271905 2024-03-29 12:49:22 -0700 ASAN_TRAP | WebCore::RenderObject::destroy; WebCore::Document::destroyRenderTree; WebCore::Document::willBeRemovedFromFrame 2024-05-20 07:35:34 -0700 1 1 1 Unclassified WebKit Layout and Rendering WebKit Nightly Build Unspecified Unspecified RESOLVED DUPLICATE 268770 https://bugs.webkit.org/show_bug.cgi?id=268770 InRadar P2 Normal --- 1 wilander webkit-unassigned abifox bfulgham cgarcia csaavedra fred.wang gpoo koivisto mikhail msaboff pgriffis rbuis simon.fraser webkit-bug-importer xan.lopez zalan zdobersek oldest_to_newest 2024795 0 470670 wilander 2024-03-29 12:49:22 -0700 Created attachment 470670 Repro case <rdar://125580138> See attached repro case. 2025332 1 fred.wang 2024-04-02 01:49:19 -0700 This is a duplicate of bug 271903. It is similar to bug 268770, but with a RenderInline ruby split into multiple continuations because of forced line breaks caused by block descendants. RELEASE_ASSERT(!m_previous) fails in WebCore::RenderObject::destroy, with a misparented m_previous. It was badly attached in RenderTreeBuilder::Ruby::attachForStyleBasedRuby with the following bad configuration: RenderView at (0,0) size 0x0 renderer (0x7f363e0007a0) layout box ((nil)) layout->[normal child] HTML RenderBlock at (0,0) size 0x0 renderer (0x7f363e0015e0) layout box ((nil)) node (0x7f363e0010e0) layout->[self][normal child] BODY RenderBody at (0,0) size 0x0 renderer (0x7f363e0017f0) layout box ((nil)) node (0x7f363e001230) layout->[self][normal child] RenderBlock at (0,0) size 0x0 renderer (0x7f363e007070) layout box ((nil)) layout->[self][normal child] [parent]----->RUBY RenderInline renderer (0x7f363e005d20) layout box ((nil)) node (0x7f363e004620) continuation->(0x7f363e007250) layout->[self][normal child] RenderInline renderer (0x7f363e005dc0) layout box ((nil)) layout->[self][normal child] #text RenderText renderer (0x7f363e005e60) layout box ((nil)) node (0x7f363e004700) length->(1) "\n" layout->[self] #text RenderText renderer (0x7f363e005ed0) layout box ((nil)) node (0x7f363e004760) length->(1) "\n" layout->[self] TIME RenderInline renderer (0x7f363e006b30) layout box ((nil)) node (0x7f363e004900) layout->[self][normal child] #text RenderText renderer (0x7f363e006ac0) layout box ((nil)) node (0x7f363e0047c0) length->(1) "\n" layout->[self] #text RenderText renderer (0x7f363e0060f0) layout box ((nil)) node (0x7f363e004a50) length->(1) "\n" layout->[self] RenderInline renderer (0x7f363e006bd0) layout box ((nil)) layout->[self][normal child] #text RenderText renderer (0x7f363e006c70) layout box ((nil)) node (0x7f363e004ab0) length->(1) "\n" layout->[self] #text RenderText renderer (0x7f363e0061d0) layout box ((nil)) node (0x7f363e004c60) length->(1) "\n" layout->[self] DATA RenderInline renderer (0x7f363e006d50) layout box ((nil)) node (0x7f363e004d20) continuation->(0x7f363e006f80) layout->[self][normal child] #text RenderText renderer (0x7f363e006ce0) layout box ((nil)) node (0x7f363e004cc0) length->(1) "\n" layout->[self] #text RenderText renderer (0x7f363e0063f0) layout box ((nil)) node (0x7f363e005010) length->(1) "\n" layout->[self] RenderBlock at (0,0) size 0x0 renderer (0x7f363e006f80) layout box ((nil)) continuation->(0x7f363e006df0) layout->[self][normal child] H3 RenderBlock at (0,0) size 0x0 renderer (0x7f363e006e90) layout box ((nil)) node (0x7f363e004e00) layout->[self] RenderBlock at (0,0) size 0x0 renderer (0x7f363e007160) layout box ((nil)) layout->[self][normal child] RUBY RenderInline renderer (0x7f363e007250) layout box ((nil)) node (0x7f363e004620) continuation->(0x7f363e006820) layout->[self][normal child] DATA RenderInline renderer (0x7f363e006df0) layout box ((nil)) node (0x7f363e004d20) layout->[self] RUBY RenderInline renderer (0x7f363e006820) layout box ((nil)) node (0x7f363e004620) layout->[self][normal child] RenderInline renderer (0x7f363e0068c0) layout box ((nil)) layout->[self][normal child] [beforeChild]-->#text RenderText renderer (0x7f363e006a50) layout box ((nil)) node (0x7f363e0050d0) length->(1) "\n" layout->[self] This is happening when creating a renderer for the RT element, here is the DOM tree: BODY 0x7f363e001230 (renderer 0x7f363e0017f0) #text 0x7f363e0045c0 "\n\n" RUBY 0x7f363e004620 (renderer 0x7f363e005d20) #text 0x7f363e004700 "\n" RT 0x7f363e004820 (renderer (nil)) CLASS=class1 #text 0x7f363e004760 "\n" TIME 0x7f363e004900 (renderer 0x7f363e006b30) #text 0x7f363e0047c0 "\n" #text 0x7f363e004a50 "\n" RP 0x7f363e004b10 (renderer (nil)) CLASS=class1 #text 0x7f363e004ab0 "\n" #text 0x7f363e004c60 "\n" DATA 0x7f363e004d20 (renderer 0x7f363e006d50) #text 0x7f363e004cc0 "\n" H3 0x7f363e004e00 (renderer 0x7f363e006e90) #text 0x7f363e004f50 "\n" #text 0x7f363e004fb0 "\n\n" #text 0x7f363e005010 "\n" RT 0x7f363e004890 (renderer 0x7f363e007390) #text 0x7f363e005070 "\n" #text 0x7f363e0050d0 "\n" 2027400 2 fred.wang 2024-04-10 04:19:26 -0700 *** This bug has been marked as a duplicate of bug 268770 *** 470670 2024-03-29 12:49:22 -0700 2024-03-29 12:49:22 -0700 Repro case reduced-1-171104482852.html text/html 505 wilander PHN0eWxlPgouY2xhc3MwLC5jbGFzczEsI3g1MCB7IHNsaWRlcnRodW1iLXZlcnRpY2FsO2Rpc3Bs YXk6IGNvbnRlbnRzO21hc2stcmVwZWF0OiB9Cjwvc3R5bGU+CjxzY3JpcHQ+CmZ1bmN0aW9uIGdj KCkgewogZm9yKHZhciBpPTA7aTwxMDA7aSsrKSB7CiB9Cn0KZnVuY3Rpb24gbWFpbigpIHsKdHJ5 IHsgeDExLnNldEF0dHJpYnV0ZSgiY2xhc3MiLCJjbGFzczEiKTsgfSBjYXRjaCB7IH0KfQo8L3Nj cmlwdD4KPGJvZHkgb25sb2FkPSJtYWluKCkiPgo8L25hdj4KPHJ1YnkgaXRlbWdyb3VwPSJBQUFB QUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBIj4KPHJ0IGNsYXNzPSJjbGFzczEiIGl0ZW1zY29w ZT0iIj4KPHRpbWUgZGlyPSJhdXRvIj4KPC90aW1lPgo8cnAgaWQ9IngxMSIgYXV0b2NhcGl0YWxp emU9InNlbnRlbmNlcyI+CjwvcnA+CjxkYXRhIDEiPgo8aDMgYWxpZ249Imp1c3RpZnkiPgo8L2gz Pgo8L21lbnU+CjwvZGF0YT4KPHJ0IHBhcnQ9InBhcnQwIj4KPC9ydD4KPC9ydWJ5Pg==