Bug 268557

Summary:	[ iOS 17 Debug ] ASSERTION FAILED: containingBlock.isInFlowPositioned() on imported/w3c/web-platform-tests/html/dom/elements/global-attributes/the-anchor-attribute-003-crash.tentative.html
Product:	WebKit	Reporter:	Jay Stfleur <j_stfleur>
Component:	Layout and Rendering	Assignee:	Nobody <webkit-unassigned>
Status:	NEW
Severity:	Normal	CC:	ahmad.saleem792, bfulgham, simon.fraser, webkit-bot-watchers-bugzilla, webkit-bug-importer, zalan
Priority:	P2	Keywords:	InRadar
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified

Jay Stfleur

Reported 2024-02-01 09:28:11 PST

Description: imported/w3c/web-platform-tests/html/dom/elements/global-attributes/the-anchor-attribute-003-crash.tentative.html Is a constant crash History: https://results.webkit.org/?suite=layout-tests&test=imported%2Fw3c%2Fweb-platform-tests%2Fhtml%2Fdom%2Felements%2Fglobal-attributes%2Fthe-anchor-attribute-003-crash.tentative.html Diff/Image Diff/Crash Log: https://build.webkit.org/results/Apple-iOS-17-Simulator-Debug-WK2-Tests/273889@main%20(931)/imported/w3c/web-platform-tests/html/dom/elements/global-attributes/the-anchor-attribute-003-crash.tentative-crash-log.txt

Attachments
Add attachment proposed patch, testcase, etc.

Radar WebKit Bug Importer

Comment 1 2024-02-01 09:28:42 PST

<rdar://problem/122108986>

Jay Stfleur

Comment 2 2024-02-01 12:04:43 PST

Reproducibility: run-webkit-test --root imported/w3c/web-platform-tests/html/dom/elements/global-attributes/the-anchor-attribute-003-crash.tentative.html --child-process=1 --iterations 10

Jay Stfleur

Comment 3 2024-02-01 12:14:35 PST

Pull request: https://github.com/WebKit/WebKit/pull/23683

EWS

Comment 4 2024-02-01 16:33:42 PST

Test gardening commit 273957@main (3c8ea8c91f66): <https://commits.webkit.org/273957@main> Reviewed commits have been landed. Closing PR #23683 and removing active labels.

Alexey Proskuryakov

Comment 5 2024-02-05 09:52:07 PST

ASSERTION FAILED: containingBlock.isInFlowPositioned() /Volumes/Data/worker/Apple-iOS-17-Simulator-Debug-Build/build/Source/WebCore/rendering/RenderBox.cpp(3903) : LayoutUnit WebCore::RenderBox::containingBlockLogicalWidthForPositioned(const RenderBoxModelObject &, RenderFragmentContainer *, bool) const 1 0x104606ca4 WTFCrash 2 0x2ca45e150 WebCore::AudioWorkletProcessor::buildJSArguments(JSC::VM&, JSC::JSGlobalObject&, JSC::MarkedVector<JSC::JSValue, 8ul, WTF::RecordOverflow>&, WTF::Vector<WTF::RefPtr<WebCore::AudioBus, WTF::RawPtrTraits<WebCore::AudioBus>, WTF::DefaultRefDerefTraits<WebCore::AudioBus>>, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&, WTF::Vector<WTF::Ref<WebCore::AudioBus, WTF::RawPtrTraits<WebCore::AudioBus>, WTF::DefaultRefDerefTraits<WebCore::AudioBus>>, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&, WTF::HashMap<WTF::String, std::__1::unique_ptr<WebCore::AudioArray<float>, std::__1::default_delete<WebCore::AudioArray<float>>>, WTF::DefaultHash<WTF::String>, WTF::HashTraits<WTF::String>, WTF::HashTraits<std::__1::unique_ptr<WebCore::AudioArray<float>, std::__1::default_delete<WebCore::AudioArray<float>>>>, WTF::MemoryCompactLookupOnlyRobinHoodHashTableTraits> const&) 3 0x2cccaf6e4 WebCore::RenderBox::containingBlockLogicalWidthForPositioned(WebCore::RenderBoxModelObject const&, WebCore::RenderFragmentContainer*, bool) const 4 0x2ccca9530 WebCore::RenderBox::computePositionedLogicalWidth(WebCore::RenderBox::LogicalExtentComputedValues&, WebCore::RenderFragmentContainer*) const 5 0x2ccc687ac WebCore::RenderBox::computeLogicalWidthInFragment(WebCore::RenderBox::LogicalExtentComputedValues&, WebCore::RenderFragmentContainer*) const 6 0x2ccca93c8 WebCore::RenderBox::updateLogicalWidth() 7 0x2ccc667e0 WebCore::RenderBlock::recomputeLogicalWidth() 8 0x2ccc82220 WebCore::RenderBlockFlow::recomputeLogicalWidthAndColumnWidth() 9 0x2ccc82e08 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) 10 0x2ccc66528 WebCore::RenderBlock::layout() 11 0x2ccd11548 WebCore::RenderElement::layoutIfNeeded() 12 0x2ccc69744 WebCore::RenderBlock::layoutPositionedObject(WebCore::RenderBox&, bool, bool) 13 0x2ccc68418 WebCore::RenderBlock::layoutPositionedObjects(bool, bool) 14 0x2ccc83610 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) 15 0x2ccc66528 WebCore::RenderBlock::layout() 16 0x2ccc86b8c WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 17 0x2ccc85e54 WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) 18 0x2ccc84120 WebCore::RenderBlockFlow::layoutInFlowChildren(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 19 0x2ccc83048 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) 20 0x2ccc66528 WebCore::RenderBlock::layout() 21 0x2ccc86b8c WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 22 0x2ccc85e54 WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) 23 0x2ccc84120 WebCore::RenderBlockFlow::layoutInFlowChildren(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 24 0x2ccc83048 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) 25 0x2ccc66528 WebCore::RenderBlock::layout() 26 0x2ccef9d98 WebCore::RenderView::layout() 27 0x2cc14bb90 WebCore::LocalFrameViewLayoutContext::performLayout() 28 0x2cc129f6c WebCore::LocalFrameViewLayoutContext::layout() 29 0x2cb17fce8 WebCore::Document::implicitClose() 30 0x2cbec2210 WebCore::FrameLoader::checkCallImplicitClose() 31 0x2cbec1b64 WebCore::FrameLoader::checkCompleted()

Ahmad Saleem

Comment 6 2024-02-05 09:56:24 PST

(In reply to Alexey Proskuryakov from comment #5) > ASSERTION FAILED: containingBlock.isInFlowPositioned() > /Volumes/Data/worker/Apple-iOS-17-Simulator-Debug-Build/build/Source/WebCore/ > rendering/RenderBox.cpp(3903) : LayoutUnit > WebCore::RenderBox::containingBlockLogicalWidthForPositioned(const > RenderBoxModelObject &, RenderFragmentContainer *, bool) const > 1 0x104606ca4 WTFCrash > 2 0x2ca45e150 WebCore::AudioWorkletProcessor::buildJSArguments(JSC::VM&, > JSC::JSGlobalObject&, JSC::MarkedVector<JSC::JSValue, 8ul, > WTF::RecordOverflow>&, WTF::Vector<WTF::RefPtr<WebCore::AudioBus, > WTF::RawPtrTraits<WebCore::AudioBus>, > WTF::DefaultRefDerefTraits<WebCore::AudioBus>>, 0ul, WTF::CrashOnOverflow, > 16ul, WTF::FastMalloc> const&, WTF::Vector<WTF::Ref<WebCore::AudioBus, > WTF::RawPtrTraits<WebCore::AudioBus>, > WTF::DefaultRefDerefTraits<WebCore::AudioBus>>, 0ul, WTF::CrashOnOverflow, > 16ul, WTF::FastMalloc>&, WTF::HashMap<WTF::String, > std::__1::unique_ptr<WebCore::AudioArray<float>, > std::__1::default_delete<WebCore::AudioArray<float>>>, > WTF::DefaultHash<WTF::String>, WTF::HashTraits<WTF::String>, > WTF::HashTraits<std::__1::unique_ptr<WebCore::AudioArray<float>, > std::__1::default_delete<WebCore::AudioArray<float>>>>, > WTF::MemoryCompactLookupOnlyRobinHoodHashTableTraits> const&) > 3 0x2cccaf6e4 > WebCore::RenderBox::containingBlockLogicalWidthForPositioned(WebCore:: > RenderBoxModelObject const&, WebCore::RenderFragmentContainer*, bool) const > 4 0x2ccca9530 > WebCore::RenderBox::computePositionedLogicalWidth(WebCore::RenderBox:: > LogicalExtentComputedValues&, WebCore::RenderFragmentContainer*) const > 5 0x2ccc687ac > WebCore::RenderBox::computeLogicalWidthInFragment(WebCore::RenderBox:: > LogicalExtentComputedValues&, WebCore::RenderFragmentContainer*) const > 6 0x2ccca93c8 WebCore::RenderBox::updateLogicalWidth() > 7 0x2ccc667e0 WebCore::RenderBlock::recomputeLogicalWidth() > 8 0x2ccc82220 > WebCore::RenderBlockFlow::recomputeLogicalWidthAndColumnWidth() > 9 0x2ccc82e08 WebCore::RenderBlockFlow::layoutBlock(bool, > WebCore::LayoutUnit) > 10 0x2ccc66528 WebCore::RenderBlock::layout() > 11 0x2ccd11548 WebCore::RenderElement::layoutIfNeeded() > 12 0x2ccc69744 > WebCore::RenderBlock::layoutPositionedObject(WebCore::RenderBox&, bool, bool) > 13 0x2ccc68418 WebCore::RenderBlock::layoutPositionedObjects(bool, bool) > 14 0x2ccc83610 WebCore::RenderBlockFlow::layoutBlock(bool, > WebCore::LayoutUnit) > 15 0x2ccc66528 WebCore::RenderBlock::layout() > 16 0x2ccc86b8c > WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, > WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, > WebCore::LayoutUnit&) > 17 0x2ccc85e54 WebCore::RenderBlockFlow::layoutBlockChildren(bool, > WebCore::LayoutUnit&) > 18 0x2ccc84120 WebCore::RenderBlockFlow::layoutInFlowChildren(bool, > WebCore::LayoutUnit&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) > 19 0x2ccc83048 WebCore::RenderBlockFlow::layoutBlock(bool, > WebCore::LayoutUnit) > 20 0x2ccc66528 WebCore::RenderBlock::layout() > 21 0x2ccc86b8c > WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, > WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, > WebCore::LayoutUnit&) > 22 0x2ccc85e54 WebCore::RenderBlockFlow::layoutBlockChildren(bool, > WebCore::LayoutUnit&) > 23 0x2ccc84120 WebCore::RenderBlockFlow::layoutInFlowChildren(bool, > WebCore::LayoutUnit&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) > 24 0x2ccc83048 WebCore::RenderBlockFlow::layoutBlock(bool, > WebCore::LayoutUnit) > 25 0x2ccc66528 WebCore::RenderBlock::layout() > 26 0x2ccef9d98 WebCore::RenderView::layout() > 27 0x2cc14bb90 WebCore::LocalFrameViewLayoutContext::performLayout() > 28 0x2cc129f6c WebCore::LocalFrameViewLayoutContext::layout() > 29 0x2cb17fce8 WebCore::Document::implicitClose() > 30 0x2cbec2210 WebCore::FrameLoader::checkCallImplicitClose() > 31 0x2cbec1b64 WebCore::FrameLoader::checkCompleted() Just fixed by Alan in commit: https://github.com/WebKit/WebKit/commit/8e1707f9911a65f4e5090c7252654684455f9a9a

EWS

Comment 7 2024-04-26 16:38:22 PDT

Test gardening commit 278065@main (5859cb6b941d): <https://commits.webkit.org/278065@main> Reviewed commits have been landed. Closing PR #27822 and removing active labels.

Note You need to log in before you can comment on or make changes to this bug.