<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>271902</bug_id>
          
          <creation_ts>2024-03-29 12:37:07 -0700</creation_ts>
          <short_desc>ASAN_SEGV | RenderTreeBuilder::Block::attachIgnoringContinuation; RenderTreeBuilder::Block::attach; RenderTreeBuilder::BlockFlow::attach</short_desc>
          <delta_ts>2024-05-20 07:36:08 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>Layout and Rendering</component>
          <version>WebKit Nightly Build</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>DUPLICATE</resolution>
          <dup_id>268770</dup_id>
          <see_also>https://bugs.webkit.org/show_bug.cgi?id=268770</see_also>
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="John Wilander">wilander</reporter>
          <assigned_to name="Nobody">webkit-unassigned</assigned_to>
          <cc>abifox</cc>
    
    <cc>bfulgham</cc>
    
    <cc>cgarcia</cc>
    
    <cc>csaavedra</cc>
    
    <cc>fred.wang</cc>
    
    <cc>gpoo</cc>
    
    <cc>koivisto</cc>
    
    <cc>mikhail</cc>
    
    <cc>msaboff</cc>
    
    <cc>pgriffis</cc>
    
    <cc>rbuis</cc>
    
    <cc>simon.fraser</cc>
    
    <cc>webkit-bug-importer</cc>
    
    <cc>xan.lopez</cc>
    
    <cc>zalan</cc>
    
    <cc>zdobersek</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>2024792</commentid>
    <comment_count>0</comment_count>
      <attachid>470667</attachid>
    <who name="John Wilander">wilander</who>
    <bug_when>2024-03-29 12:37:07 -0700</bug_when>
    <thetext>Created attachment 470667
repro case

&lt;rdar://125183625&gt;

See attached repro case.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>2025390</commentid>
    <comment_count>1</comment_count>
    <who name="Frédéric Wang Nélar">fred.wang</who>
    <bug_when>2024-04-02 08:07:50 -0700</bug_when>
    <thetext>This is a duplicate of bug 268770.

Crash is happening in WebCore::RenderTreeBuilder::Block::attachIgnoringContinuation where beforeChildContainer is dereferenced after reaching the outermost ancestor:

164	        while (beforeChildContainer-&gt;parent() != &amp;parent)
(rr) bt
#0  WebCore::RenderTreeBuilder::Block::attachIgnoringContinuation(WebCore::RenderBlock&amp;, std::unique_ptr&lt;WebCore::RenderObject, WebCore::RenderObjectDeleter&gt;, WebCore::RenderObject*) (this=0x7fa5aa24afb0, parent=..., child=std::unique_ptr&lt;WebCore::RenderObject&gt; = {...}, beforeChild=0x7fa54200f8c0)
    at /home/fred/src-obj/WebKit/Source/WebCore/rendering/updating/RenderTreeBuilderBlock.cpp:164
#1  0x00007fa5cca75432 in WebCore::RenderTreeBuilder::Block::attach(WebCore::RenderBlock&amp;, std::unique_ptr&lt;WebCore::RenderObject, WebCore::RenderObjectDeleter&gt;, WebCore::RenderObject*)
    (this=0x7fa5aa24afb0, parent=..., child=std::unique_ptr&lt;WebCore::RenderObject&gt; = {...}, beforeChild=beforeChild@entry=0x7fa54200f8c0)
    at /usr/include/c++/11/bits/unique_ptr.h:172
#2  0x00007fa5cca75958 in WebCore::RenderTreeBuilder::BlockFlow::attach(WebCore::RenderBlockFlow&amp;, std::unique_ptr&lt;WebCore::RenderObject, WebCore::RenderObjectDeleter&gt;, WebCore::RenderObject*)
    (this=&lt;optimized out&gt;, parent=..., child=std::unique_ptr&lt;WebCore::RenderObject&gt; = {...}, beforeChild=&lt;optimized out&gt;)
    at /usr/include/c++/11/bits/unique_ptr.h:172
#3  0x00007fa5cca6fc31 in WebCore::RenderTreeBuilder::attachInternal(WebCore::RenderElement&amp;, std::unique_ptr&lt;WebCore::RenderObject, WebCore::RenderObjectDeleter&gt;, WebCore::RenderObject*)
    (this=&lt;optimized out&gt;, parent=..., child=std::unique_ptr&lt;WebCore::RenderObject&gt; = {...}, beforeChild=&lt;optimized out&gt;)
    at /usr/include/c++/11/bits/unique_ptr.h:172
#4  0x00007fa5cca75b1b in operator()(WebCore::RenderElement&amp;) const (__closure=0x7ffc313959f0, parentCandidate=...)
    at /home/fred/src-obj/WebKit/Source/WebCore/rendering/updating/RenderTreeBuilder.cpp:207
#5  0x00007fa5cca6f8f1 in WebCore::RenderTreeBuilder::attachInternal(WebCore::RenderElement&amp;, std::unique_ptr&lt;WebCore::RenderObject, WebCore::RenderObjectDeleter&gt;, WebCore::RenderObject*)
    (this=this@entry=0x7ffc31398360, parent=..., child=std::unique_ptr&lt;WebCore::RenderObject&gt; = {...}, beforeChild=&lt;optimized out&gt;, 
    beforeChild@entry=0x7fa54200f8c0) at /home/fred/src-obj/WebKit/Source/WebCore/rendering/updating/RenderTreeBuilder.cpp:328
#6  0x00007fa5cca6ff16 in WebCore::RenderTreeBuilder::attach(WebCore::RenderElement&amp;, std::unique_ptr&lt;WebCore::RenderObject, WebCore::RenderObjectDeleter&gt;, WebCore::RenderObject*)
    (this=this@entry=0x7ffc31398360, parent=..., child=std::unique_ptr&lt;WebCore::RenderObject&gt; = {...}, beforeChild=0x7fa54200f8c0)
    at /usr/include/c++/11/bits/unique_ptr.h:172
#7  0x00007fa5cca7f52a in WebCore::RenderTreeUpdater::createTextRenderer(WebCore::Text&amp;, WebCore::Style::TextUpdate const*)
    (this=this@entry=0x7ffc31398330, textNode=..., textUpdate=textUpdate@entry=0x7fa5aa205398)
    at /home/fred/src-obj/WebKit/Source/WebCore/rendering/updating/RenderTreePosition.h:45
#8  0x00007fa5cca7f92b in WebCore::RenderTreeUpdater::updateTextRenderer(WebCore::Text&amp;, WebCore::Style::TextUpdate const*)
     (this=this@entry=0x7ffc31398330, text=..., textUpdate=textUpdate@entry=0x7fa5aa205398)
    at /home/fred/src-obj/WebKit/Source/WebCore/rendering/updating/RenderTreeUpdater.cpp:624
#9  0x00007fa5cca800fe in WebCore::RenderTreeUpdater::updateRenderTree(WebCore::ContainerNode&amp;)
    (this=this@entry=0x7ffc31398330, root=&lt;optimized out&gt;) at /home/fred/src-obj/WebKit/Source/WebCore/rendering/updating/RenderTreeUpdater.cpp:238
#10 0x00007fa5cca80583 in WebCore::RenderTreeUpdater::commit(std::unique_ptr&lt;WebCore::Style::Update, std::default_delete&lt;WebCore::Style::Update&gt; &gt;)
     (this=0x7ffc31398330, styleUpdate=std::unique_ptr&lt;WebCore::Style::Update&gt; = {...})
    at /home/fred/src-obj/WebKit/Source/WebCore/rendering/updating/RenderTreeUpdater.cpp:127
#11 0x00007fa5cbb5dda1 in WebCore::Document::updateRenderTree(std::unique_ptr&lt;WebCore::Style::Update, std::default_delete&lt;WebCore::Style::Update&gt; &gt;)
    (this=this@entry=0x7fa55a141c00, styleUpdate=std::unique_ptr&lt;WebCore::Style::Update&gt; = {...}) at /usr/include/c++/11/bits/unique_ptr.h:172
#12 0x00007fa5cbb7f79e in WebCore::Document::resolveStyle(WebCore::Document::ResolveStyleType)
    (this=this@entry=0x7fa55a141c00, type=&lt;optimized out&gt;, type@entry=WebCore::Document::ResolveStyleType::Normal)
    at /usr/include/c++/11/bits/unique_ptr.h:172
#13 0x00007fa5cbb7fc45 in WebCore::Document::updateStyleIfNeeded() (this=this@entry=0x7fa55a141c00)
    at /home/fred/src-obj/WebKit/Source/WebCore/dom/Document.cpp:2668
#14 0x00007fa5cbc97405 in WebCore::CompositeEditCommand::textNodeForRebalance(WebCore::Position const&amp;) const
     (this=this@entry=0x7fa5aa109ff0, position=...) at /home/fred/src-obj/WebKit/Source/WebCore/editing/CompositeEditCommand.cpp:911
#15 0x00007fa5cbc97ad0 in WebCore::CompositeEditCommand::rebalanceWhitespaceAt(WebCore::Position const&amp;)
    (this=this@entry=0x7fa5aa109ff0, position=...) at /home/fred/src-obj/WebKit/Source/WebCore/editing/CompositeEditCommand.cpp:925
#16 0x00007fa5cbd0f2f8 in WebCore::InsertTextCommand::doApply() (this=0x7fa5aa109ff0)
    at /home/fred/src-obj/WebKit/Source/WebCore/editing/InsertTextCommand.cpp:213
#17 0x00007fa5cbc900c3 in WebCore::CompositeEditCommand::applyCommandToComposite(WTF::Ref&lt;WebCore::CompositeEditCommand, WTF::RawPtrTraits&lt;WebCore::CompositeEditCommand&gt;, WTF::DefaultRefDerefTraits&lt;WebCore::CompositeEditCommand&gt; &gt;&amp;&amp;, WebCore::VisibleSelection const&amp;)
    (this=this@entry=0x7fa5aa0a0d20, command=..., selection=...)
    at /home/fred/src-obj/WebKit/WebKitBuild/RelWithDebInfo/WTF/Headers/wtf/RawPtrTraits.h:44
#18 0x00007fa5cbd48c57 in WebCore::TypingCommand::insertTextRunWithoutNewlines(WTF::String const&amp;, bool)
    (selectInsertedText=false, text=..., this=0x7fa5aa0a0d20) at /home/fred/src-obj/WebKit/Source/WebCore/editing/TypingCommand.cpp:557
#19 WebCore::TypingCommand::insertTextRunWithoutNewlines(WTF::String const&amp;, bool)
    (this=0x7fa5aa0a0d20, text=..., selectInsertedText=&lt;optimized out&gt;) at /home/fred/src-obj/WebKit/Source/WebCore/editing/TypingCommand.cpp:549
--Type &lt;RET&gt; for more, q to quit, c to continue without paging--c
#20 0x00007fa5cbd58038 in WebCore::TypingCommandLineOperation::operator()(unsigned long, unsigned long, bool) const (isLastLine=&lt;optimized out&gt;, lineLength=&lt;optimized out&gt;, lineOffset=&lt;optimized out&gt;, this=&lt;optimized out&gt;) at /home/fred/src-obj/WebKit/Source/WebCore/editing/TypingCommand.cpp:70
#21 WebCore::TypingCommandLineOperation::operator()(unsigned long, unsigned long, bool) const (isLastLine=&lt;optimized out&gt;, lineLength=&lt;optimized out&gt;, lineOffset=&lt;optimized out&gt;, this=&lt;optimized out&gt;) at /home/fred/src-obj/WebKit/Source/WebCore/editing/TypingCommand.cpp:66
#22 WebCore::forEachLineInString&lt;WebCore::TypingCommandLineOperation&gt;(WTF::String const&amp;, WebCore::TypingCommandLineOperation const&amp;) (string=..., operation=...) at /home/fred/src-obj/WebKit/Source/WebCore/editing/TextInsertionBaseCommand.h:64
#23 0x00007fa5cbd49759 in WebCore::TypingCommand::insertText(WTF::String const&amp;, bool) (this=&lt;optimized out&gt;, text=..., selectInsertedText=&lt;optimized out&gt;) at /home/fred/src-obj/WebKit/Source/WebCore/editing/TypingCommand.cpp:535
#24 0x00007fa5cbd49867 in WebCore::TypingCommand::insertTextAndNotifyAccessibility(WTF::String const&amp;, bool) (this=0x7fa5aa0a0d20, text=..., selectInsertedText=&lt;optimized out&gt;) at /home/fred/src-obj/WebKit/Source/WebCore/editing/TypingCommand.cpp:544
#25 0x00007fa5cbc8faf3 in WebCore::CompositeEditCommand::apply() (this=0x7fa5aa0a0d20) at /home/fred/src-obj/WebKit/Source/WebCore/editing/CompositeEditCommand.cpp:402
#26 0x00007fa5cbd49c41 in WebCore::TypingCommand::insertText(WTF::Ref&lt;WebCore::Document, WTF::RawPtrTraits&lt;WebCore::Document&gt;, WTF::DefaultRefDerefTraits&lt;WebCore::Document&gt; &gt;&amp;&amp;, WTF::String const&amp;, WebCore::VisibleSelection const&amp;, WTF::OptionSet&lt;WebCore::TypingCommand::Option&gt;, WebCore::TypingCommand::TextCompositionType) (document=..., text=&lt;optimized out&gt;, selectionForInsertion=..., options=..., compositionType=&lt;optimized out&gt;) at /home/fred/src-obj/WebKit/Source/WebCore/editing/TypingCommand.cpp:267
#27 0x00007fa5cbd49fa8 in WebCore::TypingCommand::insertText(WTF::Ref&lt;WebCore::Document, WTF::RawPtrTraits&lt;WebCore::Document&gt;, WTF::DefaultRefDerefTraits&lt;WebCore::Document&gt; &gt;&amp;&amp;, WTF::String const&amp;, WTF::OptionSet&lt;WebCore::TypingCommand::Option&gt;, WebCore::TypingCommand::TextCompositionType) (document=..., text=&lt;optimized out&gt;, options=..., options@entry=..., composition=composition@entry=WebCore::TypingCommand::TextCompositionType::None) at /home/fred/src-obj/WebKit/Source/WebCore/editing/TypingCommand.cpp:231
#28 0x00007fa5cbccfd24 in WebCore::executeInsertText(WebCore::LocalFrame&amp;, WebCore::Event*, WebCore::EditorCommandSource, WTF::String const&amp;) (frame=&lt;optimized out&gt;, value=&lt;optimized out&gt;) at /home/fred/src-obj/WebKit/Source/WebCore/editing/EditorCommand.cpp:536
#29 0x00007fa5cbb81c5b in WebCore::Document::execCommand(WTF::String const&amp;, bool, WTF::String const&amp;) (this=0x7fa55a141c00, commandName=..., userInterface=&lt;optimized out&gt;, value=...) at /home/fred/src-obj/WebKit/Source/WebCore/dom/Document.cpp:6860
#30 0x00007fa5cac4caf5 in WebCore::jsDocumentPrototypeFunction_execCommandBody (castedThis=&lt;optimized out&gt;, callFrame=&lt;optimized out&gt;, lexicalGlobalObject=0x7fa55a017088) at /home/fred/src-obj/WebKit/WebKitBuild/RelWithDebInfo/WebCore/DerivedSources/JSDocument.cpp:6433
#31 WebCore::IDLOperation&lt;WebCore::JSDocument&gt;::call&lt;WebCore::jsDocumentPrototypeFunction_execCommandBody&gt; (operationName=0x7fa5cd184c7a &quot;execCommand&quot;, callFrame=&lt;optimized out&gt;, lexicalGlobalObject=...) at /home/fred/src-obj/WebKit/Source/WebCore/bindings/js/JSDOMOperation.h:63
#32 WebCore::jsDocumentPrototypeFunction_execCommand(JSC::JSGlobalObject*, JSC::CallFrame*) (lexicalGlobalObject=0x7fa55a017088, callFrame=&lt;optimized out&gt;) at /home/fred/src-obj/WebKit/WebKitBuild/RelWithDebInfo/WebCore/DerivedSources/JSDocument.cpp:6438
#33 0x00007fa55c008038 in  ()
#34 0x00007ffc31398ed0 in  ()
#35 0x00007fa5c7a3fade in op_call_return_location () at /home/fred/src-obj/WebKit/Source/JavaScriptCore/llint/LowLevelInterpreter.asm:1172
#36 0x0000000000000000 in  ()

Going up to https://searchfox.org/wubkat/rev/2f857be7d42f00feb7b59870709310154181a774/Source/WebCore/rendering/updating/RenderTreeBuilder.cpp#302, we have the following configuration:

      RenderView at (0,0) size 800x585 renderer (0x7fa5420007a0) layout box ((nil)) (layout overflow 0,0 7748x585)
        HTML RenderFlexibleBox at (0,0) size 800x585 renderer (0x7fa5420085c0) layout box ((nil)) node (0x7fa5420010e0) (layout overflow 0,0 7748x585) (visual overflow 0,0 7748x585)
          BODY RenderFlexibleBox at (8,8) size 7740x569 renderer (0x7fa542008770) layout box ((nil)) node (0x7fa542001230) (layout overflow 0,0 7740x569) (visual overflow 0,-7 7740x583)
            KEYGEN RenderBlock at (0,0) size 0x569 renderer (0x7fa5420015e0) layout box ((nil)) node (0x7fa542004920)
            METER RenderBlock at (0,0) size 80x16 renderer (0x7fa5420017f0) layout box ((nil)) node (0x7fa542004b20)
              DIV RenderBlock at (0,0) size 80x16 renderer (0x7fa542003220) layout box ((nil)) node (0x7fa542004e80)
                DIV RenderBlock at (0,0) size 80x16 renderer (0x7fa542003430) layout box ((nil)) node (0x7fa542004ef0)
                  DIV RenderBlock at (0,0) size 80x16 renderer (0x7fa542008920) layout box ((nil)) node (0x7fa542004f60)
            SHADOW RenderBlock at (80,0) size 0x569 renderer (0x7fa542008a10) layout box ((nil)) node (0x7fa542004990)
            svg RenderSVGRoot at (80,0) size 300x569 renderer (0x7fa542008b00) layout box ((nil)) node (0x7fa542005c20)
[parent]---&gt;RUBY RenderBlock at (380,0) size 7200x569 renderer (0x7fa54200f300) layout box ((nil)) node (0x7fa542005e20) (layout overflow 0,0 7200x569) (visual overflow -7,-7 7214x583)
              RenderBlock at (0,0) size 7200x18 renderer (0x7fa54200f4e0) layout box (0x7fa54200db40)
               line at (0.00,0.00) size (7200.00x18.00) baseline (14.00) enclosing top (0.00) bottom (17.00)
                 Root inline box at (0.00,0.00) size (7200.00x17.00)
                   Inline box at (0.00,0.00) size (0.00x17.00) renderer-&gt;(0x7fa542008ff0)
                     Inline box at (0.00,0.00) size (0.00x17.00) renderer-&gt;(0x7fa54200ad50)
                       Inline box at (0.00,0.00) size (0.00x17.00) renderer-&gt;(0x7fa542008f50)
                   Inline box at (4800.00,0.00) size (2400.00x17.00) renderer-&gt;(0x7fa54200f7b0)
                 Run(s):
                   Text at (0.00,0.00) size 4800.00x17.00 run(0, 400) renderer-&gt;(0x7fa54200ace0)
                   Text at (4800.00,0.00) size 2400.00x17.00 run(0, 200) renderer-&gt;(0x7fa54200f850)
                RenderInline renderer (0x7fa542008ff0) layout box (0x7fa54200dbd0)
                  RenderInline renderer (0x7fa54200ad50) layout box (0x7fa54200e260)
                    FONT RenderInline renderer (0x7fa542008f50) layout box (0x7fa54200e2f0) node (0x7fa54200cd40) continuation-&gt;(0x7fa54200f3f0)
                #text RenderText renderer (0x7fa54200ace0) layout box (0x7fa54200d060) node (0x7fa54200c880) length-&gt;(400) &quot;AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&quot;...
                A RenderInline renderer (0x7fa54200f7b0) layout box (0x7fa54200e380) node (0x7fa54200f270) continuation-&gt;(0x7fa5420104c0)
                  #text RenderText renderer (0x7fa54200f850) layout box (0x7fa54200d0e0) node (0x7fa54200c8e0) length-&gt;(200) &quot;AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&quot;...
              RenderBlock at (0,18) size 7200x18 renderer (0x7fa54200d600) layout box (0x7fa54200e4a0)
               line at (0.00,0.00) size (7200.00x18.00) baseline (14.00) enclosing top (0.00) bottom (17.00)
                 Root inline box at (0.00,0.00) size (16.00x17.00)
                   Inline box at (0.00,0.00) size (0.00x17.00) renderer-&gt;(0x7fa5420104c0)
                 Run(s):
                   Text at (0.00,0.00) size 16.00x17.00 run(0, 2) renderer-&gt;(0x7fa54200f8c0)
                   Atomic box at (16.00,14.00) size 0.00x0.00 renderer-&gt;(0x7fa54200ae90)
                A RenderInline renderer (0x7fa5420104c0) layout box (0x7fa54200e920) node (0x7fa54200f270)
[beforeChild]--&gt;#text RenderText renderer (0x7fa54200f8c0) layout box (0x7fa54200dce0) node (0x7fa542005dc0) length-&gt;(2) &quot;A\n&quot;
                    CAPTION RenderFlexibleBox at (16,14) size 0x0 renderer (0x7fa54200ae90) layout box (0x7fa54200e9b0) node (0x7fa54200a320)
                  RenderBlock at (0,36) size 7200x18 renderer (0x7fa54200f3f0) layout box ((nil)) continuation-&gt;(0x7fa54200adf0)
                    A RenderFlexibleBox at (0,0) size 7200x18 renderer (0x7fa54200a170) layout box ((nil)) node (0x7fa54200d280)
                      RenderBlock at (0,0) size 180x18 renderer (0x7fa54200f6c0) layout box (0x7fa54200ecf0)
                       line at (0.00,0.00) size (180.00x18.00) baseline (14.00) enclosing top (0.00) bottom (17.00)
                         Root inline box at (0.00,0.00) size (180.00x17.00)
                         Run(s):
                           Text at (0.00,0.00) size 180.00x17.00 run(1, 16) renderer-&gt;(0x7fa542008ee0)
                        #text RenderText renderer (0x7fa542008ee0) layout box (0x7fa54200ebe0) node (0x7fa54200c820) length-&gt;(16) &quot;\nAAAAAAAAAAAAAAA&quot;
                  RenderBlock at (0,54) size 7200x0 renderer (0x7fa54200f5d0) layout box (0x7fa54200f930)
               line at (0.00,0.00) size (7200.00x0.00) baseline (0.00) enclosing top (0.00) bottom (0.00)
                 Root inline box at (0.00,-14.00) size (0.00x17.00)
                 Run(s):
                FONT RenderInline renderer (0x7fa54200adf0) layout box (0x7fa54200f9c0) node (0x7fa54200cd40)
            SPAN RenderFlexibleBox at (7580,0) size 160x569 renderer (0x7fa542009090) layout box ((nil)) node (0x7fa542006020)
              DATA RenderFlexibleBox at (0,0) size 160x569 renderer (0x7fa542009240) layout box ((nil)) node (0x7fa542006100)
                U RenderFlexibleBox at (0,0) size 160x569 renderer (0x7fa5420093f0) layout box ((nil)) node (0x7fa542006250)
                  BLOCKQUOTE RenderFlexibleBox at (40,16) size 80x537 renderer (0x7fa5420095a0) layout box ((nil)) node (0x7fa542006450)
                    BLOCKQUOTE RenderFlexibleBox at (40,16) size 0x505 renderer (0x7fa542009750) layout box ((nil)) node (0x7fa5420064c0)
                      H6 RenderFlexibleBox at (0,24.97) size 0x455.06 renderer (0x7fa542009900) layout box ((nil)) node (0x7fa542005990)
                        LABEL RenderFlexibleBox at (0,0) size 0x455.06 renderer (0x7fa542009ab0) layout box ((nil)) node (0x7fa542006650)
                          A RenderFlexibleBox at (0,0) size 0x455.06 renderer (0x7fa542009c60) layout box ((nil)) node (0x7fa542006750)
                            H1 RenderFlexibleBox at (0,14.36) size 0x426.34 renderer (0x7fa542009e10) layout box ((nil)) node (0x7fa542006870)
                              LABEL RenderFlexibleBox at (0,0) size 0x426.34 renderer (0x7fa542009fc0) layout box ((nil)) node (0x7fa5420066d0)
                                FORM RenderBlock at (0,0) size 0x404.91 renderer (0x7fa542008df0) layout box ((nil)) node (0x7fa542006a10)
                                SPAN RenderFlexibleBox at (0,0) size 0x426.34 renderer (0x7fa54200aa40) layout box ((nil)) node (0x7fa542006090)

findOrCreateParentForStyleBasedRubyChild would return the first child in release mode and failing assertion ASSERT(parent.firstChild()-&gt;style().display() == DisplayType::Ruby) in debug mode. Then insertRecursiveIfNeeded will lead to the nullptr beforeChildContainer.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>2027402</commentid>
    <comment_count>2</comment_count>
    <who name="Frédéric Wang Nélar">fred.wang</who>
    <bug_when>2024-04-10 04:19:34 -0700</bug_when>
    <thetext>

*** This bug has been marked as a duplicate of bug 268770 ***</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="0"
              isprivate="0"
          >
            <attachid>470667</attachid>
            <date>2024-03-29 12:37:07 -0700</date>
            <delta_ts>2024-03-29 12:37:07 -0700</delta_ts>
            <desc>repro case</desc>
            <filename>reduced-1-171088854606.html</filename>
            <type>text/html</type>
            <size>1789</size>
            <attacher name="John Wilander">wilander</attacher>
            
              <data encoding="base64">PHN0eWxlPgouY2xhc3MxOjpmaXJzdC1sZXR0ZXIsKjpsYXN0LWNoaWxkIHsgMC43M2VtO2Rpc3Bs
YXk6IGZsZXg7bWFzay1wb3NpdGlvbjogMHB4Oy13ZWJraXQtYW5pbWF0aW9uLW5hbWU6IGtleWZy
YW1lczQsa2V5ZnJhbWVzMztib3JkZXItdG9wLWNvbG9yOiB9Cjwvc3R5bGU+CjxzdHlsZT4KQGtl
eWZyYW1lcyBrZXlmcmFtZXMzIHsKPC9zdHlsZT4KPHN0eWxlPgo8L3N0eWxlPgo8c2NyaXB0Pgpm
dW5jdGlvbiBnYygpIHsKIGZvcih2YXIgaT0wO2k8MTAwO2krKykgewogfQp9CmZ1bmN0aW9uIG1h
aW4oKSB7CnRyeSB7IHYyID0gZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiY2FwdGlvbiIpOyB9IGNh
dGNoIHsgfQp0cnkgeyB2NCA9IGRvY3VtZW50LmNyZWF0ZUVsZW1lbnQoInNwYW4iKTsgfSBjYXRj
aCB7IH0KdHJ5IHsgd2luZG93Lm9ud2Via2l0YW5pbWF0aW9uc3RhcnQgPSBmMDsgfSBjYXRjaCB7
IH0KdHJ5IHsgdjU3ID0geDMxLmluc2VydEFkamFjZW50RWxlbWVudCgiYWZ0ZXJlbmQiLHY0KTsg
fSBjYXRjaCB7IH0KdHJ5IHsgZG9jdW1lbnQuYWxsWzQxICUgZG9jdW1lbnQuYWxsLmxlbmd0aF0u
YXBwZW5kQ2hpbGQodjIpOyB9IGNhdGNoIHsgfQp9CmZ1bmN0aW9uIGYwKCkgewp0cnkgeyBkb2N1
bWVudC5leGVjQ29tbWFuZCgiZm9yZUNvbG9yIixmYWxzZSwiIzFFRENERiIpOyB9IGNhdGNoIHsg
fQp0cnkgeyBkb2N1bWVudC5leGVjQ29tbWFuZCgiY3JlYXRlTGluayIsZmFsc2UsIngiKTsgfSBj
YXRjaCB7IH0KdHJ5IHsgd2luZG93LmZpbmQoIkFBQUFBQUFBQUFBQUFBQSIsZmFsc2UsZmFsc2Us
ZmFsc2UsdHJ1ZSx0cnVlLHRydWUpOyB9IGNhdGNoIHsgfQp0cnkgeyB9IGNhdGNoIHsgfQp0cnkg
eyBkb2N1bWVudC5leGVjQ29tbWFuZCgiaW5zZXJ0VGV4dCIsZmFsc2UsIkFBQUFBQUFBQUFBQUFB
QUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFB
QUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFB
QUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFB
QUFBQUFBQUFBQUFBQUFBIik7IH0gY2F0Y2ggeyB9Cn0KPC9zY3JpcHQ+Cjxib2R5IG9ubG9hZD0i
bWFpbigpIj4KPGtleWdlbiBrZXl0eXBlPSJFQyI+CjxtZXRlciB2YWx1ZT0iMzM3Ij4KPC9tZXRl
cj4KPHNoYWRvdyBvbmZvY3VzPSJmMCgpIj4KPGF1ZGlvIG9uZm9jdXM9ImYyKCkiPgo8L3NoYWRv
dz4KPGg1IGhpZGRlbj0iIj4KPGFyZWEgZHJhZ2dhYmxlPSJ0cnVlIj4KPC9oNT4KPHN2ZyBmaWx0
ZXI9InVybCgjeDM2KSI+CjxydWJ5IGNvbnRlbnRlZGl0YWJsZT0idHJ1ZSIgb25mb2N1c2luPSJm
MCgpIiBwYXJ0PSJwYXJ0MSI+CkFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUEKPC9ydWJ5
Pgo8c3BhbiBpdGVtc2NvcGU9IiI+CjxkYXRhIG9uY2xpY2s9ImYxKCkiPgo8dSB0cmFuc2xhdGU9
InllcyI+CjxibG9ja3F1b3RlIGl0ZW10eXBlPSJBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFB
QUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUEiPgo8YmxvY2txdW90ZSBwYXJ0PSJw
YXJ0MSI+Cjwvc3VwPgo8aDYgaXRlbXJlZj0ieDE4Ij4KPGxhYmVsIGl0ZW10eXBlPSJBQUFBQUFB
QUFBQUFBQUFBQUFBQSI+CjxhIGl0ZW1yZWY9Ing2Ij4KPGgxIG9uZm9jdXNpbj0iZjIoKSI+Cjxs
YWJlbCBpdGVtcmVmPSJ4NTAiPgo8Zm9ybSBpZD0ieDMxIiBlbmN0eXBlPSJhcHBsaWNhdGlvbi94
LXd3dy1mb3JtLXVybGVuY29kZWQiPg==
</data>

          </attachment>
      

    </bug>

</bugzilla>