Bug 172611

Summary:	Layout Test imported/w3c/web-platform-tests/css/css-display-3/display-contents-replaced-001.html crashes
Product:	WebKit	Reporter:	Matt Lewis <jlewis3>
Component:	New Bugs	Assignee:	Nobody <webkit-unassigned>
Status:	NEW
Severity:	Normal	CC:	ap, ecobos, koivisto, ryanhaddad, webkit-bug-importer
Priority:	P2	Keywords:	InRadar
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified
See Also:	https://bugs.webkit.org/show_bug.cgi?id=172515 https://bugs.webkit.org/show_bug.cgi?id=172613

Matt Lewis

Reported 2017-05-25 14:36:40 PDT

The test imported/w3c/web-platform-tests/css/css-display-3/display-contents-dynamic-multicol-001-inline.html crashes consistently. Currently the test is skipped along with several other test that are similar: imported/w3c/web-platform-tests/css/css-display-3/display-contents-dynamic-flex-003-inline.html imported/w3c/web-platform-tests/css/css-display-3/display-contents-dynamic-list-001-inline.html imported/w3c/web-platform-tests/css/css-display-3/display-contents-dynamic-list-001-none.html imported/w3c/web-platform-tests/css/css-display-3/display-contents-dynamic-multicol-001-inline.html They were added in and crashed immediately in r217280 https://trac.webkit.org/changeset/217280/webkit https://build.webkit.org/results/Apple%20Sierra%20Release%20WK2%20(Tests)/r217280%20(1704)/results.html https://build.webkit.org/builders/Apple%20Sierra%20Release%20WK2%20(Tests)/builds/1704 Crash Log: Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.WebCore 0x000000010a2a789e WebCore::RenderElement::getUncachedPseudoStyle(WebCore::PseudoStyleRequest const&, WebCore::RenderStyle const*, WebCore::RenderStyle const*) const + 62 (RenderElement.cpp:1570) 1 com.apple.WebCore 0x000000010a2ed519 WebCore::RenderLayer::updateScrollCornerStyle() + 169 (RenderLayer.cpp:6926) 2 com.apple.WebCore 0x000000010a2fce1d WebCore::RenderLayer::styleChanged(WebCore::StyleDifference, WebCore::RenderStyle const*) + 957 (RenderLayer.cpp:6859) 3 com.apple.WebCore 0x000000010a3198fe WebCore::RenderLayerModelObject::styleDidChange(WebCore::StyleDifference, WebCore::RenderStyle const*) + 686 (RenderLayerModelObject.cpp:180) 4 com.apple.WebCore 0x000000010a26ef14 WebCore::RenderBox::styleDidChange(WebCore::StyleDifference, WebCore::RenderStyle const*) + 36 (RenderBox.cpp:354) 5 com.apple.WebCore 0x000000010a23a7eb WebCore::RenderBlock::styleDidChange(WebCore::StyleDifference, WebCore::RenderStyle const*) + 91 (RenderObject.h:491) 6 com.apple.WebCore 0x000000010a25ab1c WebCore::RenderBlockFlow::styleDidChange(WebCore::StyleDifference, WebCore::RenderStyle const*) + 28 (RenderObject.h:698) 7 com.apple.WebCore 0x000000010a3e02df WebCore::RenderTreeUpdater::createRenderer(WebCore::Element&, WebCore::RenderStyle&&) + 783 (RenderTreeUpdater.cpp:364) 8 com.apple.WebCore 0x000000010a3df3c3 WebCore::RenderTreeUpdater::updateElementRenderer(WebCore::Element&, WebCore::Style::ElementUpdate const&) + 451 (RenderTreeUpdater.cpp:281) 9 com.apple.WebCore 0x000000010a3de760 WebCore::RenderTreeUpdater::updateRenderTree(WebCore::ContainerNode&) + 576 (Node.h:418) 10 com.apple.WebCore 0x000000010a3de4ab WebCore::RenderTreeUpdater::commit(std::__1::unique_ptr<WebCore::Style::Update const, std::__1::default_delete<WebCore::Style::Update const> >) + 411 (ListHashSet.h:84) 11 com.apple.WebCore 0x00000001097d78a8 WebCore::Document::resolveStyle(WebCore::Document::ResolveStyleType) + 632 (Document.cpp:1764) 12 com.apple.WebCore 0x00000001097e882e WebCore::Document::finishedParsing() + 254 (Document.cpp:5028) 13 com.apple.WebCore 0x0000000109a0f022 WebCore::HTMLDocumentParser::prepareToStopParsing() + 162 (HTMLDocumentParser.cpp:137) 14 com.apple.WebCore 0x0000000109a0feb3 WebCore::HTMLDocumentParser::finish() + 211 (HTMLDocumentParser.cpp:425) 15 com.apple.WebCore 0x000000010981950a WebCore::DocumentWriter::end() + 58 (DocumentWriter.cpp:277) 16 com.apple.WebCore 0x000000010980164f WebCore::DocumentLoader::finishedLoading() + 431 (DocumentLoader.cpp:418) 17 com.apple.WebCore 0x00000001095dbc8d WebCore::CachedResource::checkNotify() + 157 (CachedResourceClientWalker.h:50) 18 com.apple.WebCore 0x00000001095d7e9c WebCore::CachedRawResource::finishLoading(WebCore::SharedBuffer*) + 268 (CachedRawResource.cpp:100) 19 com.apple.WebCore 0x000000010a5a983a WebCore::SubresourceLoader::didFinishLoading(WebCore::NetworkLoadMetrics const&) + 1162 (SubresourceLoader.cpp:564) 20 com.apple.WebKit 0x000000010866a641 WebKit::WebResourceLoader::didFinishResourceLoad(WebCore::NetworkLoadMetrics const&) + 217 (WebResourceLoader.cpp:151) 21 com.apple.WebKit 0x000000010866b308 void IPC::handleMessage<Messages::WebResourceLoader::DidFinishResourceLoad, WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)>(IPC::Decoder&, WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)) + 93 (HandleMessage.h:127) 22 com.apple.WebKit 0x00000001083f2d17 IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >) + 119 (Connection.cpp:930) 23 com.apple.WebKit 0x00000001083f59a1 IPC::Connection::dispatchOneMessage() + 175 (Connection.cpp:959) 24 com.apple.JavaScriptCore 0x000000010d6fca69 WTF::RunLoop::performWork() + 169 (RunLoop.cpp:107) 25 com.apple.JavaScriptCore 0x000000010d6fcd22 WTF::RunLoop::performWork(void*) + 34 (RunLoopCF.cpp:39) 26 com.apple.CoreFoundation 0x7fff7edc83b1 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17 (/Library/Caches/com.apple.xbs/Sources/CF/CF-1349.65/RunLoop.subproj/CFRunLoop.c:1943) 27 com.apple.CoreFoundation 0x7fff7eda963c __CFRunLoopDoSources0 + 556 (/Library/Caches/com.apple.xbs/Sources/CF/CF-1349.65/RunLoop.subproj/CFRunLoop.c:1989) 28 com.apple.CoreFoundation 0x7fff7eda8b26 __CFRunLoopRun + 934 (/Library/Caches/com.apple.xbs/Sources/CF/CF-1349.65/RunLoop.subproj/CFRunLoop.c:2821) 29 com.apple.CoreFoundation 0x7fff7eda8524 CFRunLoopRunSpecific + 420 (/Library/Caches/com.apple.xbs/Sources/CF/CF-1349.65/RunLoop.subproj/CFRunLoop.c:3113) 30 com.apple.HIToolbox 0x7fff7e308ebc RunCurrentEventLoopInMode + 240 (Events/EventsCore/EventLoop.c:440) 31 com.apple.HIToolbox 0x7fff7e308cf1 ReceiveNextEventCommon + 432 (Events/EventsCore/EventBlocking.c:264) 32 com.apple.HIToolbox 0x7fff7e308b26 _BlockUntilNextEventMatchingListInModeWithFilter + 71 (Events/EventsCore/EventBlocking.c:161) 33 com.apple.AppKit 0x7fff7c8a3e24 _DPSNextEvent + 1120 (/Library/Caches/com.apple.xbs/Sources/AppKit/AppKit-1504.82.104/GraphicsContext.subproj/CGDPSReplacement.m:705) 34 com.apple.AppKit 0x7fff7d01f85e -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 2796 (/Library/Caches/com.apple.xbs/Sources/AppKit/AppKit-1504.82.104/Events.subproj/appEventRouting.m:1319) 35 com.apple.AppKit 0x7fff7c8987ab -[NSApplication run] + 926 (/Library/Caches/com.apple.xbs/Sources/AppKit/AppKit-1504.82.104/AppKit.subproj/NSApplication.m:3712) 36 com.apple.AppKit 0x7fff7c8631de NSApplicationMain + 1237 (/Library/Caches/com.apple.xbs/Sources/AppKit/AppKit-1504.82.104/AppKit.subproj/NSApplication.m:9122) 37 libxpc.dylib 0x7fff94d228c7 _xpc_objc_main + 775 (/BuildRoot/Library/Caches/com.apple.xbs/Sources/libxpc/libxpc-972.50.27/src/main.m:162) 38 libxpc.dylib 0x7fff94d212e4 xpc_main + 494 (/BuildRoot/Library/Caches/com.apple.xbs/Sources/libxpc/libxpc-972.50.27/src/init.c:1468) 39 com.apple.WebKit.WebContent 0x00000001083ae695 main + 492 (XPCServiceMain.mm:122) 40 libdyld.dylib 0x00007fff94ac9235 start + 1

Attachments
Add attachment proposed patch, testcase, etc.

Radar WebKit Bug Importer

Comment 1 2017-05-25 14:42:32 PDT

<rdar://problem/32412412>

Matt Lewis

Comment 2 2017-05-25 14:57:54 PDT

The test imported/w3c/web-platform-tests/css/css-display-3/display-contents-replaced-001.html is also crashing alongside these tests. Accidentally put the wrong test in original post. The crash Log belongs to this test. The other test have a different crash point

Emilio Cobos Álvarez

Comment 3 2017-05-25 15:03:14 PDT

Note that I'm fixing a bunch of these in bug 172503. I'll investigate the remaining ones during the following days.

Note You need to log in before you can comment on or make changes to this bug.