Bug 231703

Summary:

[ Windows EWS ] Flaky crashes in layout code on js/dom & js/dfg- tests

Product:

WebKit

Reporter:

ayumi_kojima

Component:

Layout and Rendering

Assignee:

Nobody <webkit-unassigned>

Status:

NEW ---

Severity:

Normal

CC:

bfulgham, koivisto, pvollan, simon.fraser, webkit-bot-watchers-bugzilla, webkit-bug-importer, zalan

Priority:

Keywords:

InRadar

Version:

WebKit Nightly Build

Hardware:

OS:

Unspecified

Attachments:

Description	Flags
Crash log	none

Description ayumi_kojima 2021-10-13 15:35:08 PDT

Many js/dom & js/dfg- tests are showing up on Windows EWS as flaky tests.

js/dom/toInt32UInt32.html
js/dom/implicit-call-with-global-reentry.html
js/dom/document-all-class-extends.html
js/dom/reserved-words-as-property.html
js/dfg-inlining-reg-alloc.html
js/dfg-inline-many-blocks.html
js/dfg-float32array.html
js/dfg-uint16array.html

The crash seems to be only on Windows-EWS and are not seen in the open source: https://results.webkit.org/?suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&test=js%2Fdom%2FtoInt32UInt32.html&test=js%2Fdfg-uint16array.html&test=js%2Fdfg-float32array.html&test=js%2Fdfg-inline-many-blocks.html&test=js%2Fdfg-inlining-reg-alloc.html

Some of the tests have been flaky since August (Example build: https://ews-build.webkit.org/#/builders/10/builds/102140).

Those tests seem to have no stderr and sometimes no crash log (No crash log found for DumpRenderTree:8796.) Example: https://ews-build.s3-us-west-2.amazonaws.com/Windows-EWS/r441069-110127/results.html

Stdio:

22:21:33.280 10004 worker/1 worker/1 js/dom/toInt32UInt32.html crashed, (no stderr)
22:21:33.299 10004 [23872/26923] js/dom/toInt32UInt32.html failed unexpectedly (DumpRenderTree crashed [pid=1000])
22:21:33.300 10004 worker/1 killing driver
22:21:33.300 10004 worker/1 js/dom/toInt32UInt32.html failed:
22:21:33.300 10004 worker/1 DumpRenderTree crashed [pid=1000]

Comment 1 ayumi_kojima 2021-10-13 15:36:13 PDT

Created attachment 441149 [details]
Crash log

Comment 2 Radar WebKit Bug Importer 2021-10-13 15:36:45 PDT

<rdar://problem/84220361>

Comment 3 ayumi_kojima 2021-10-13 15:47:49 PDT

Marked test expectation so that they won't affect the performance of EWS https://trac.webkit.org/changeset/284130/webkit

Comment 4 ayumi_kojima 2021-10-13 17:11:19 PDT

Crash logs:

js/dfg-inline-many-blocks.html

 Frame[00]  Triage Symbol: [WTF!abort+0x35]
    Frame[01]  Triage Symbol: [WTF!WTF::fastMalloc+0x18]
    Frame[02]  Triage Symbol: [WebKit!WTF::HashTable<WTF::RefPtr<WebCore::Element const ,WTF::RawPtrTraits<WebCore::Element const >,WTF::DefaultRefDerefTraits<WebCore::Element const > >,WTF::KeyValuePair<WTF::RefPtr<WebCore::Element const ,WTF::RawPtrTraits<WebCore::Element const >,WTF::DefaultRe+0x59]
    Frame[03]  Triage Symbol: [WebKit!WTF::HashMap<WTF::RefPtr<WebCore::Element const ,WTF::RawPtrTraits<WebCore::Element const >,WTF::DefaultRefDerefTraits<WebCore::Element const > >,WebCore::Style::ElementUpdates,WTF::DefaultHash<WTF::RefPtr<WebCore::Element const ,WTF::RawPtrTraits<WebCore::El+0x23e]
    Frame[04]  Triage Symbol: [WebKit!WebCore::Style::TreeResolver::resolveComposedTree+0x650]
    Frame[05]  Triage Symbol: [WebKit!WebCore::Style::TreeResolver::resolve+0x3a0]
    Frame[06]  Triage Symbol: [WebKit!WebCore::Document::resolveStyle+0x2e7]
    Frame[07]  Triage Symbol: [WebKit!WebCore::Document::updateStyleIfNeeded+0x130]
    Frame[08]  Triage Symbol: [WebKit!WebCore::Document::finishedParsing+0x1fe]
    Frame[09]  Triage Symbol: [WebKit!WebCore::HTMLDocumentParser::prepareToStopParsing+0x8e]
    Frame[0a]  Triage Symbol: [WebKit!WebCore::HTMLDocumentParser::resumeParsingAfterScriptExecution+0x57]
    Frame[0b]  Triage Symbol: [WebKit!WebCore::HTMLDocumentParser::notifyFinished+0xad]
    Frame[0c]  Triage Symbol: [WebKit!WebCore::PendingScript::notifyClientFinished+0x1e]
    Frame[0d]  Triage Symbol: [WebKit!WebCore::LoadableScript::notifyClientFinished+0x17c]
    Frame[0e]  Triage Symbol: [WebKit!WebCore::CachedResource::checkNotify+0x11d]
    Frame[0f]  Triage Symbol: [WebKit!WebCore::SubresourceLoader::didFinishLoading+0x139]
    Frame[10]  Triage Symbol: [WebKit!<lambda_e7e2d454785dfeaf6199132ec807941c>::operator+0xec]
    Frame[11]  Triage Symbol: [WTF!WTF::RunLoop::performWork+0x23f]
    Frame[12]  Ignore Symbol: [WTF!WTF::RunLoop::RunLoopWndProc+0x5c]
    Frame[13]  Triage Symbol: [USER32!UserCallWinProcCheckWow+0x2f8]
    Frame[14]  Triage Symbol: [USER32!DispatchMessageWorker+0x249]
    Frame[15]  Triage Symbol: [DumpRenderTreeLib!runTest+0xb08]
    Frame[16]  Triage Symbol: [DumpRenderTreeLib!main+0x5d3]
    Frame[17]  Triage Symbol: [DumpRenderTree!main+0x880]
    Frame[18]  Triage Symbol: [DumpRenderTree!__scrt_common_main_seh+0x10c]
    Frame[19]  Triage Symbol: [KERNEL32!BaseThreadInitThunk+0x14]
    Frame[1a]  Triage Symbol: [ntdll!RtlUserThreadStart+0x21]


js/dfg-float32array.html

Frame[00]  Triage Symbol: [WTF!abort+0x35]
    Frame[01]  Triage Symbol: [WTF!WTF::fastMalloc+0x18]
    Frame[02]  Triage Symbol: [WebKit!WTF::Vector<WebCore::FloatQuad,0,WTF::CrashOnOverflow,16,WTF::FastMalloc>::expandCapacity<0>+0x5f]
    Frame[03]  Triage Symbol: [WebKit!WTF::Vector<WebCore::FloatQuad,0,WTF::CrashOnOverflow,16,WTF::FastMalloc>::expandCapacity<0>+0x53]
    Frame[04]  Triage Symbol: [WebKit!WebCore::Layout::InlineFormattingContext::collectContentIfNeeded+0x2a8]
    Frame[05]  Triage Symbol: [WebKit!WebCore::Layout::InlineFormattingContext::lineLayoutForIntergration+0x65]
    Frame[06]  Triage Symbol: [WebKit!WebCore::LayoutIntegration::LineLayout::layout+0x2ae]
    Frame[07]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutModernLines+0x391]
    Frame[08]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlock+0x443]
    Frame[09]  Triage Symbol: [WebKit!WebCore::RenderBlock::layout+0x80]
    Frame[0a]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlockChild+0x292]
    Frame[0b]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlockChildren+0x5e1]
    Frame[0c]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlock+0x44e]
    Frame[0d]  Triage Symbol: [WebKit!WebCore::RenderBlock::layout+0x80]
    Frame[0e]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlockChild+0x292]
    Frame[0f]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlockChildren+0x5e1]
    Frame[10]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlock+0x44e]
    Frame[11]  Triage Symbol: [WebKit!WebCore::RenderBlock::layout+0x80]
    Frame[12]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlockChild+0x292]
    Frame[13]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlockChildren+0x5e1]
    Frame[14]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlock+0x44e]
    Frame[15]  Triage Symbol: [WebKit!WebCore::RenderBlock::layout+0x80]
    Frame[16]  Triage Symbol: [WebKit!WebCore::RenderView::layout+0x2e3]
    Frame[17]  Triage Symbol: [WebKit!WebCore::FrameViewLayoutContext::layout+0x599]
    Frame[18]  Triage Symbol: [WebKit!WebCore::Document::implicitClose+0x35d]
    Frame[19]  Triage Symbol: [WebKit!WebCore::FrameLoader::checkCompleted+0x13f]
    Frame[1a]  Triage Symbol: [WebKit!WebCore::CachedResourceLoader::loadDone+0x80]
    Frame[1b]  Triage Symbol: [WebKit!WebCore::SubresourceLoader::notifyDone+0x55]
    Frame[1c]  Triage Symbol: [WebKit!WebCore::SubresourceLoader::didFinishLoading+0xf0]
    Frame[1d]  Triage Symbol: [WebKit!WTF::Detail::CallableWrapper<<lambda_e7e2d454785dfeaf6199132ec807941c>,void>::call+0x7a]
    Frame[1e]  Triage Symbol: [WTF!WTF::RunLoop::performWork+0x23f]
    Frame[1f]  Ignore Symbol: [WTF!WTF::RunLoop::RunLoopWndProc+0x5c]
    Frame[20]  Triage Symbol: [USER32!UserCallWinProcCheckWow+0x2f8]
    Frame[21]  Triage Symbol: [USER32!DispatchMessageWorker+0x249]
    Frame[22]  Triage Symbol: [DumpRenderTreeLib!runTest+0xb08]
    Frame[23]  Triage Symbol: [DumpRenderTreeLib!main+0x5d3]
    Frame[24]  Triage Symbol: [DumpRenderTree!main+0x880]
    Frame[25]  Triage Symbol: [DumpRenderTree!__scrt_common_main_seh+0x10c]
    Frame[26]  Triage Symbol: [KERNEL32!BaseThreadInitThunk+0x14]
    Frame[27]  Triage Symbol: [ntdll!RtlUserThreadStart+0x21]

js/dfg-uint32array.html

Frame[00]  Triage Symbol: [WTF!abort+0x35]
    Frame[01]  Triage Symbol: [WTF!WTF::fastMalloc+0x18]
    Frame[02]  Triage Symbol: [WebKit!WTF::Vector<WebCore::Layout::LineBox,0,WTF::CrashOnOverflow,16,WTF::FastMalloc>::expandCapacity<0>+0x5d]
    Frame[03]  Triage Symbol: [WebKit!WTF::Vector<WebCore::Layout::LineBox,0,WTF::CrashOnOverflow,16,WTF::FastMalloc>::expandCapacity<0>+0x6e]
    Frame[04]  Triage Symbol: [WebKit!WebCore::Layout::InlineFormattingContext::computeGeometryForLineContent+0x17e]
    Frame[05]  Triage Symbol: [WebKit!WebCore::Layout::InlineFormattingContext::lineLayout+0x257]
    Frame[06]  Triage Symbol: [WebKit!WebCore::Layout::InlineFormattingContext::lineLayoutForIntergration+0x8a]
    Frame[07]  Triage Symbol: [WebKit!WebCore::LayoutIntegration::LineLayout::layout+0x2ae]
    Frame[08]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutModernLines+0x316]
    Frame[09]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlock+0x443]
    Frame[0a]  Triage Symbol: [WebKit!WebCore::RenderBlock::layout+0x80]
    Frame[0b]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlockChild+0x292]
    Frame[0c]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlockChildren+0x5e1]
    Frame[0d]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlock+0x44e]
    Frame[0e]  Triage Symbol: [WebKit!WebCore::RenderBlock::layout+0x80]
    Frame[0f]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlockChild+0x292]
    Frame[10]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlockChildren+0x5e1]
    Frame[11]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlock+0x44e]
    Frame[12]  Triage Symbol: [WebKit!WebCore::RenderBlock::layout+0x80]
    Frame[13]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlockChild+0x292]
    Frame[14]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlockChildren+0x5e1]
    Frame[15]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlock+0x44e]
    Frame[16]  Triage Symbol: [WebKit!WebCore::RenderBlock::layout+0x80]
    Frame[17]  Triage Symbol: [WebKit!WebCore::RenderView::layout+0x2e3]
    Frame[18]  Triage Symbol: [WebKit!WebCore::FrameViewLayoutContext::layout+0x4fb]
    Frame[19]  Triage Symbol: [WebKit!WebCore::Document::implicitClose+0x35d]
    Frame[1a]  Triage Symbol: [WebKit!WebCore::FrameLoader::checkCompleted+0x13f]
    Frame[1b]  Triage Symbol: [WebKit!WebCore::CachedResourceLoader::loadDone+0x80]
    Frame[1c]  Triage Symbol: [WebKit!WebCore::SubresourceLoader::notifyDone+0x55]
    Frame[1d]  Triage Symbol: [WebKit!WebCore::SubresourceLoader::didFinishLoading+0xf0]
    Frame[1e]  Triage Symbol: [WebKit!WTF::Detail::CallableWrapper<<lambda_e7e2d454785dfeaf6199132ec807941c>,void>::call+0x7a]
    Frame[1f]  Triage Symbol: [WTF!WTF::RunLoop::performWork+0x23f]
    Frame[20]  Ignore Symbol: [WTF!WTF::RunLoop::RunLoopWndProc+0x5c]
    Frame[21]  Triage Symbol: [USER32!UserCallWinProcCheckWow+0x2f8]
    Frame[22]  Triage Symbol: [USER32!DispatchMessageWorker+0x249]
    Frame[23]  Triage Symbol: [DumpRenderTreeLib!runTest+0xb08]
    Frame[24]  Triage Symbol: [DumpRenderTreeLib!main+0x5d3]
    Frame[25]  Triage Symbol: [DumpRenderTree!main+0x880]
    Frame[26]  Triage Symbol: [DumpRenderTree!__scrt_common_main_seh+0x10c]
    Frame[27]  Triage Symbol: [KERNEL32!BaseThreadInitThunk+0x14]
    Frame[28]  Triage Symbol: [ntdll!RtlUserThreadStart+0x21]

js/dfg-inlining-reg-alloc.html

Frame[00]  Triage Symbol: [WTF!abort+0x35]
    Frame[01]  Triage Symbol: [WTF!WTF::fastMalloc+0x18]
    Frame[02]  Triage Symbol: [WebKit!WebCore::LayoutIntegration::LineLayout::constructContent+0x273]
    Frame[03]  Triage Symbol: [WebKit!WebCore::LayoutIntegration::LineLayout::layout+0x14f]
    Frame[04]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutModernLines+0x347]
    Frame[05]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlock+0x380]
    Frame[06]  Triage Symbol: [WebKit!WebCore::RenderBlock::layout+0x80]
    Frame[07]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlockChild+0x292]
    Frame[08]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlockChildren+0x508]
    Frame[09]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlock+0x43f]
    Frame[0a]  Triage Symbol: [WebKit!WebCore::RenderBlock::layout+0x80]
    Frame[0b]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlockChild+0x292]
    Frame[0c]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlockChildren+0x508]
    Frame[0d]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlock+0x43f]
    Frame[0e]  Triage Symbol: [WebKit!WebCore::RenderBlock::layout+0x80]
    Frame[0f]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlockChild+0x292]
    Frame[10]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlockChildren+0x508]
    Frame[11]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlock+0x43f]
    Frame[12]  Triage Symbol: [WebKit!WebCore::RenderBlock::layout+0x80]
    Frame[13]  Triage Symbol: [WebKit!WebCore::RenderView::layout+0x2ed]
    Frame[14]  Triage Symbol: [WebKit!WebCore::FrameViewLayoutContext::layout+0x5bf]
    Frame[15]  Triage Symbol: [WebKit!WebCore::Document::implicitClose+0x35d]
    Frame[16]  Triage Symbol: [WebKit!WebCore::FrameLoader::checkCompleted+0x13f]
    Frame[17]  Triage Symbol: [WebKit!WebCore::CachedResourceLoader::loadDone+0x80]
    Frame[18]  Triage Symbol: [WebKit!WebCore::SubresourceLoader::notifyDone+0x55]
    Frame[19]  Triage Symbol: [WebKit!WebCore::SubresourceLoader::didFinishLoading+0x163]
    Frame[1a]  Triage Symbol: [WebKit!<lambda_e7e2d454785dfeaf6199132ec807941c>::operator+0xec]
    Frame[1b]  Triage Symbol: [WTF!WTF::RunLoop::performWork+0x23f]
    Frame[1c]  Ignore Symbol: [WTF!WTF::RunLoop::RunLoopWndProc+0x5c]
    Frame[1d]  Triage Symbol: [USER32!UserCallWinProcCheckWow+0x2f8]
    Frame[1e]  Triage Symbol: [USER32!DispatchMessageWorker+0x249]
    Frame[1f]  Triage Symbol: [DumpRenderTreeLib!runTest+0xb08]
    Frame[20]  Triage Symbol: [DumpRenderTreeLib!main+0x5d3]
    Frame[21]  Triage Symbol: [DumpRenderTree!main+0x880]
    Frame[22]  Triage Symbol: [DumpRenderTree!__scrt_common_main_seh+0x10c]
    Frame[23]  Triage Symbol: [KERNEL32!BaseThreadInitThunk+0x14]
    Frame[24]  Triage Symbol: [ntdll!RtlUserThreadStart+0x21]

js/dfg-uint16array.html

Frame[00]  Triage Symbol: [WTF!abort+0x35]
    Frame[01]  Triage Symbol: [WTF!WTF::fastMalloc+0x18]
    Frame[02]  Triage Symbol: [WebKit!WTF::Vector<WebCore::FloatQuad,0,WTF::CrashOnOverflow,16,WTF::FastMalloc>::expandCapacity<0>+0x5f]
    Frame[03]  Triage Symbol: [WebKit!<lambda_d3c85f595435a51d9a01f47c3175058e>::operator+0xf7]
    Frame[04]  Triage Symbol: [WebKit!WebCore::Layout::InlineTextItem::createAndAppendTextItems+0x4d0]
    Frame[05]  Triage Symbol: [WebKit!WebCore::Layout::InlineFormattingContext::collectContentIfNeeded+0x499]
    Frame[06]  Triage Symbol: [WebKit!WebCore::Layout::InlineFormattingContext::lineLayoutForIntergration+0x1d]
    Frame[07]  Triage Symbol: [WebKit!WebCore::LayoutIntegration::LineLayout::layout+0x2e0]
    Frame[08]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutModernLines+0x35b]
    Frame[09]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlock+0x3b6]
    Frame[0a]  Triage Symbol: [WebKit!WebCore::RenderBlock::layout+0x80]
    Frame[0b]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlockChild+0x292]
    Frame[0c]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlockChildren+0x47a]
    Frame[0d]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlock+0x3c1]
    Frame[0e]  Triage Symbol: [WebKit!WebCore::RenderBlock::layout+0x80]
    Frame[0f]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlockChild+0x292]
    Frame[10]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlockChildren+0x47a]
    Frame[11]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlock+0x3c1]
    Frame[12]  Triage Symbol: [WebKit!WebCore::RenderBlock::layout+0x80]
    Frame[13]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlockChild+0x292]
    Frame[14]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlockChildren+0x47a]
    Frame[15]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlock+0x3c1]
    Frame[16]  Triage Symbol: [WebKit!WebCore::RenderBlock::layout+0x80]
    Frame[17]  Triage Symbol: [WebKit!WebCore::RenderView::layout+0x2ed]
    Frame[18]  Triage Symbol: [WebKit!WebCore::FrameViewLayoutContext::layout+0x5bf]
    Frame[19]  Triage Symbol: [WebKit!WebCore::Document::implicitClose+0x35d]
    Frame[1a]  Triage Symbol: [WebKit!WebCore::FrameLoader::checkCompleted+0x13f]
    Frame[1b]  Triage Symbol: [WebKit!WebCore::CachedResourceLoader::loadDone+0x80]
    Frame[1c]  Triage Symbol: [WebKit!WebCore::SubresourceLoader::notifyDone+0x55]
    Frame[1d]  Triage Symbol: [WebKit!WebCore::SubresourceLoader::didFinishLoading+0x163]
    Frame[1e]  Triage Symbol: [WebKit!<lambda_e7e2d454785dfeaf6199132ec807941c>::operator+0xec]
    Frame[1f]  Triage Symbol: [WTF!WTF::RunLoop::performWork+0x23f]
    Frame[20]  Ignore Symbol: [WTF!WTF::RunLoop::RunLoopWndProc+0x5c]
    Frame[21]  Triage Symbol: [USER32!UserCallWinProcCheckWow+0x2f8]
    Frame[22]  Triage Symbol: [USER32!DispatchMessageWorker+0x249]
    Frame[23]  Triage Symbol: [DumpRenderTreeLib!runTest+0xb08]
    Frame[24]  Triage Symbol: [DumpRenderTreeLib!main+0x5d3]
    Frame[25]  Triage Symbol: [DumpRenderTree!main+0x880]
    Frame[26]  Triage Symbol: [DumpRenderTree!__scrt_common_main_seh+0x10c]
    Frame[27]  Triage Symbol: [KERNEL32!BaseThreadInitThunk+0x14]
    Frame[28]  Triage Symbol: [ntdll!RtlUserThreadStart+0x21]

js/dom/reserved-words-as-property.html

Frame[00]  Triage Symbol: [WTF!abort+0x35]
    Frame[01]  Triage Symbol: [WTF!WTF::fastMalloc+0x18]
    Frame[02]  Triage Symbol: [WebKit!WTF::Vector<WebCore::InlineDisplay::Box,0,WTF::CrashOnOverflow,16,WTF::FastMalloc>::shrinkCapacity+0xae]
    Frame[03]  Triage Symbol: [WebKit!WebCore::LayoutIntegration::InlineContent::shrinkToFit+0x1a]
    Frame[04]  Triage Symbol: [WebKit!WebCore::LayoutIntegration::LineLayout::constructContent+0x113]
    Frame[05]  Triage Symbol: [WebKit!WebCore::LayoutIntegration::LineLayout::layout+0x384]
    Frame[06]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutModernLines+0x347]
    Frame[07]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlock+0x443]
    Frame[08]  Triage Symbol: [WebKit!WebCore::RenderBlock::layout+0x80]
    Frame[09]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlockChild+0x292]
    Frame[0a]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlockChildren+0x5e1]
    Frame[0b]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlock+0x44e]
    Frame[0c]  Triage Symbol: [WebKit!WebCore::RenderBlock::layout+0x80]
    Frame[0d]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlockChild+0x292]
    Frame[0e]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlockChildren+0x5e1]
    Frame[0f]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlock+0x44e]
    Frame[10]  Triage Symbol: [WebKit!WebCore::RenderBlock::layout+0x80]
    Frame[11]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlockChild+0x292]
    Frame[12]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlockChildren+0x5e1]
    Frame[13]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlock+0x44e]
    Frame[14]  Triage Symbol: [WebKit!WebCore::RenderBlock::layout+0x80]
    Frame[15]  Triage Symbol: [WebKit!WebCore::RenderView::layout+0x2ed]
    Frame[16]  Triage Symbol: [WebKit!WebCore::FrameViewLayoutContext::layout+0x5bf]
    Frame[17]  Triage Symbol: [WebKit!WebCore::Document::implicitClose+0x35d]
    Frame[18]  Triage Symbol: [WebKit!WebCore::FrameLoader::checkCompleted+0x13f]
    Frame[19]  Triage Symbol: [WebKit!WebCore::CachedResourceLoader::loadDone+0x80]
    Frame[1a]  Triage Symbol: [WebKit!WebCore::SubresourceLoader::notifyDone+0x55]
    Frame[1b]  Triage Symbol: [WebKit!WebCore::SubresourceLoader::didFinishLoading+0xf0]
    Frame[1c]  Triage Symbol: [WebKit!WTF::Detail::CallableWrapper<<lambda_e7e2d454785dfeaf6199132ec807941c>,void>::call+0x7a]
    Frame[1d]  Triage Symbol: [WTF!WTF::RunLoop::performWork+0x23f]
    Frame[1e]  Ignore Symbol: [WTF!WTF::RunLoop::RunLoopWndProc+0x5c]
    Frame[1f]  Triage Symbol: [USER32!UserCallWinProcCheckWow+0x2f8]
    Frame[20]  Triage Symbol: [USER32!DispatchMessageWorker+0x249]
    Frame[21]  Triage Symbol: [DumpRenderTreeLib!runTest+0xb08]
    Frame[22]  Triage Symbol: [DumpRenderTreeLib!main+0x5d3]
    Frame[23]  Triage Symbol: [DumpRenderTree!main+0x880]
    Frame[24]  Triage Symbol: [DumpRenderTree!__scrt_common_main_seh+0x10c]
    Frame[25]  Triage Symbol: [KERNEL32!BaseThreadInitThunk+0x14]
    Frame[26]  Triage Symbol: [ntdll!RtlUserThreadStart+0x21]

js/dom/toInt32UInt32.html

    Frame[00]  Triage Symbol: [WTF!abort+0x35]
    Frame[01]  Triage Symbol: [WTF!WTF::fastMalloc+0x18]
    Frame[02]  Triage Symbol: [WebKit!WTF::Vector<WebCore::FloatQuad,0,WTF::CrashOnOverflow,16,WTF::FastMalloc>::expandCapacity<0>+0x5f]
    Frame[03]  Triage Symbol: [WebKit!WebCore::Layout::InlineTextItem::createAndAppendTextItems+0x673]
    Frame[04]  Triage Symbol: [WebKit!WebCore::Layout::InlineFormattingContext::collectContentIfNeeded+0x499]
    Frame[05]  Triage Symbol: [WebKit!WebCore::Layout::InlineFormattingContext::lineLayoutForIntergration+0x1d]
    Frame[06]  Triage Symbol: [WebKit!WebCore::LayoutIntegration::LineLayout::layout+0x147]
    Frame[07]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutModernLines+0x347]
    Frame[08]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlock+0x380]
    Frame[09]  Triage Symbol: [WebKit!WebCore::RenderBlock::layout+0x80]
    Frame[0a]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlockChild+0x292]
    Frame[0b]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlockChildren+0x508]
    Frame[0c]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlock+0x43f]
    Frame[0d]  Triage Symbol: [WebKit!WebCore::RenderBlock::layout+0x80]
    Frame[0e]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlockChild+0x292]
    Frame[0f]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlockChildren+0x508]
    Frame[10]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlock+0x43f]
    Frame[11]  Triage Symbol: [WebKit!WebCore::RenderBlock::layout+0x80]
    Frame[12]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlockChild+0x292]
    Frame[13]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlockChildren+0x508]
    Frame[14]  Triage Symbol: [WebKit!WebCore::RenderBlockFlow::layoutBlock+0x43f]
    Frame[15]  Triage Symbol: [WebKit!WebCore::RenderBlock::layout+0x80]
    Frame[16]  Triage Symbol: [WebKit!WebCore::RenderView::layout+0x2ed]
    Frame[17]  Triage Symbol: [WebKit!WebCore::FrameViewLayoutContext::layout+0x5bf]
    Frame[18]  Triage Symbol: [WebKit!WebCore::Document::implicitClose+0x35d]
    Frame[19]  Triage Symbol: [WebKit!WebCore::FrameLoader::checkCompleted+0x13f]
    Frame[1a]  Triage Symbol: [WebKit!WebCore::CachedResourceLoader::loadDone+0x80]
    Frame[1b]  Triage Symbol: [WebKit!WebCore::SubresourceLoader::notifyDone+0x55]
    Frame[1c]  Triage Symbol: [WebKit!WebCore::SubresourceLoader::didFinishLoading+0x163]
    Frame[1d]  Triage Symbol: [WebKit!<lambda_e7e2d454785dfeaf6199132ec807941c>::operator+0xec]
    Frame[1e]  Triage Symbol: [WTF!WTF::RunLoop::performWork+0x23f]
    Frame[1f]  Ignore Symbol: [WTF!WTF::RunLoop::RunLoopWndProc+0x5c]
    Frame[20]  Triage Symbol: [USER32!UserCallWinProcCheckWow+0x2f8]
    Frame[21]  Triage Symbol: [USER32!DispatchMessageWorker+0x249]
    Frame[22]  Triage Symbol: [DumpRenderTreeLib!runTest+0xb08]
    Frame[23]  Triage Symbol: [DumpRenderTreeLib!main+0x5d3]
    Frame[24]  Triage Symbol: [DumpRenderTree!main+0x880]
    Frame[25]  Triage Symbol: [DumpRenderTree!__scrt_common_main_seh+0x10c]
    Frame[26]  Triage Symbol: [KERNEL32!BaseThreadInitThunk+0x14]
    Frame[27]  Triage Symbol: [ntdll!RtlUserThreadStart+0x21]

Comment 5 Alexey Proskuryakov 2021-10-16 10:54:51 PDT

This needs to be split into multiple bugs. "

Comment 6 Per Arne Vollan 2021-10-18 15:28:36 PDT

I wonder if we're running out of memory, since fastMalloc is failing.

Comment 7 Simon Fraser (smfr) 2021-10-18 15:34:56 PDT

I have seen similar crashes in macOS EWS too.