Bug 272288

Summary:	Regression(276859@main): Crashes in ~GlyphDisplayListCacheEntry() on the bots
Product:	WebKit	Reporter:	Chris Dumez <cdumez>
Component:	Text	Assignee:	Chris Dumez <cdumez>
Status:	RESOLVED FIXED
Severity:	Normal	CC:	fantasai.bugs, vitor.roriz, webkit-bug-importer
Priority:	P2	Keywords:	InRadar
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified

Chris Dumez

Reported 2024-04-06 17:26:41 PDT

We see crashes in ~GlyphDisplayListCacheEntry() on the bots and on https://brutalisthackernews.com/top since 276859@main: ``` Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 WebCore 0x329da10b4 WTFCrashWithInfo(int, char const*, char const*, int) + 132 (Assertions.h:851) 1 WebCore 0x32c440e98 WTF::WeakRef<WebCore::GlyphDisplayListCacheEntry, WTF::SingleThreadWeakPtrImpl>::get() const + 136 (WeakRef.h:87) 2 WebCore 0x32c441f78 WebCore::GlyphDisplayListCacheKeyTranslator::equal(WTF::WeakRef<WebCore::GlyphDisplayListCacheEntry, WTF::SingleThreadWeakPtrImpl> const&, WebCore::GlyphDisplayListCacheKey const&) + 32 (GlyphDisplayListCache.cpp:54) 3 WebCore 0x32c4416c8 bool WTF::HashSetTranslatorAdapter<WebCore::GlyphDisplayListCacheKeyTranslator>::equal<WTF::WeakRef<WebCore::GlyphDisplayListCacheEntry, WTF::SingleThreadWeakPtrImpl>, WebCore::GlyphDisplayListCacheKey>(WTF::WeakRef<WebCore::GlyphDisplayListCacheEntry, WTF::SingleThreadWeakPtrImpl> const&, WebCore::GlyphDisplayListCacheKey const&) + 36 (HashSet.h:213) 4 WebCore 0x32c4414dc WTF::WeakRef<WebCore::GlyphDisplayListCacheEntry, WTF::SingleThreadWeakPtrImpl>* WTF::HashTable<WTF::WeakRef<WebCore::GlyphDisplayListCacheEntry, WTF::SingleThreadWeakPtrImpl>, WTF::WeakRef<WebCore::GlyphDisplayListCacheEntry, WTF::SingleThreadWeakPtrImpl>, WTF::IdentityExtractor, WTF::DefaultHash<WTF::WeakRef<WebCore::GlyphDisplayListCacheEntry, WTF::SingleThreadWeakPtrImpl>>, WTF::HashTraits<WTF::WeakRef<WebCore::GlyphDisplayListCacheEntry, WTF::SingleThreadWeakPtrImpl>>, WTF::HashTraits<WTF::WeakRef<WebCore::GlyphDisplayListCacheEntry, WTF::SingleThreadWeakPtrImpl>>>::inlineLookup<WTF::HashSetTranslatorAdapter<WebCore::GlyphDisplayListCacheKeyTranslator>, WebCore::GlyphDisplayListCacheKey>(WebCore::GlyphDisplayListCacheKey const&) + 224 (HashTable.h:704) 5 WebCore 0x32c441338 WTF::WeakRef<WebCore::GlyphDisplayListCacheEntry, WTF::SingleThreadWeakPtrImpl>* WTF::HashTable<WTF::WeakRef<WebCore::GlyphDisplayListCacheEntry, WTF::SingleThreadWeakPtrImpl>, WTF::WeakRef<WebCore::GlyphDisplayListCacheEntry, WTF::SingleThreadWeakPtrImpl>, WTF::IdentityExtractor, WTF::DefaultHash<WTF::WeakRef<WebCore::GlyphDisplayListCacheEntry, WTF::SingleThreadWeakPtrImpl>>, WTF::HashTraits<WTF::WeakRef<WebCore::GlyphDisplayListCacheEntry, WTF::SingleThreadWeakPtrImpl>>, WTF::HashTraits<WTF::WeakRef<WebCore::GlyphDisplayListCacheEntry, WTF::SingleThreadWeakPtrImpl>>>::lookup<WTF::HashSetTranslatorAdapter<WebCore::GlyphDisplayListCacheKeyTranslator>, WebCore::GlyphDisplayListCacheKey>(WebCore::GlyphDisplayListCacheKey const&) + 36 (HashTable.h:663) 6 WebCore 0x32c441210 WTF::HashTableConstIterator<WTF::HashTable<WTF::WeakRef<WebCore::GlyphDisplayListCacheEntry, WTF::SingleThreadWeakPtrImpl>, WTF::WeakRef<WebCore::GlyphDisplayListCacheEntry, WTF::SingleThreadWeakPtrImpl>, WTF::IdentityExtractor, WTF::DefaultHash<WTF::WeakRef<WebCore::GlyphDisplayListCacheEntry, WTF::SingleThreadWeakPtrImpl>>, WTF::HashTraits<WTF::WeakRef<WebCore::GlyphDisplayListCacheEntry, WTF::SingleThreadWeakPtrImpl>>, WTF::HashTraits<WTF::WeakRef<WebCore::GlyphDisplayListCacheEntry, WTF::SingleThreadWeakPtrImpl>>>, WTF::WeakRef<WebCore::GlyphDisplayListCacheEntry, WTF::SingleThreadWeakPtrImpl>, WTF::WeakRef<WebCore::GlyphDisplayListCacheEntry, WTF::SingleThreadWeakPtrImpl>, WTF::IdentityExtractor, WTF::DefaultHash<WTF::WeakRef<WebCore::GlyphDisplayListCacheEntry, WTF::SingleThreadWeakPtrImpl>>, WTF::HashTraits<WTF::WeakRef<WebCore::GlyphDisplayListCacheEntry, WTF::SingleThreadWeakPtrImpl>>, WTF::HashTraits<WTF::WeakRef<WebCore::GlyphDisplayListCacheEntry, WTF::SingleThreadWeakPtrImpl>>> WTF::HashTable<WTF::WeakRef<WebCore::GlyphDisplayListCacheEntry, WTF::SingleThreadWeakPtrImpl>, WTF::WeakRef<WebCore::GlyphDisplayListCacheEntry, WTF::SingleThreadWeakPtrImpl>, WTF::IdentityExtractor, WTF::DefaultHash<WTF::WeakRef<WebCore::GlyphDisplayListCacheEntry, WTF::SingleThreadWeakPtrImpl>>, WTF::HashTraits<WTF::WeakRef<WebCore::GlyphDisplayListCacheEntry, WTF::SingleThreadWeakPtrImpl>>, WTF::HashTraits<WTF::WeakRef<WebCore::GlyphDisplayListCacheEntry, WTF::SingleThreadWeakPtrImpl>>>::find<WTF::HashSetTranslatorAdapter<WebCore::GlyphDisplayListCacheKeyTranslator>, WebCore::GlyphDisplayListCacheKey>(WebCore::GlyphDisplayListCacheKey const&) const + 92 (HashTable.h:1029) 7 WebCore 0x32c440c98 WTF::HashTableConstIteratorAdapter<WTF::HashTable<WTF::WeakRef<WebCore::GlyphDisplayListCacheEntry, WTF::SingleThreadWeakPtrImpl>, WTF::WeakRef<WebCore::GlyphDisplayListCacheEntry, WTF::SingleThreadWeakPtrImpl>, WTF::IdentityExtractor, WTF::DefaultHash<WTF::WeakRef<WebCore::GlyphDisplayListCacheEntry, WTF::SingleThreadWeakPtrImpl>>, WTF::HashTraits<WTF::WeakRef<WebCore::GlyphDisplayListCacheEntry, WTF::SingleThreadWeakPtrImpl>>, WTF::HashTraits<WTF::WeakRef<WebCore::GlyphDisplayListCacheEntry, WTF::SingleThreadWeakPtrImpl>>>, WTF::WeakRef<WebCore::GlyphDisplayListCacheEntry, WTF::SingleThreadWeakPtrImpl>> WTF::HashSet<WTF::WeakRef<WebCore::GlyphDisplayListCacheEntry, WTF::SingleThreadWeakPtrImpl>, WTF::DefaultHash<WTF::WeakRef<WebCore::GlyphDisplayListCacheEntry, WTF::SingleThreadWeakPtrImpl>>, WTF::HashTraits<WTF::WeakRef<WebCore::GlyphDisplayListCacheEntry, WTF::SingleThreadWeakPtrImpl>>, WTF::HashTableTraits>::find<WebCore::GlyphDisplayListCacheKeyTranslator, WebCore::GlyphDisplayListCacheKey>(WebCore::GlyphDisplayListCacheKey const&) const + 52 (HashSet.h:288) 8 WebCore 0x32c42c1e0 WebCore::DisplayList::DisplayList* WebCore::GlyphDisplayListCache::getDisplayList<WebCore::InlineDisplay::Box>(WebCore::InlineDisplay::Box const*, WebCore::FontCascade const&, WebCore::GraphicsContext&, WebCore::TextRun const&) + 356 (GlyphDisplayListCache.cpp:96) 9 WebCore 0x32c42c070 WebCore::GlyphDisplayListCache::get(WebCore::InlineDisplay::Box const&, WebCore::FontCascade const&, WebCore::GraphicsContext&, WebCore::TextRun const&) + 60 (GlyphDisplayListCache.cpp:119) 10 WebCore 0x32c79a9d8 void WebCore::TextPainter::setGlyphDisplayListIfNeeded<WebCore::InlineDisplay::Box>(WebCore::InlineDisplay::Box const&, WebCore::PaintInfo const&, WebCore::TextRun const&) + 96 (TextPainter.h:69) ```

Attachments
Add attachment proposed patch, testcase, etc.

Chris Dumez

Comment 1 2024-04-06 17:26:51 PDT

<rdar://125823370>

Chris Dumez

Comment 2 2024-04-06 17:32:40 PDT

Pull request: https://github.com/WebKit/WebKit/pull/26946

EWS

Comment 3 2024-04-06 17:57:22 PDT

Committed 277168@main (23935509223c): <https://commits.webkit.org/277168@main> Reviewed commits have been landed. Closing PR #26946 and removing active labels.

Note You need to log in before you can comment on or make changes to this bug.