC9oMT4KPHJ0Pgo8cD48L3A+CjxpbnB1dD4KPC9ydD4KSGVsbG8hIFRoaXMg cmVuZGVyaW5nIHNob3VsZCBub3QgY3Jhc2guCjxycD48L3JwPgo8L3J1Ynk+Cg==