Bug 156349

Summary:	Assertions in FrameView::scheduleRelayoutOfSubtree() in some layout tests after fix to https://bugs.webkit.org/show_bug.cgi?id=156245
Product:	WebKit	Reporter:	Ada Chan <adachan>
Component:	Layout and Rendering	Assignee:	Nobody <webkit-unassigned>
Status:	RESOLVED FIXED
Severity:	Normal	CC:	ap, ryanhaddad, simon.fraser, zalan
Priority:	P2
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified
See Also:	https://bugs.webkit.org/show_bug.cgi?id=156381

Ada Chan

Reported 2016-04-07 11:06:40 PDT

A number of layout tests ran into assertions in FrameView::scheduleRelayoutOfSubtree() after fix to MediaControlsApple.css changes in https://bugs.webkit.org/show_bug.cgi?id=156245 It looks like the style change that changes the test result is the addition of overflow: hidden in ::-webkit-media-controls in mediaControlsApple.css. The tests are: http/tests/appcache/video.html media/track/track-active-cues.html media/track/track-in-band.html media/track/video-track-alternate-groups.html media/track/video-track.html media/video-src-empty.html It looks like it's asserting in FrameView::scheduleRelayoutOfSubtree() on this line: ASSERT(!newRelayoutRoot.container() || !newRelayoutRoot.container()->needsLayout()); Here's the call stack of the assertion: Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.JavaScriptCore 0x0000000102639497 WTFCrash + 39 1 com.apple.WebCore 0x0000000107e2e211 WebCore::FrameView::scheduleRelayoutOfSubtree(WebCore::RenderElement&) + 465 (FrameView.cpp:2704) 2 com.apple.WebCore 0x0000000109074a69 WebCore::scheduleRelayoutForSubtree(WebCore::RenderElement&) + 121 (RenderObject.cpp:585) 3 com.apple.WebCore 0x00000001090745ef WebCore::RenderObject::markContainingBlocksForLayout(WebCore::ScheduleRelayout, WebCore::RenderElement*) + 1151 (RenderObject.cpp:642) 4 com.apple.WebCore 0x00000001073d7650 WebCore::RenderObject::setNeedsLayout(WebCore::MarkingBehavior) + 176 (RenderObject.h:1108) 5 com.apple.WebCore 0x0000000107a4550e WebCore::RenderObject::setNeedsLayoutAndPrefWidthsRecalc() + 30 (RenderObject.h:593) 6 com.apple.WebCore 0x0000000108f2cabf WebCore::RenderElement::insertChildInternal(WebCore::RenderObject*, WebCore::RenderObject*, WebCore::RenderElement::NotifyChildrenType) + 847 (RenderElement.cpp:594) 7 com.apple.WebCore 0x0000000108f2c6d5 WebCore::RenderElement::addChild(WebCore::RenderObject*, WebCore::RenderObject*) + 293 (RenderElement.cpp:515) 8 com.apple.WebCore 0x0000000108e5a33f WebCore::RenderBlock::addChildIgnoringContinuation(WebCore::RenderObject*, WebCore::RenderObject*) + 1327 (RenderBlock.cpp:498) 9 com.apple.WebCore 0x0000000108e59e08 WebCore::RenderBlock::addChild(WebCore::RenderObject*, WebCore::RenderObject*) + 120 (RenderBlock.cpp:412) 10 com.apple.WebCore 0x000000010880f6e1 WebCore::RenderTreePosition::insert(WebCore::RenderObject&) + 129 (RenderTreePosition.h:93) 11 com.apple.WebCore 0x000000010880e340 WebCore::RenderTreeUpdater::createRenderer(WebCore::Element&, WebCore::RenderStyle&) + 800 (RenderTreeUpdater.cpp:338) 12 com.apple.WebCore 0x000000010880d73e WebCore::RenderTreeUpdater::updateElementRenderer(WebCore::Element&, WebCore::Style::ElementUpdate const&) + 302 (RenderTreeUpdater.cpp:252) 13 com.apple.WebCore 0x000000010880d228 WebCore::RenderTreeUpdater::updateRenderTree(WebCore::ContainerNode&) + 808 (RenderTreeUpdater.cpp:154) 14 com.apple.WebCore 0x000000010880ccd6 WebCore::RenderTreeUpdater::commit(std::__1::unique_ptr<WebCore::Style::Update const, std::__1::default_delete<WebCore::Style::Update const> >) + 854 (RenderTreeUpdater.cpp:99) 15 com.apple.WebCore 0x0000000107a2781d WebCore::Document::recalcStyle(WebCore::Style::Change) + 1565 (Document.cpp:1943) 16 com.apple.WebCore 0x0000000107a1cb91 WebCore::Document::updateStyleIfNeeded() + 305 (Document.cpp:1990) 17 com.apple.WebCore 0x0000000107a23c2e WebCore::Document::updateLayout() + 238 (Document.cpp:2008) 18 com.apple.WebCore 0x0000000107a2839f WebCore::Document::updateLayoutIgnorePendingStylesheets(WebCore::Document::RunPostLayoutTasks) + 207 (Document.cpp:2048) 19 com.apple.WebCore 0x0000000107bf1bc0 WebCore::Element::getBoundingClientRect() + 64 (Element.cpp:1096) 20 com.apple.WebCore 0x0000000108563c1d WebCore::jsElementPrototypeFunctionGetBoundingClientRect(JSC::ExecState*) + 429 (JSElement.cpp:4823) 21 ??? 0x00005809dfa01028 0 + 96799429759016 22 ??? 0x00005809dfa10a54 0 + 96799429823060 23 com.apple.JavaScriptCore 0x000000010225bf47 llint_entry + 26835 24 com.apple.JavaScriptCore 0x000000010225becd llint_entry + 26713 25 com.apple.JavaScriptCore 0x000000010225becd llint_entry + 26713 26 com.apple.JavaScriptCore 0x000000010225bf47 llint_entry + 26835 27 com.apple.JavaScriptCore 0x000000010225bf47 llint_entry + 26835 28 com.apple.JavaScriptCore 0x000000010225545e vmEntryToJavaScript + 334 29 com.apple.JavaScriptCore 0x00000001020681da JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 218 30 com.apple.JavaScriptCore 0x0000000101fff5ac JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 1100 31 com.apple.JavaScriptCore 0x00000001018ed86e JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 190 32 com.apple.JavaScriptCore 0x00000001018ed8d3 JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) + 83 33 com.apple.JavaScriptCore 0x00000001018edacb JSC::profiledCall(JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) + 139 34 com.apple.WebCore 0x00000001083c6d4b WebCore::JSMainThreadExecState::profiledCall(JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) + 139 (JSMainThreadExecState.h:75) 35 com.apple.WebCore 0x0000000108580510 WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext*, WebCore::Event*) + 1504 (JSEventListener.cpp:133) 36 com.apple.WebCore 0x0000000107c4af67 WebCore::EventTarget::fireEventListeners(WebCore::Event&, WebCore::EventTargetData*, WTF::Vector<WebCore::RegisteredEventListener, 1ul, WTF::CrashOnOverflow, 16ul>&) + 1463 (EventTarget.cpp:260) 37 com.apple.WebCore 0x0000000107c4a798 WebCore::EventTarget::fireEventListeners(WebCore::Event&) + 312 (EventTarget.cpp:212) 38 com.apple.WebCore 0x0000000108d1d191 WebCore::Node::handleLocalEvents(WebCore::Event&) + 177 (Node.cpp:2124) 39 com.apple.WebCore 0x0000000107c205e1 WebCore::EventContext::handleLocalEvents(WebCore::Event&) const + 177 (EventContext.cpp:55) 40 com.apple.WebCore 0x0000000107c2122c WebCore::dispatchEventInDOM(WebCore::Event&, WebCore::EventPath const&, WebCore::WindowEventContext&) + 348 (EventDispatcher.cpp:127) 41 com.apple.WebCore 0x0000000107c20f48 WebCore::EventDispatcher::dispatchEvent(WebCore::Node*, WebCore::Event&) + 680 (EventDispatcher.cpp:184) 42 com.apple.WebCore 0x0000000108d1d1ed WebCore::Node::dispatchEvent(WebCore::Event&) + 29 (Node.cpp:2138) 43 com.apple.WebCore 0x0000000107e67a35 WebCore::GenericEventQueue::dispatchOneEvent() + 245 (GenericEventQueue.cpp:103) 44 com.apple.WebCore 0x0000000107e678e3 WebCore::GenericEventQueue::sharedTimerFired() + 243 (GenericEventQueue.cpp:83) 45 com.apple.WebCore 0x0000000107e6aeda void std::__1::__invoke_void_return_wrapper<void>::__call<void (*&)()>(void (*&&&)()) + 42 (__functional_base:441) 46 com.apple.WebCore 0x0000000107e6ae7c std::__1::__function::__func<void (*)(), std::__1::allocator<void (*)()>, void ()>::operator()() + 44 (functional:1407) 47 com.apple.WebCore 0x00000001073c891a std::__1::function<void ()>::operator()() const + 26 (functional:1793) 48 com.apple.WebCore 0x00000001073c882c WebCore::Timer::fired() + 28 (Timer.h:142) 49 com.apple.WebCore 0x000000010975a99a WebCore::ThreadTimers::sharedTimerFiredInternal() + 394 (ThreadTimers.cpp:124) 50 com.apple.WebCore 0x000000010975bbe1 WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0::operator()() const + 33 (ThreadTimers.cpp:73) 51 com.apple.WebCore 0x000000010975bbad void std::__1::__invoke_void_return_wrapper<void>::__call<WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0&>(WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0&&&) + 45 (__functional_base:441) 52 com.apple.WebCore 0x000000010975bb4c std::__1::__function::__func<WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0, std::__1::allocator<WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0>, void ()>::operator()() + 44 (functional:1407) 53 com.apple.WebCore 0x00000001073c891a std::__1::function<void ()>::operator()() const + 26 (functional:1793) 54 com.apple.WebCore 0x0000000108af1cbf WebCore::MainThreadSharedTimer::fired() + 111 (MainThreadSharedTimer.cpp:53) 55 com.apple.WebCore 0x0000000108af20b9 WebCore::timerFired(__CFRunLoopTimer*, void*) + 41 (MainThreadSharedTimerCF.cpp:74) 56 com.apple.CoreFoundation 0x00007fff846b62e4 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 20 57 com.apple.CoreFoundation 0x00007fff846b5f73 __CFRunLoopDoTimer + 1059 58 com.apple.CoreFoundation 0x00007fff8472953d __CFRunLoopDoTimers + 301 59 com.apple.CoreFoundation 0x00007fff84671608 __CFRunLoopRun + 2024 60 com.apple.CoreFoundation 0x00007fff84670bd8 CFRunLoopRunSpecific + 296 61 ??? 0x00000001011d6c0c 0 + 4313672716 62 ??? 0x00000001011d52ed 0 + 4313666285 63 ??? 0x00000001011d4872 0 + 4313663602 64 ??? 0x00000001011d750d 0 + 4313675021 65 ??? 0x000000010122e702 0 + 4314031874 66 libdyld.dylib 0x00007fff85ddc5c9 start + 1

Attachments
Add attachment proposed patch, testcase, etc.

Ada Chan

Comment 1 2016-04-07 15:26:10 PDT

Looks like there are two more tests with the same assertion firing: media/media-controls-invalid-url.html plugins/quicktime-plugin-replacement.html

Alexey Proskuryakov

Comment 2 2016-04-07 17:19:31 PDT

Ada is going to roll out the part of the patch that's making these assertions fail, and to unskip the tests.

Ada Chan

Comment 3 2016-04-07 18:29:23 PDT

The rollout has been addressed in https://bugs.webkit.org/show_bug.cgi?id=156381.

zalan

Comment 4 2016-04-22 08:39:16 PDT

This is addressed by http://trac.webkit.org/changeset/199856

Note You need to log in before you can comment on or make changes to this bug.