Bug 270014

Summary:	REGRESSION (275227@main): [ macOS wk2 Debug ] ASSERTION FAILED fixedPositionContainerLayer result of 5 tests in imported/w3c/web-platform-tests/css/css-view-transitions to flaky crash or constant failure
Product:	WebKit	Reporter:	Marta Darbinyan <darbinyan>
Component:	New Bugs	Assignee:	Matt Woodrow <mattwoodrow>
Status:	RESOLVED FIXED
Severity:	Normal	CC:	fujii.hironori, webkit-bot-watchers-bugzilla, webkit-bug-importer
Priority:	P2	Keywords:	InRadar
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified
See Also:	https://bugs.webkit.org/show_bug.cgi?id=269863 https://bugs.webkit.org/show_bug.cgi?id=269996

Marta Darbinyan

Reported 2024-02-23 14:49:28 PST

Description: Flaky Crash imported/w3c/web-platform-tests/css/css-view-transitions/massive-element-below-viewport-offscreen-new.html imported/w3c/web-platform-tests/css/css-view-transitions/massive-element-below-viewport-offscreen-old.html imported/w3c/web-platform-tests/css/css-view-transitions/massive-element-right-of-viewport-offscreen-new.html imported/w3c/web-platform-tests/css/css-view-transitions/massive-element-right-of-viewport-offscreen-old.html imported/w3c/web-platform-tests/css/css-view-transitions/offscreen-element-modified-before-coming-onscreen.html Failure imported/w3c/web-platform-tests/css/css-view-transitions/pseudo-rendering-invalidation.html The test are flaky crashing or constant failing on macOS Debug w2 after 275227@main. History: https://results.webkit.org/?suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&test=imported%2Fw3c%2Fweb-platform-tests%2Fcss%2Fcss-view-transitions%2Fmassive-element-below-viewport-offscreen-new.html&test=imported%2Fw3c%2Fweb-platform-tests%2Fcss%2Fcss-view-transitions%2Fmassive-element-below-viewport-offscreen-old.html&test=imported%2Fw3c%2Fweb-platform-tests%2Fcss%2Fcss-view-transitions%2Fmassive-element-right-of-viewport-offscreen-new.html&test=imported%2Fw3c%2Fweb-platform-tests%2Fcss%2Fcss-view-transitions%2Fmassive-element-right-of-viewport-offscreen-old.html&test=imported%2Fw3c%2Fweb-platform-tests%2Fcss%2Fcss-view-transitions%2Foffscreen-element-modified-before-coming-onscreen.html&test=imported%2Fw3c%2Fweb-platform-tests%2Fcss%2Fcss-view-transitions%2Fpseudo-rendering-invalidation.html&style=debug Crash Log: stderr: ASSERTION FAILED: fixedPositionContainerLayer rendering/RenderLayer.cpp(2391) : const WebCore::RenderLayer *WebCore::accumulateOffsetTowardsAncestor(const WebCore::RenderLayer *, const WebCore::RenderLayer *, WebCore::LayoutPoint &, RenderLayer::ColumnOffsetAdjustment) 1 0x1045ef8e8 WTFCrash 2 0x2df8ea030 WebCore::NetworkResourcesData::ResourceData::hasContent() const 3 0x2e10cef6c WebCore::accumulateOffsetTowardsAncestor(WebCore::RenderLayer const*, WebCore::RenderLayer const*, WebCore::LayoutPoint&, WebCore::RenderLayer::ColumnOffsetAdjustment) 4 0x2e10cec3c WebCore::RenderLayer::convertToLayerCoords(WebCore::RenderLayer const*, WebCore::LayoutPoint const&, WebCore::RenderLayer::ColumnOffsetAdjustment) const 5 0x2e10c937c WebCore::RenderLayer::offsetFromAncestor(WebCore::RenderLayer const*, WebCore::RenderLayer::ColumnOffsetAdjustment) const 6 0x2e111ae64 WebCore::RenderLayerCompositor::repaintInCompositedAncestor(WebCore::RenderLayer&, WebCore::LayoutRect const&) 7 0x2e112f3bc WebCore::RenderLayerCompositor::layerWillBeRemoved(WebCore::RenderLayer&, WebCore::RenderLayer&) 8 0x2e10c5780 WebCore::RenderLayer::removeChild(WebCore::RenderLayer&) 9 0x2e103b0e0 WebCore::RenderElement::removeLayers() 10 0x2e103e440 WebCore::RenderElement::willBeRemovedFromTree(WebCore::RenderObject::IsInternalMove) 11 0x2e113bc18 WebCore::RenderLayerModelObject::willBeRemovedFromTree(WebCore::RenderObject::IsInternalMove) 12 0x2e0fbffbc WebCore::RenderBox::willBeRemovedFromTree(WebCore::RenderObject::IsInternalMove) 13 0x2e14f8f50 WebCore::RenderTreeBuilder::detachFromRenderElement(WebCore::RenderElement&, WebCore::RenderObject&, WebCore::RenderTreeBuilder::WillBeDestroyed) 14 0x2e14f856c WebCore::RenderTreeBuilder::Block::detach(WebCore::RenderBlock&, WebCore::RenderObject&, WebCore::RenderTreeBuilder::CanCollapseAnonymousBlock) 15 0x2e14f8434 WebCore::RenderTreeBuilder::Block::detach(WebCore::RenderBlockFlow&, WebCore::RenderObject&, WebCore::RenderTreeBuilder::CanCollapseAnonymousBlock) 16 0x2e14f58ac WebCore::RenderTreeBuilder::detach(WebCore::RenderElement&, WebCore::RenderObject&, WebCore::RenderTreeBuilder::CanCollapseAnonymousBlock) 17 0x2e14f5528 WebCore::RenderTreeBuilder::destroy(WebCore::RenderObject&, WebCore::RenderTreeBuilder::CanCollapseAnonymousBlock) 18 0x2e14f5604 WebCore::RenderTreeBuilder::destroy(WebCore::RenderObject&, WebCore::RenderTreeBuilder::CanCollapseAnonymousBlock) 19 0x2e1524c2c WebCore::RenderTreeUpdater::ViewTransition::updatePseudoElementTree(WebCore::RenderElement&)::$_11::operator()() const 20 0x2e1521a5c WebCore::RenderTreeUpdater::ViewTransition::updatePseudoElementTree(WebCore::RenderElement&) 21 0x2e15211c0 WebCore::RenderTreeUpdater::updateAfterDescendants(WebCore::Element&, WebCore::Style::ElementUpdate const*) 22 0x2e15210cc WebCore::RenderTreeUpdater::popParent() 23 0x2e15204e8 WebCore::RenderTreeUpdater::popParentsToDepth(unsigned int) 24 0x2e151fddc WebCore::RenderTreeUpdater::updateRenderTree(WebCore::ContainerNode&) 25 0x2e151f5b4 WebCore::RenderTreeUpdater::commit(std::__1::unique_ptr<WebCore::Style::Update, std::__1::default_delete<WebCore::Style::Update> >) 26 0x2decd7ac4 WebCore::Document::updateRenderTree(std::__1::unique_ptr<WebCore::Style::Update, std::__1::default_delete<WebCore::Style::Update> >) 27 0x2decd819c WebCore::Document::resolveStyle(WebCore::Document::ResolveStyleType) 28 0x2decd8dec WebCore::Document::updateStyleIfNeeded() 29 0x2de83a0f8 WebCore::ComputedStyleExtractor::updateStyleIfNeededForProperty(WebCore::Element&, WebCore::CSSPropertyID) 30 0x2de839c04 WebCore::ComputedStyleExtractor::propertyValue(WebCore::CSSPropertyID, WebCore::ComputedStyleExtractor::UpdateLayout, WebCore::ComputedStyleExtractor::PropertyValueType) const 31 0x2de883c44 std::__1::optional<WebCore::CSSProperty> WebCore::ComputedStyleExtractor::copyProperties(std::__1::span<WebCore::CSSPropertyID const, 18446744073709551615ul>) const::$_17::operator()<WebCore::CSSPropertyID const>(WebCore::CSSPropertyID const&) const com.apple.WebKit.WebContent.Development terminated (pid 76716) for reason: crash LEAK: 1 WebPageProxy Link: https://build.webkit.org/results/Apple-Monterey-Debug-AppleSilicon-WK2-Tests/275249@main%20(8262)/imported/w3c/web-platform-tests/css/css-view-transitions/massive-element-below-viewport-offscreen-new-crash-log.txt

Attachments
Add attachment proposed patch, testcase, etc.

Radar WebKit Bug Importer

Comment 1 2024-02-23 14:51:16 PST

<rdar://problem/123530456>

EWS

Comment 2 2024-02-23 15:48:09 PST

Test gardening commit 275261@main (9df0e928b75b): <https://commits.webkit.org/275261@main> Reviewed commits have been landed. Closing PR #25041 and removing active labels.

Matt Woodrow

Comment 3 2024-02-27 17:26:36 PST

Pull request: https://github.com/WebKit/WebKit/pull/25206

EWS

Comment 4 2024-02-27 19:47:37 PST

Committed 275420@main (4c582037a107): <https://commits.webkit.org/275420@main> Reviewed commits have been landed. Closing PR #25206 and removing active labels.

Note You need to log in before you can comment on or make changes to this bug.