Bug 259342 – REGRESSION(265506@Main): [ Monterey+ Release ] fast/layoutformattingcontext (Layout-Tests) are a constant crash

• Component: Layout and Rendering
• Status: REOPENED

[Robert Jenner]

The following 10 fast/layoutformattingcontext layout-tests are constant crashes on Release for Monterey and higher:

fast/layoutformattingcontext/fit-content-width-simple.html
fast/layoutformattingcontext/inline-text-outside-of-inline-container-simple.html
fast/layoutformattingcontext/line-heigt-when-text-is-inside-inline-container.html
fast/layoutformattingcontext/table-basic-row-baseline-align.html
fast/layoutformattingcontext/table-basic-row-vertical-align-baseline.html
fast/layoutformattingcontext/table-cell-baseline-offset-simple.html
fast/layoutformattingcontext/table-cell-baseline-offset-simple2.html
fast/layoutformattingcontext/table-cell-vertical-alignment-simple.html
fast/layoutformattingcontext/table-with-margin-content-simple.html
fast/layoutformattingcontext/vertical-align-middle-simple.html

HISTORY:
https://results.webkit.org/?suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&test=fast%2Flayoutformattingcontext%2Ffit-content-width-simple.html&test=fast%2Flayoutformattingcontext%2Finline-text-outside-of-inline-container-simple.html&test=fast%2Flayoutformattingcontext%2Fline-heigt-when-text-is-inside-inline-container.html&test=fast%2Flayoutformattingcontext%2Ftable-basic-row-baseline-align.html&test=fast%2Flayoutformattingcontext%2Ftable-basic-row-vertical-align-baseline.html&test=fast%2Flayoutformattingcontext%2Ftable-cell-baseline-offset-simple.html&test=fast%2Flayoutformattingcontext%2Ftable-cell-baseline-offset-simple2.html&test=fast%2Flayoutformattingcontext%2Ftable-cell-vertical-alignment-simple.html&test=fast%2Flayoutformattingcontext%2Ftable-with-margin-content-simple.html&test=fast%2Flayoutformattingcontext%2Fvertical-align-middle-simple.html

There is no crash log that appears to have been collected. The following is the stdout from these tests:

STDOUT TEXT:
No crash log found for com.apple.WebKit.WebContent.Development:39354.

stdout:

stderr:
com.apple.WebKit.WebContent.Development terminated (pid 39354) for reason: crash


https://build.webkit.org/results/Apple-Ventura-Release-WK2-Tests/266158@main%20(2948)/fast/layoutformattingcontext/fit-content-width-simple-crash-log.txt

[Robert Jenner]

These tests all appear to have a pretty clear cut regression point as well. All starting at crashing at: https://commits.webkit.org/265506@main

[Radar WebKit Bug Importer]

<rdar://problem/112540099>

[Robert Jenner]

I was also able reproduce the crash at Ventura Release ToT running the test as follows:

Run-webkit-tests <test_goes_here>

Here is the crashed thread from my local repo case:

Thread 0 Crashed::  Dispatch queue: com.apple.main-thread
0   WebCore                       	       0x10f129d14 WebCore::Layout::LineBuilder::inlineItemWidth(WebCore::Layout::InlineItem const&, float) const + 380
1   WebCore                       	       0x10f12be98 WebCore::Layout::LineBuilder::placeInlineAndFloatContent(WebCore::Layout::InlineItemRange const&) + 4292
2   WebCore                       	       0x10f12a0c4 WebCore::Layout::LineBuilder::layoutInlineContent(WebCore::Layout::LineBuilder::LineInput const&, std::__1::optional<WebCore::Layout::PreviousLine> const&) + 136
3   WebCore                       	       0x10f11b778 WebCore::Layout::InlineFormattingContext::computedIntrinsicWidthForConstraint(WebCore::Layout::IntrinsicWidthMode) const + 496
4   WebCore                       	       0x10f11b4cc WebCore::Layout::InlineFormattingContext::computedIntrinsicWidthConstraints() + 116
5   WebCore                       	       0x10f0ffe18 WebCore::Layout::FormattingGeometry::computedWidthValue(WebCore::Layout::Box const&, WebCore::Layout::FormattingGeometry::WidthType, WebCore::LayoutUnit) const + 1280
6   WebCore                       	       0x10f100098 WebCore::Layout::FormattingGeometry::computedWidth(WebCore::Layout::Box const&, WebCore::LayoutUnit) const + 36
7   WebCore                       	       0x10f10a01c WebCore::Layout::BlockFormattingGeometry::inFlowNonReplacedContentWidthAndMargin(WebCore::Layout::ElementBox const&, WebCore::Layout::HorizontalConstraints const&, WebCore::Layout::OverriddenHorizontalValues const&) const + 272
8   WebCore                       	       0x10f10ad28 auto WebCore::Layout::BlockFormattingGeometry::computedContentWidthAndMargin(WebCore::Layout::ElementBox const&, WebCore::Layout::HorizontalConstraints const&, std::__1::optional<WebCore::LayoutUnit>) const::$_17::operator()<WebCore::Layout::HorizontalConstraints>(WebCore::Layout::HorizontalConstraints, std::__1::optional<WebCore::LayoutUnit>) const + 440
9   WebCore                       	       0x10f105fc4 WebCore::Layout::BlockFormattingContext::layoutInFlowContent(WebCore::Layout::ConstraintsForInFlowContent const&) + 1620
10  WebCore                       	       0x10f0f76cc WebCore::Layout::LayoutContext::layout(WebCore::LayoutSize const&) + 556
11  WebCore                       	       0x10f2c9b88 WebCore::LocalFrameViewLayoutContext::performLayout() + 2592
12  WebCore                       	       0x10f2acc34 WebCore::LocalFrameViewLayoutContext::layout() + 44
13  WebCore                       	       0x10d611d80 WebCore::Document::implicitClose() + 772
14  WebCore                       	       0x10d6118ec WebCore::FrameLoader::checkCompleted() + 312
15  WebCore                       	       0x10d6109b0 WebCore::FrameLoader::finishedParsing() + 340
16  WebCore                       	       0x10d60fbec WebCore::Document::finishedParsing() + 612
17  WebCore                       	       0x10d6094e4 WebCore::HTMLDocumentParser::prepareToStopParsing() + 256
18  WebCore                       	       0x10d6091b0 WebCore::HTMLDocumentParser::finish() + 236
19  WebCore                       	       0x10d608ddc WebCore::DocumentWriter::end() + 148
20  WebCore                       	       0x10f175748 WebCore::DocumentLoader::finishedLoading() + 308
21  WebCore                       	       0x10f2232a8 WebCore::CachedResource::checkNotify(WebCore::NetworkLoadMetrics const&) + 404
22  WebCore                       	       0x10f220fd8 WebCore::CachedRawResource::finishLoading(WebCore::FragmentedSharedBuffer const*, WebCore::NetworkLoadMetrics const&) + 360
23  WebCore                       	       0x10f1e9820 WebCore::SubresourceLoader::didFinishLoading(WebCore::NetworkLoadMetrics const&) + 692
24  WebKit                        	       0x1042ed700 WebKit::WebResourceLoader::didFinishResourceLoad(WebCore::NetworkLoadMetrics&&) + 232
25  WebKit                        	       0x1044be810 WebKit::WebResourceLoader::didReceiveWebResourceLoaderMessage(IPC::Connection&, IPC::Decoder&) + 748
26  WebKit                        	       0x1044f1460 IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder>>) + 332
27  WebKit                        	       0x1044f3ef4 WTF::Detail::CallableWrapper<IPC::Connection::enqueueIncomingMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder>>)::$_15, void>::call() + 148
28  JavaScriptCore                	       0x101575360 WTF::RunLoop::performWork() + 200
29  JavaScriptCore                	       0x10157622c WTF::RunLoop::performWork(void*) + 36
30  CoreFoundation                	       0x18e38e63c __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 28
31  CoreFoundation                	       0x18e38e5d0 __CFRunLoopDoSource0 + 176
32  CoreFoundation                	       0x18e38e340 __CFRunLoopDoSources0 + 244
33  CoreFoundation                	       0x18e38cf48 __CFRunLoopRun + 828
34  CoreFoundation                	       0x18e38c4b8 CFRunLoopRunSpecific + 612
35  Foundation                    	       0x18f305fcc -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 212
36  Foundation                    	       0x18f37eccc -[NSRunLoop(NSRunLoop) run] + 64
37  libxpc.dylib                  	       0x18dffe594 _xpc_objc_main + 860
38  libxpc.dylib                  	       0x18dffdeb4 xpc_main + 108
39  WebKit                        	       0x103cd2d34 WebKit::XPCServiceMain(int, char const**) + 248
40  dyld                          	       0x18df57f28 start + 2236

[Robert Jenner]

I have also confirmed that 265506@main is what introduced this. These all start crashing when testing at 265506@main. They were not crashing at 265505@main. 

Starting on Alan who introduced: https://commits.webkit.org/265506@main that caused these tests to start crashing constantly.

[EWS]

Test gardening commit 266181@main (3b4b5509d96e): <https://commits.webkit.org/266181@main>

Reviewed commits have been landed. Closing PR #15948 and removing active labels.

[zalan]

Thank you for taking care of this.

[EWS]

Test gardening commit 266670@main (7e928333021b): <https://commits.webkit.org/266670@main>

Reviewed commits have been landed. Closing PR #16458 and removing active labels.

[Robert Jenner]

Re-opening for pull request https://github.com/apple/WebKit/pull/770

[EWS]

Test gardening commit 265870.556@safari-7616-branch (e28e46dcc8a9): <https://commits.webkit.org/265870.556@safari-7616-branch>

Reviewed commits have been landed. Closing PR #770 and removing active labels.