Bug 181836 - REGRESSION (r226981): ASSERTION FAILED: startY >= 0 && endY <= height && startY < endY in WebCore::FEMorphology::platformApplyGeneric
Summary: REGRESSION (r226981): ASSERTION FAILED: startY >= 0 && endY <= height && star...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: New Bugs (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Simon Fraser (smfr)
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2018-01-18 21:45 PST by Ryan Haddad
Modified: 2018-01-22 17:36 PST (History)
8 users (show)

See Also:


Attachments
Patch (15.93 KB, patch)
2018-01-19 23:02 PST, Simon Fraser (smfr)
no flags Details | Formatted Diff | Diff
Patch (15.82 KB, patch)
2018-01-20 08:06 PST, Simon Fraser (smfr)
no flags Details | Formatted Diff | Diff
Patch (15.83 KB, patch)
2018-01-20 09:54 PST, Simon Fraser (smfr)
no flags Details | Formatted Diff | Diff
Archive of layout-test-results from ews206 for win-future (11.96 MB, application/zip)
2018-01-20 13:59 PST, EWS Watchlist
no flags Details
Patch (16.63 KB, patch)
2018-01-22 12:39 PST, Simon Fraser (smfr)
no flags Details | Formatted Diff | Diff
Archive of layout-test-results from ews107 for mac-sierra-wk2 (2.54 MB, application/zip)
2018-01-22 13:44 PST, EWS Watchlist
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Ryan Haddad 2018-01-18 21:45:52 PST
This assertion failure is seen on iOS Debug WK2 with LayoutTest svg/filters/feMorphology-invalid-radius.svg:

ASSERTION FAILED: startY >= 0 && endY <= height && startY < endY

Thread 16 Crashed:: Dispatch queue: com.apple.root.default-qos
0   JavaScriptCore                	0x000000011be46ec4 WTFCrash + 36
1   com.apple.WebCore             	0x000000011ea6e45d WebCore::FEMorphology::platformApplyGeneric(WebCore::FEMorphology::PaintingData const&, int, int) + 317
2   com.apple.WebCore             	0x000000011ea6ebbe WebCore::FEMorphology::platformApplyWorker(WebCore::FEMorphology::PlatformApplyParameters*) + 46
3   com.apple.WebCore             	0x000000011ea720b0 ___ZN3WTF19ParallelEnvironment7executeEPh_block_invoke + 48
4   libdispatch.dylib             	0x00000001151dd2e6 _dispatch_client_callout2 + 8
5   libdispatch.dylib             	0x00000001151e9ebc _dispatch_apply_invoke + 164
6   libdispatch.dylib             	0x00000001151dd2b5 _dispatch_client_callout + 8
7   libdispatch.dylib             	0x00000001151e7c1b _dispatch_root_queue_drain + 993
8   libdispatch.dylib             	0x00000001151e77dc _dispatch_worker_thread3 + 119
9   libsystem_pthread.dylib       	0x00000001156985a2 _pthread_wqthread + 1299
10  libsystem_pthread.dylib       	0x000000011569807d start_wqthread + 13

https://build.webkit.org/results/Apple%20iOS%2011%20Simulator%20Debug%20WK2%20(Tests)/r227176%20(2176)/results.html

https://webkit-test-results.webkit.org/dashboards/flakiness_dashboard.html#showAllRuns=true&tests=svg%2Ffilters%2FfeMorphology-invalid-radius.svg
Comment 1 Simon Fraser (smfr) 2018-01-19 11:11:09 PST
Weird that this happens on iOS but not macOS. Will look.
Comment 2 Simon Fraser (smfr) 2018-01-19 14:55:49 PST
Happens on macOS too.

FEMorphology::platformApplySoftware() was relying in implicit conversion between large floats and ints, which used to result in negative radius values, but now causes large positive values.
Comment 3 Simon Fraser (smfr) 2018-01-19 17:02:12 PST
This logic is bad:

            const int jobSize = paintingData.height / numOfThreads;
            const int jobsWithExtra = paintingData.height % numOfThreads;

when numOfThreads > paintingData.height, because you end up with jobSize=0 and jobsWithExtra = paintingData.height, but we loop on numOfThreads.
Comment 4 Simon Fraser (smfr) 2018-01-19 23:02:22 PST
Created attachment 331835 [details]
Patch
Comment 5 Simon Fraser (smfr) 2018-01-20 08:06:43 PST
Created attachment 331844 [details]
Patch
Comment 6 Simon Fraser (smfr) 2018-01-20 09:54:40 PST
Created attachment 331845 [details]
Patch
Comment 7 EWS Watchlist 2018-01-20 13:59:27 PST
Comment on attachment 331845 [details]
Patch

Attachment 331845 [details] did not pass win-ews (win):
Output: http://webkit-queues.webkit.org/results/6151177

New failing tests:
svg/filters/feTurbulence-parallel-jobs-wide.svg
svg/filters/feLighting-parallel-jobs.svg
Comment 8 EWS Watchlist 2018-01-20 13:59:37 PST
Created attachment 331847 [details]
Archive of layout-test-results from ews206 for win-future

The attached test failures were seen while running run-webkit-tests on the win-ews.
Bot: ews206  Port: win-future  Platform: CYGWIN_NT-6.1-2.9.0-0.318-5-3-x86_64-64bit
Comment 9 Simon Fraser (smfr) 2018-01-22 12:39:18 PST
Created attachment 331950 [details]
Patch
Comment 10 EWS Watchlist 2018-01-22 13:44:07 PST
Comment on attachment 331950 [details]
Patch

Attachment 331950 [details] did not pass mac-wk2-ews (mac-wk2):
Output: http://webkit-queues.webkit.org/results/6173128

New failing tests:
media/video-main-content-autoplay.html
Comment 11 EWS Watchlist 2018-01-22 13:44:08 PST
Created attachment 331958 [details]
Archive of layout-test-results from ews107 for mac-sierra-wk2

The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews.
Bot: ews107  Port: mac-sierra-wk2  Platform: Mac OS X 10.12.6
Comment 12 Tim Horton 2018-01-22 13:44:45 PST
Comment on attachment 331950 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=331950&action=review

> Source/WebCore/platform/graphics/filters/FEMorphology.cpp:197
> +        WTF::ParallelJobs<PlatformApplyParameters> parallelJobs(&WebCore::FEMorphology::platformApplyWorker, optimalThreadNumber);

Why the WTF::
Comment 13 Ryan Haddad 2018-01-22 17:10:48 PST
Comment on attachment 331950 [details]
Patch

Marking CQ+ again because the failure is unrelated.
Comment 14 WebKit Commit Bot 2018-01-22 17:34:38 PST
Comment on attachment 331950 [details]
Patch

Clearing flags on attachment: 331950

Committed r227374: <https://trac.webkit.org/changeset/227374>
Comment 15 WebKit Commit Bot 2018-01-22 17:34:40 PST
All reviewed patches have been landed.  Closing bug.
Comment 16 Radar WebKit Bug Importer 2018-01-22 17:36:24 PST
<rdar://problem/36757037>