REGRESSION(264701@main): wpt/css/CSS2/normal-flow/crashtests/block-in-inline-ax-crash.html

• Component: WebCore Misc.
• Status: NEW ---

[Sam Sneddon [:gsnedders]]

c.f. https://wpt.fyi/results/css/CSS2/normal-flow/crashtests/block-in-inline-ax-crash.html?run_id=5081514008641536&run_id=5202434048131072&run_id=5082008735186944&run_id=5125781984903168&run_id=5071490779709440

[Radar WebKit Bug Importer]

<rdar://problem/110839883>

[Chris Dumez]

This is a crash test, not a correctness test.

264701@main aligned our behavior with Firefox when it comes to timer ordering (Chrome still has the bug). As a result, it is a little surprising Firefox is passing this crash test and we're not. I looked into it and Chrome & Firefox's output is very different. Chrome runs the whole test without JS exception and produces a large output. Firefox produces a much smaller output because they throw exceptions.

We have Firefox's timer ordering but don't end up throwing exception. As a result, the test ends up in an infinite loop and the WebProcess hangs.

I wouldn't say this is a true regression given that this isn't a correctness and given that our new timer ordering is correct.

[Chris Dumez]

Exceptions thrown by Firefox:
```
Uncaught TypeError: oRange is null
    event_handler_ECA_DOMCharacterDataModified http://wpt.live/css/CSS2/normal-flow/crashtests/block-in-inline-ax-crash.html:50
    event_handler_EC9_load http://wpt.live/css/CSS2/normal-flow/crashtests/block-in-inline-ax-crash.html:20
block-in-inline-ax-crash.html:50:25
Uncaught TypeError: oRange is null
    event_handler_EC9_load http://wpt.live/css/CSS2/normal-flow/crashtests/block-in-inline-ax-crash.html:31
block-in-inline-ax-crash.html:31:1
Uncaught DOMException: Node.insertBefore: The new child is an ancestor of the parent
    <anonymous> http://wpt.live/css/CSS2/normal-flow/crashtests/block-in-inline-ax-crash.html:127
block-in-inline-ax-crash.html:127
```