Bug 325012 – REGRESSION(317859@main): [ iOS ] 4x fast/* tests crash with ASSERTION FAILED: mode == Verify => !geometryChanged in RenderLayer::updateLayerPosition (CRASH)

• Component: Layout and Rendering
• Status: RESOLVED FIXED

[Dawn Morningstar]

fast/forms/input-placeholder-visibility-2.html
fast/forms/input-placeholder-visibility-3.html
fast/events/ios/command+shift+v-should-not-insert-v.html
fast/forms/number/number-placeholder-with-intermediate-value.html

are constant failures on iOS (Debug)

All four crash at the same assertion with an identical backtrace: an editing command forces layout
(VisiblePosition::canonicalPosition -> Document::updateLayout), and the Verify pass of
RenderLayer::recursiveUpdateLayerPositions finds layer geometry that changed.

Reproduction:
run-webkit-tests --no-build --no-show-results --iterations=10 --ios-simulator --debug fast/forms/input-placeholder-visibility-2.html

History:
https://results.webkit.org/?suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&test=fast%2Fforms%2Finput-placeholder-visibility-2.html&test=fast%2Fforms%2Finput-placeholder-visibility-3.html&test=fast%2Fevents%2Fios%2Fcommand%2Bshift%2Bv-should-not-insert-v.html&test=fast%2Fforms%2Fnumber%2Fnumber-placeholder-with-intermediate-value.html

Crash:
No crash log found for com.apple.WebKit.WebContent.Development:51264.

stdout:

stderr:

Dirty flags: NeedsPosition(U)pdate, (D)escendantNeedsPositionUpdate, All(C)hildrenNeedPositionUpdate, (A)llDescendantsNeedPositionUpdate
Repaint status: (-)NeedsNormalRepaint, Needs(F)ullRepaint, NeedsFullRepaintFor(P)ositionedMovementLayout
Layer state: has(P)aginatedAncestor, has(F)ixedAncestor,  hasFixedContaining(B)lockAncestor, has(T)ransformedAncestor, has(3)DTransformedAncestor, hasComposited(S)crollingAncestor, !is(V)isibilityHiddenOrOpacityZero(), isSelfPainting(L)ayer, (C)omposited, CompositedWithOwn(B)ackingStore

 -D-- - ------VLCB 0x10c254500 (0,0) width=800 height=600 RenderView 0x10c248480 (repaint container: 0x10c248480) (repaint rects  (clipped overflow (0,0) width=800 height=600))
 -D-- - ------VL--   0x10c254650 (0,0) width=800 height=600 RenderBlock 0x10c32c3a0 HTML 0x10c3196c0 (repaint container: 0x10c248480) (repaint rects  (clipped overflow (0,0) width=800 height=600))
*---- - ------V---     0x10c2547a0 (14,10.94) width=142 height=13 RenderBlock 0x10c32c680 DIV 0x10c319760 (repaint container: 0x10c248480)
 UDC- - ------V---     0x10c2548f0 (14,11) width=142 height=13 RenderBlock 0x10c32c7f0 DIV 0x10c322a20 (repaint container: 0x10c248480)

ASSERTION FAILED: mode == Verify => !geometryChanged
/Volumes/Data/worker/Apple-iOS-26-Simulator-Debug-Build/build/Source/WebCore/rendering/RenderLayer.cpp(2241) : bool WebCore::RenderLayer::updateLayerPosition(OptionSet<UpdateLayerPositionsFlag> *, UpdateLayerPositionsMode)
1   0x14b6e44b0 WebCore::RenderLayer::updateLayerPosition(WTF::OptionSet<WebCore::RenderLayer::UpdateLayerPositionsFlag, (WTF::ConcurrencyTag)0>*, WebCore::RenderLayer::UpdateLayerPositionsMode)
2   0x14b77fa94 void WebCore::RenderLayer::recursiveUpdateLayerPositions<(WebCore::RenderLayer::UpdateLayerPositionsMode)1>(WTF::OptionSet<WebCore::RenderLayer::UpdateLayerPositionsFlag, (WTF::ConcurrencyTag)0>)
3   0x14b6e21fc void WebCore::RenderLayer::recursiveUpdateLayerPositions<(WebCore::RenderLayer::UpdateLayerPositionsMode)0>(WTF::OptionSet<WebCore::RenderLayer::UpdateLayerPositionsFlag, (WTF::ConcurrencyTag)0>)
4   0x14b6e299c void WebCore::RenderLayer::recursiveUpdateLayerPositions<(WebCore::RenderLayer::UpdateLayerPositionsMode)0>(WTF::OptionSet<WebCore::RenderLayer::UpdateLayerPositionsFlag, (WTF::ConcurrencyTag)0>)
5   0x14b6e299c void WebCore::RenderLayer::recursiveUpdateLayerPositions<(WebCore::RenderLayer::UpdateLayerPositionsMode)0>(WTF::OptionSet<WebCore::RenderLayer::UpdateLayerPositionsFlag, (WTF::ConcurrencyTag)0>)
6   0x14b6e2e58 WebCore::RenderLayer::updateLayerPositionsAfterLayout(bool, bool)
7   0x14b118da8 WebCore::LocalFrameViewLayoutContext::flushUpdateLayerPositions()
8   0x14b10885c WebCore::LocalFrameViewLayoutContext::didLayout(bool)
9   0x14b1086e8 WebCore::LocalFrameView::didLayout(WTF::WeakPtr<WebCore::RenderElement, WTF::SingleThreadWeakPtrImpl, WTF::RawPtrTraits<WTF::SingleThreadWeakPtrImpl>>, bool)
10  0x14b12b358 WebCore::LocalFrameViewLayoutContext::performLayout(bool)
11  0x14b0fb288 WebCore::LocalFrameViewLayoutContext::layout(bool)
12  0x1487003a8 WebCore::Document::updateLayout(WTF::OptionSet<WebCore::LayoutOptions, (WTF::ConcurrencyTag)0>, WebCore::Element const*)
13  0x1486fa06c WebCore::Document::updateLayoutIgnorePendingStylesheets(WTF::OptionSet<WebCore::LayoutOptions, (WTF::ConcurrencyTag)0>, WebCore::Element const*)
14  0x1491537a8 WebCore::VisiblePosition::canonicalPosition(WebCore::Position const&, WebCore::AllowUserSelectNone)
15  0x1491535f4 WebCore::VisiblePosition::VisiblePosition(WebCore::Position const&, WebCore::Affinity, WebCore::AllowUserSelectNone)
16  0x149153ea0 WebCore::VisiblePosition::VisiblePosition(WebCore::Position const&, WebCore::Affinity, WebCore::AllowUserSelectNone)
17  0x14d8d8790 WebCore::VisibleSelection::setBaseAndExtentToDeepEquivalents()
18  0x14d8d75ec WebCore::VisibleSelection::validate(WebCore::TextGranularity)
19  0x14d8d75bc WebCore::VisibleSelection::VisibleSelection(WebCore::Position const&, WebCore::Position const&, WebCore::Affinity, WebCore::Directionality)
20  0x14d8d6c94 WebCore::VisibleSelection::VisibleSelection(WebCore::Position const&, WebCore::Position const&, WebCore::Affinity, WebCore::Directionality)
21  0x14d8d665c WebCore::VisibleSelection::VisibleSelection(WebCore::Position const&, WebCore::Affinity, WebCore::Directionality)
22  0x14d8a53e0 WebCore::InsertTextCommand::doApply()
23  0x148e16bfc WebCore::CompositeEditCommand::applyCommandToComposite(WTF::Ref<WebCore::CompositeEditCommand, WTF::RawPtrTraits<WebCore::CompositeEditCommand>, WTF::DefaultRefDerefTraits<WebCore::CompositeEditCommand>>&&, WebCore::VisibleSelection const&)
24  0x14d8d5e64 WebCore::TypingCommand::insertTextRunWithoutNewlines(WTF::String const&, bool)
25  0x14d8dce90 WebCore::TypingCommandLineOperation::operator()(unsigned long, unsigned long, bool) const
26  0x14d8d5ca4 void WebCore::forEachLineInString<WebCore::TypingCommandLineOperation>(WTF::String const&, WebCore::TypingCommandLineOperation const&)
27  0x14d8d43d4 WebCore::TypingCommand::insertText(WTF::String const&, bool)
28  0x14d8d45e4 WebCore::TypingCommand::insertTextAndNotifyAccessibility(WTF::String const&, bool)
29  0x14d8d5440 WebCore::TypingCommand::doApply()
30  0x148e15810 WebCore::CompositeEditCommand::apply()
31  0x14d8d1338 WebCore::TextInsertionBaseCommand::applyTextInsertionCommand(WebCore::LocalFrame*, WebCore::TextInsertionBaseCommand&, WebCore::VisibleSelection const&, WebCore::VisibleSelection const&)
com.apple.WebKit.WebContent.Development terminated (pid 51264) for reason: crash

Bisect:
Last pass 317857@main, first crash 317859@main (no build for 317858@main).
Likely cause: 317859@main, [iOS] Converge iOS font metrics with macOS in Font::platformInit. 317858@main only changes network stream uploads.
Related: webkit.org/b/311034, the same assertion on GTK/WPE, filed before 317859@main.

[Radar WebKit Bug Importer]

<rdar://problem/188216588>

[Dawn Morningstar]

*** Bug 325015 has been marked as a duplicate of this bug. ***

[alan]

Pull request: https://github.com/WebKit/WebKit/pull/74751

[EWS]

Committed 321784@main (ce41a20021a1): <https://commits.webkit.org/321784@main>

Reviewed commits have been landed. Closing PR #74751 and removing active labels.