Bug 254030

Summary:	REGRESSION (261623@main?): [ iOS, macOS Debug ] ASSERTION FAILED: !isCalculated() in WebCore::Length::value()
Product:	WebKit	Reporter:	Bri Harris <bharris9>
Component:	New Bugs	Assignee:	Nobody <webkit-unassigned>
Status:	RESOLVED DUPLICATE
Severity:	Normal	CC:	ahmad.saleem792, webkit-bot-watchers-bugzilla, webkit-bug-importer, zalan
Priority:	P2	Keywords:	InRadar
Version:	Other
Hardware:	Unspecified
OS:	Unspecified

Bri Harris

Reported 2023-03-16 10:09:49 PDT

fast/table/calculated-width-on-col-within-colgroup.html is a constant crash on iOS and macOS Debug only. HISTORY: https://results.webkit.org/?suite=layout-tests&test=fast%2Ftable%2Fcalculated-width-on-col-within-colgroup.html Crash Log Text: ASSERTION FAILED: !isCalculated() /Volumes/Data/worker/macOS-AppleSilicon-Ventura-Debug-Build-EWS/build/Source/WebCore/platform/Length.h(341) : float WebCore::Length::value() const 1 0x13a89f2b0 WTFCrash 2 0x28065d6a0 WebCore::JSANGLEInstancedArrays::createPrototype(JSC::VM&, WebCore::JSDOMGlobalObject&) 3 0x28218076c WebCore::Length::value() const 4 0x2857fc288 WebCore::AutoTableLayout::recalcColumn(unsigned int) 5 0x2857fd304 WebCore::AutoTableLayout::fullRecalc() 6 0x2857fd528 WebCore::AutoTableLayout::computeIntrinsicLogicalWidths(WebCore::LayoutUnit&, WebCore::LayoutUnit&, WebCore::TableIntrinsics) 7 0x285b72314 WebCore::RenderTable::computeIntrinsicLogicalWidths(WebCore::LayoutUnit&, WebCore::LayoutUnit&, WebCore::TableIntrinsics) const 8 0x285b7234c WebCore::RenderTable::computeIntrinsicLogicalWidths(WebCore::LayoutUnit&, WebCore::LayoutUnit&) const 9 0x285b72418 WebCore::RenderTable::computePreferredLogicalWidths() 10 0x2859834b8 WebCore::RenderBox::maxPreferredLogicalWidth() const 11 0x285b6dd2c WebCore::RenderTable::updateLogicalWidth() 12 0x285b6f3cc WebCore::RenderTable::layout() 13 0x285920518 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 14 0x28591f9f8 WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) 15 0x28591e3c8 WebCore::RenderBlockFlow::layoutInFlowChildren(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 16 0x28591d774 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) 17 0x285906578 WebCore::RenderBlock::layout() 18 0x285920518 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 19 0x28591f9f8 WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) 20 0x28591e3c8 WebCore::RenderBlockFlow::layoutInFlowChildren(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 21 0x28591d774 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) 22 0x285906578 WebCore::RenderBlock::layout() 23 0x285920518 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 24 0x28591f9f8 WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) 25 0x28591e3c8 WebCore::RenderBlockFlow::layoutInFlowChildren(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 26 0x28591d774 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) 27 0x285906578 WebCore::RenderBlock::layout() 28 0x285be8d40 WebCore::RenderView::layout() 29 0x284c7f140 WebCore::FrameViewLayoutContext::performLayout() 30 0x284c7ea54 WebCore::FrameViewLayoutContext::layout() 31 0x283bbd624 WebCore::Document::updateLayout() com.apple.WebKit.WebContent.Development terminated (pid 2071) for reason: crash LEAK: 1 WebPageProxy

Attachments
Add attachment proposed patch, testcase, etc.

Bri Harris

Comment 1 2023-03-16 10:10:59 PDT

I was able to replicate this crash on Ventura ToT and iOS 16 ToT as follows: run-webkit-tests --root fast/table/calculated-width-on-col-within-colgroup.html --force

Radar WebKit Bug Importer

Comment 2 2023-03-16 10:11:18 PDT

<rdar://problem/106813623>

EWS

Comment 3 2023-03-16 11:03:52 PDT

Test gardening commit 261754@main (b56022040d48): <https://commits.webkit.org/261754@main> Reviewed commits have been landed. Closing PR #11615 and removing active labels.

Ryan Haddad

Comment 4 2023-03-17 10:01:36 PDT

This test was added with https://commits.webkit.org/261623@main, the test has been asserting from the start.

Ryan Haddad

Comment 5 2023-03-17 10:01:45 PDT

*** Bug 254034 has been marked as a duplicate of this bug. ***

Ryan Haddad

Comment 6 2023-03-17 10:03:36 PDT

Duping the other way. *** This bug has been marked as a duplicate of bug 254034 ***

Note You need to log in before you can comment on or make changes to this bug.