Bug 280747

Summary:	[Debug] SHOULD NEVER BE REACHED on `fast/multicol/spanner-get-re-added-on-move-crash.html`
Product:	WebKit	Reporter:	Vitaly Dyackhov <vitaly>
Component:	Layout and Rendering	Assignee:	Nobody <webkit-unassigned>
Status:	RESOLVED FIXED
Severity:	Normal	CC:	bfulgham, simon.fraser, webkit-bug-importer, zalan
Priority:	P2	Keywords:	InRadar
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified

Vitaly Dyackhov

Reported 2024-10-02 01:57:43 PDT

#0 0x00007fbe0e618138 in WTFCrash () at /home/vitaly/WebKit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2 #1 0x00007fbe11ba9056 in WebCore::RenderTable::layout() () at /home/vitaly/WebKit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2 #2 0x00007fbe11a5bd05 in WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) () at /home/vitaly/WebKit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2 #3 0x00007fbe11a6748a in WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) () at /home/vitaly/WebKit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2 #4 0x00007fbe11a68eb0 in WebCore::RenderBlockFlow::layoutInFlowChildren(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) () at /home/vitaly/WebKit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2 #5 0x00007fbe11a6945a in WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) () at /home/vitaly/WebKit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2 #6 0x00007fbe11a10dcc in WebCore::RenderBlock::layout() () at /home/vitaly/WebKit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2 #7 0x00007fbe11abad79 in WebCore::RenderFragmentedFlow::layout() () at /home/vitaly/WebKit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2 #8 0x00007fbe11b90d11 in WebCore::RenderMultiColumnFlow::layout() () at /home/vitaly/WebKit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2 #9 0x00007fbe11a6c80f in WebCore::RenderBlockFlow::layoutExcludedChildren(bool) () at /home/vitaly/WebKit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2 #10 0x00007fbe11a673f0 in WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) () at /home/vitaly/WebKit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2 #11 0x00007fbe11a68eb0 in WebCore::RenderBlockFlow::layoutInFlowChildren(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) () at /home/vitaly/WebKit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2 #12 0x00007fbe11a6945a in WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) () at /home/vitaly/WebKit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2 #13 0x00007fbe11a10dcc in WebCore::RenderBlock::layout() () at /home/vitaly/WebKit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2 #14 0x00007fbe11b97511 in WebCore::RenderTable::layoutCaption(WebCore::RenderTableCaption&) () at /home/vitaly/WebKit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2 #15 0x00007fbe11b99490 in WebCore::RenderTable::layoutCaptions(WebCore::RenderTable::BottomCaptionLayoutPhase) [clone .part.0] () at /home/vitaly/WebKit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2 #16 0x00007fbe11ba894e in WebCore::RenderTable::layout() () at /home/vitaly/WebKit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2 #17 0x00007fbe11a5bd05 in WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) () at /home/vitaly/WebKit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2 #18 0x00007fbe11a6748a in WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) () at /home/vitaly/WebKit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2 #19 0x00007fbe11a68eb0 in WebCore::RenderBlockFlow::layoutInFlowChildren(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) () at /home/vitaly/WebKit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2 #20 0x00007fbe11a6945a in WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) () at /home/vitaly/WebKit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2 #21 0x00007fbe11a10dcc in WebCore::RenderBlock::layout() () at /home/vitaly/WebKit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2 #22 0x00007fbe11abad79 in WebCore::RenderFragmentedFlow::layout() () at /home/vitaly/WebKit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2 #23 0x00007fbe11b90d11 in WebCore::RenderMultiColumnFlow::layout() () at /home/vitaly/WebKit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2 #24 0x00007fbe11a6c80f in WebCore::RenderBlockFlow::layoutExcludedChildren(bool) () at /home/vitaly/WebKit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2 #25 0x00007fbe11a673f0 in WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) () at /home/vitaly/WebKit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2 #26 0x00007fbe11a68eb0 in WebCore::RenderBlockFlow::layoutInFlowChildren(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) () at /home/vitaly/WebKit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2 #27 0x00007fbe11a6945a in WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) () at /home/vitaly/WebKit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2 #28 0x00007fbe11a10dcc in WebCore::RenderBlock::layout() () at /home/vitaly/WebKit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2 #29 0x00007fbe11a5bd05 in WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) () at /home/vitaly/WebKit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2 #30 0x00007fbe11a6748a in WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) () at /home/vitaly/WebKit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2 #31 0x00007fbe11a68eb0 in WebCore::RenderBlockFlow::layoutInFlowChildren(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) () at /home/vitaly/WebKit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2 #32 0x00007fbe11a6945a in WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) () at /home/vitaly/WebKit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2 #33 0x00007fbe11a10dcc in WebCore::RenderBlock::layout() () at /home/vitaly/WebKit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2 #34 0x00007fbe11c29dbd in WebCore::RenderView::layout() () at /home/vitaly/WebKit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2 #35 0x00007fbe113c83fe in WebCore::LocalFrameViewLayoutContext::performLayout(bool) () at /home/vitaly/WebKit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2 #36 0x00007fbe113c8d60 in WebCore::LocalFrameViewLayoutContext::layout(bool) () at /home/vitaly/WebKit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2 #37 0x00007fbe109c761a in WebCore::Document::updateLayout(WTF::OptionSet<WebCore::LayoutOptions>, WebCore::Element const*) () at /home/vitaly/WebKit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2 #38 0x00007fbe10ba92ba in WebCore::Editor::Command::execute(WTF::String const&, WebCore::Event*) const () at /home/vitaly/WebKit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2 #39 0x00007fbe109c9c98 in WebCore::Document::execCommand(WTF::String const&, bool, std::variant<WTF::String, WTF::RefPtr<WebCore::TrustedHTML, WTF::RawPtrTraits<WebCore::TrustedHTML>, WTF::DefaultRefDerefTraits<WebCore::TrustedHTML> > > const&) () at /home/vitaly/WebKit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2 #40 0x00007fbe0edeb6c6 in WebCore::jsDocumentPrototypeFunction_execCommand(JSC::JSGlobalObject*, JSC::CallFrame*) () at /home/vitaly/WebKit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2 #41 0x00007fbdb6210038 in ??? () #42 0x00007ffece03fd60 in ??? () #43 0x00007fbe121f5f21 in llint_op_call_ignore_result () at /home/vitaly/WebKit/WebKitBuild/WPE/Release/lib/libWPEWebKit-2.0.so.2 #44 0x0000000000000000 in ??? ()

Attachments
Add attachment proposed patch, testcase, etc.

Vitaly Dyackhov

Comment 1 2024-10-02 02:02:50 PDT

Pull request: https://github.com/WebKit/WebKit/pull/34567

EWS

Comment 2 2024-10-08 09:22:49 PDT

Committed 284831@main (99535733074e): <https://commits.webkit.org/284831@main> Reviewed commits have been landed. Closing PR #34567 and removing active labels.

Radar WebKit Bug Importer

Comment 3 2024-10-08 09:23:17 PDT

<rdar://problem/137515399>

Note You need to log in before you can comment on or make changes to this bug.