Bug 221275

Summary: REGRESSION(r272128): ASSERTION FAILED: run.inlineItem.isText() || run.inlineItem.isInlineBoxStart() || run.inlineItem.isInlineBoxEnd() on fast/layoutformattingcontext/table-basic-row-baseline-align.html
Product: WebKit Reporter: Robert Jenner <jenner>
Component: Layout and RenderingAssignee: zalan <zalan>
Status: RESOLVED FIXED    
Severity: Normal CC: bfulgham, koivisto, simon.fraser, webkit-bot-watchers-bugzilla, webkit-bug-importer, zalan
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
crash log
none
Patch
none
Patch none

Description Robert Jenner 2021-02-02 11:07:02 PST 
fast/layoutformattingcontext/table-basic-row-baseline-align.html

Is Flakey crashing on macOS Catalina and BigSur in wk2. 

HISTORY:
https://results.webkit.org/?suite=layout-tests&test=fast%2Flayoutformattingcontext%2Ftable-basic-row-baseline-align.html&platform=mac
Comment 1 Radar WebKit Bug Importer 2021-02-02 11:08:04 PST 
<rdar://problem/73888807>
Comment 2 Robert Jenner 2021-02-02 11:26:30 PST 
Was not able to reproduce the test crash, likely due to the test being incredibly flakey.However, the history does indicate a potential regression point. 

History chart indicates crashes started at r272128
Comment 3 Ryan Haddad 2021-02-02 20:34:56 PST 
Created attachment 419098 [details]
crash log

ASSERTION FAILED: run.inlineItem.isText() || run.inlineItem.isInlineBoxStart() || run.inlineItem.isInlineBoxEnd()
./layout/inlineformatting/InlineContentBreaker.cpp(286) : auto WebCore::Layout::InlineContentBreaker::processOverflowingTextContent(const WebCore::Layout::InlineContentBreaker::ContinuousContent &, const WebCore::Layout::InlineContentBreaker::LineStatus &)::(anonymous class)::operator()(auto &) const
1   0x6f2b0c649 WTFCrash
2   0x6cfaf392b WTFCrashWithInfo(int, char const*, char const*, int)
3   0x6d362aac2 auto WebCore::Layout::InlineContentBreaker::processOverflowingTextContent(WebCore::Layout::InlineContentBreaker::ContinuousContent const&, WebCore::Layout::InlineContentBreaker::LineStatus const&) const::$_15::operator()<WebCore::Layout::InlineContentBreaker::ContinuousContent::Run const>(WebCore::Layout::InlineContentBreaker::ContinuousContent::Run const&) const
4   0x6d36237ed WebCore::Layout::InlineContentBreaker::processOverflowingTextContent(WebCore::Layout::InlineContentBreaker::ContinuousContent const&, WebCore::Layout::InlineContentBreaker::LineStatus const&) const::$_22::operator()() const
5   0x6d36230bf WebCore::Layout::InlineContentBreaker::processOverflowingTextContent(WebCore::Layout::InlineContentBreaker::ContinuousContent const&, WebCore::Layout::InlineContentBreaker::LineStatus const&) const
6   0x6d3622655 WebCore::Layout::InlineContentBreaker::processOverflowingContent(WebCore::Layout::InlineContentBreaker::ContinuousContent const&, WebCore::Layout::InlineContentBreaker::LineStatus const&) const::$_18::operator()() const
7   0x6d3622129 WebCore::Layout::InlineContentBreaker::processOverflowingContent(WebCore::Layout::InlineContentBreaker::ContinuousContent const&, WebCore::Layout::InlineContentBreaker::LineStatus const&) const
8   0x6d3621ab1 WebCore::Layout::InlineContentBreaker::processInlineContent(WebCore::Layout::InlineContentBreaker::ContinuousContent const&, WebCore::Layout::InlineContentBreaker::LineStatus const&)::$_17::operator()() const
9   0x6d3621810 WebCore::Layout::InlineContentBreaker::processInlineContent(WebCore::Layout::InlineContentBreaker::ContinuousContent const&, WebCore::Layout::InlineContentBreaker::LineStatus const&)
10  0x6d3641b48 WebCore::Layout::LineBuilder::handleInlineContent(WebCore::Layout::InlineContentBreaker&, WebCore::Layout::LineBuilder::InlineItemRange const&, WebCore::Layout::LineCandidate const&)
11  0x6d36406e7 WebCore::Layout::LineBuilder::placeInlineContent(WebCore::Layout::LineBuilder::InlineItemRange const&, unsigned long)
12  0x6d363510a WebCore::Layout::LineBuilder::computedIntrinsicWidth(WebCore::Layout::LineBuilder::InlineItemRange const&, float)
13  0x6d3634ec6 WebCore::Layout::InlineFormattingContext::computedIntrinsicWidthForConstraint(float) const
14  0x6d3634cac auto WebCore::Layout::InlineFormattingContext::computedIntrinsicWidthConstraints()::$_0::operator()<int>(int) const
15  0x6d363483c WebCore::Layout::InlineFormattingContext::computedIntrinsicWidthConstraints()
16  0x6d36c4c6c WebCore::Layout::TableFormattingContext::Geometry::intrinsicWidthConstraintsForCell(WebCore::Layout::TableGrid::Cell const&)::$_8::operator()() const
17  0x6d36c3e01 WebCore::Layout::TableFormattingContext::Geometry::intrinsicWidthConstraintsForCell(WebCore::Layout::TableGrid::Cell const&)
18  0x6d36c2d37 WebCore::Layout::TableFormattingContext::computedPreferredWidthForColumns()
19  0x6d36c2ae9 WebCore::Layout::TableFormattingContext::computedIntrinsicWidthConstraints()
20  0x6d36022fb WebCore::Layout::TableWrapperBlockFormattingContext::computeWidthAndMarginForTableBox(WebCore::Layout::ContainerBox const&, WebCore::Layout::HorizontalConstraints const&)
21  0x6d360167a WebCore::Layout::TableWrapperBlockFormattingContext::layoutTableBox(WebCore::Layout::ContainerBox const&, WebCore::Layout::FormattingContext::ConstraintsForInFlowContent const&)
22  0x6d3601407 WebCore::Layout::TableWrapperBlockFormattingContext::layoutInFlowContent(WebCore::Layout::InvalidationState&, WebCore::Layout::FormattingContext::ConstraintsForInFlowContent const&)
23  0x6d35f69b8 WebCore::Layout::BlockFormattingContext::layoutInFlowContent(WebCore::Layout::InvalidationState&, WebCore::Layout::FormattingContext::ConstraintsForInFlowContent const&)
24  0x6d35d8097 WebCore::Layout::LayoutContext::layoutFormattingContextSubtree(WebCore::Layout::ContainerBox const&, WebCore::Layout::InvalidationState&)
25  0x6d35d7d67 WebCore::Layout::LayoutContext::layoutWithPreparedRootGeometry(WebCore::Layout::InvalidationState&)
26  0x6d35d7c0b WebCore::Layout::LayoutContext::layout(WebCore::LayoutSize const&, WebCore::Layout::InvalidationState&)
27  0x6d39c952d WebCore::FrameViewLayoutContext::layoutUsingFormattingContext()
28  0x6d39aa69d WebCore::FrameViewLayoutContext::layout()
29  0x6d39c9caf WebCore::FrameViewLayoutContext::layoutTimerFired()
Comment 5 zalan 2021-02-03 17:00:17 PST 
Created attachment 419208 [details]
Patch
Comment 6 Simon Fraser (smfr) 2021-02-03 19:28:04 PST 
Comment on attachment 419208 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=419208&action=review

> Source/WebCore/layout/inlineformatting/InlineContentBreaker.cpp:69
> +    // Based on standards commit boundary ruless it would be enough to check the first inline item, but due to the table quirk, we can have

standard commit boundary rules
Comment 7 zalan 2021-02-03 20:32:49 PST 
Created attachment 419224 [details]
Patch
Comment 8 EWS 2021-02-03 21:08:00 PST 
Committed r272356: <https://trac.webkit.org/changeset/272356>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 419224 [details].