Bug 300864 – [Debug Crash] SHOULD NEVER BE REACHED in WebCore::Layout::Line::restoreTrimmedTrailingWhitespace on `insertHTML-before-comment-at-end-of-editing-host.html` test case

• Component: Layout and Rendering
• Status: RESOLVED FIXED

[Ahmad Saleem]

Hi Team,

While trying to sync editing crash tests from WPT, it seems that we crash following WPT test case on Mac-wk2-debug bot:

WPT Test Case: https://wpt.fyi/results/editing/crashtests/insertHTML-before-comment-at-end-of-editing-host.html?label=master&label=experimental&aligned&q=insertHTML-before-comment-at-end-of-editing-host.html

WPT Test Case Live Link: http://wpt.live/editing/crashtests/insertHTML-before-comment-at-end-of-editing-host.html

EWS Run Link: https://ews-build.s3-us-west-2.amazonaws.com/macOS-Sequoia-Debug-WK2-Tests-EWS/42b9410e-40914-stress-mode/results.html

*** Logs ***

No crash log found for com.apple.WebKit.WebContent.Development:12440.

stdout:

stderr:
SHOULD NEVER BE REACHED
/Volumes/Data/worker/macOS-Sequoia-Debug-Build-EWS/build/Source/WebCore/layout/formattingContexts/inline/InlineLine.cpp(616) : auto WebCore::Layout::Line::restoreTrimmedTrailingWhitespace(InlineLayoutUnit, RunList &)::(anonymous class)::operator()(auto &) const [trailingRun:auto = WebCore::Layout::Line::Run]
1   0x306376144 _ZZN7WebCore6Layout4Line32restoreTrimmedTrailingWhitespaceEfRN3WTF6VectorINS1_3RunELm10ENS2_15CrashOnOverflowELm16ENS2_10FastMallocEEEENK3$_0clIS4_EEDaRT_
2   0x306375edc WebCore::Layout::Line::restoreTrimmedTrailingWhitespace(float, WTF::Vector<WebCore::Layout::Line::Run, 10ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&)
3   0x306368fc4 WebCore::Layout::InlineFormattingContext::createDisplayContentForLineFromCachedContent(WebCore::Layout::ConstraintsForInlineContent const&, WebCore::Layout::InlineLayoutResult&)::$_0::operator()() const
4   0x306367030 WebCore::Layout::InlineFormattingContext::createDisplayContentForLineFromCachedContent(WebCore::Layout::ConstraintsForInlineContent const&, WebCore::Layout::InlineLayoutResult&)
5   0x3063658d4 WebCore::Layout::InlineFormattingContext::lineLayout(WebCore::Layout::AbstractLineBuilder&, WTF::Vector<WebCore::Layout::InlineItem, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&, WebCore::Layout::InlineItemRange, std::__1::optional<WebCore::Layout::PreviousLine>, WebCore::Layout::ConstraintsForInlineContent const&, WebCore::Layout::InlineDamage const*)
6   0x306364ad4 WebCore::Layout::InlineFormattingContext::layout(WebCore::Layout::ConstraintsForInlineContent const&, WebCore::Layout::InlineDamage*)
7   0x30647e4c8 WebCore::LayoutIntegration::LineLayout::layout(WebCore::LayoutIntegration::LineLayout::ForceFullLayout)
8   0x3076e734c WebCore::RenderBlockFlow::layoutInlineContent(WebCore::RelayoutChildren, WebCore::LayoutUnit&, WebCore::LayoutUnit&)
9   0x3076e4f58 WebCore::RenderBlockFlow::layoutInlineChildren(WebCore::RelayoutChildren, WebCore::LayoutUnit&, WebCore::LayoutUnit&)
10  0x3076e3938 WebCore::RenderBlockFlow::layoutInFlowChildren(WebCore::RelayoutChildren, WebCore::LayoutUnit&, WebCore::LayoutUnit&, WebCore::LayoutUnit&)
11  0x3076e25a8 WebCore::RenderBlockFlow::layoutBlock(WebCore::RelayoutChildren, WebCore::LayoutUnit)
12  0x3076c96b8 WebCore::RenderBlock::layout()
13  0x3076e5d94 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&)
14  0x3076e536c WebCore::RenderBlockFlow::layoutBlockChildren(WebCore::RelayoutChildren, WebCore::LayoutUnit&)
15  0x3076e3980 WebCore::RenderBlockFlow::layoutInFlowChildren(WebCore::RelayoutChildren, WebCore::LayoutUnit&, WebCore::LayoutUnit&, WebCore::LayoutUnit&)
16  0x3076e25a8 WebCore::RenderBlockFlow::layoutBlock(WebCore::RelayoutChildren, WebCore::LayoutUnit)
17  0x3076c96b8 WebCore::RenderBlock::layout()
18  0x307787488 WebCore::RenderElement::layoutIfNeeded()
19  0x3076cb7b4 WebCore::RenderBlock::layoutOutOfFlowBox(WebCore::RenderBox&, WebCore::RelayoutChildren, bool)
20  0x3076cb03c WebCore::RenderBlock::layoutOutOfFlowBoxes(WebCore::RelayoutChildren, bool)
21  0x3076cad14 WebCore::RenderBlock::simplifiedLayout()
22  0x3076e222c WebCore::RenderBlockFlow::layoutBlock(WebCore::RelayoutChildren, WebCore::LayoutUnit)
23  0x3076c96b8 WebCore::RenderBlock::layout()
24  0x3079e485c WebCore::RenderView::layout()
25  0x3068bee7c WebCore::LocalFrameViewLayoutContext::performLayout(bool)
26  0x306896a24 WebCore::LocalFrameViewLayoutContext::layout(bool)
27  0x3055c8e04 WebCore::Document::updateLayout(WTF::OptionSet<WebCore::LayoutOptions, (WTF::ConcurrencyTag)0>, WebCore::Element const*)
28  0x3055c38d8 WebCore::Document::updateLayoutIgnorePendingStylesheets(WTF::OptionSet<WebCore::LayoutOptions, (WTF::ConcurrencyTag)0>, WebCore::Element const*)
29  0x305aa7440 WebCore::ReplaceSelectionCommand::removeUnrenderedTextNodesAtEnds(WebCore::ReplaceSelectionCommand::InsertedNodes&)
30  0x305aa9580 WebCore::ReplaceSelectionCommand::doApply()
31  0x3059cd890 WebCore::CompositeEditCommand::apply()
com.apple.WebKit.WebContent.Development terminated (pid 12440) for reason: crash

****

I will add platform specific expectation for my PR but it would be good to fix it.

If it is more of `editing` crash for Ryosuke + Wenson, we can move it later.

Thanks!

[alan]

Created attachment 477107 [details]
Patch

[alan]

Created attachment 477108 [details]
Patch

[alan]

Created attachment 477119 [details]
[fast-cq]Patch

[EWS]

Committed 301727@main (8c17e28a3674): <https://commits.webkit.org/301727@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 477119 [details].

[Radar WebKit Bug Importer]

<rdar://problem/162873234>