The following is seen on iOS Simulator with layout test fast/frames/invalid-frameset.html ERROR: post-layout: dirty renderer(s) ./page/FrameViewLayoutContext.cpp(87) : auto WebCore::RenderTreeNeedsLayoutChecker::~RenderTreeNeedsLayoutChecker()::(anonymous class)::operator()(const WebCore::RenderObject &) const (B)lock/(I)nline/I(N)line-block, (A)bsolute/Fi(X)ed/(R)elative/Stic(K)y, (F)loating, (O)verflow clip, Anon(Y)mous, (G)enerated, has(L)ayer, (C)omposited, (+)Dirty style, (+)Dirty layout B---YGLC -- RenderView at (0,0) size 800x600 renderer->(0x130000d48) B-----L- -- HTML RenderBlock at (0,0) size 800x600 renderer->(0x13f0007e0) node->(0x130101728) B------- -- FRAMESET RenderFrameSet at (0,0) size 800x600 renderer->(0x164600310) node->(0x16cd00630) B------- -- FRAME RenderFrame at (0,0) size 800x600 renderer->(0x164500240) node->(0x163901710) B-----L- -- FRAMESET RenderFrameSet at (0,0) size 0x0 renderer->(0x164600498) node->(0x16cd006c0) B------- -+* FRAME RenderFrame at (0,0) size 0x0 renderer->(0x164500360) node->(0x1639017a0) layout->[self] SHOULD NEVER BE REACHED ./page/FrameViewLayoutContext.cpp(89) : auto WebCore::RenderTreeNeedsLayoutChecker::~RenderTreeNeedsLayoutChecker()::(anonymous class)::operator()(const WebCore::RenderObject &) const 1 0x1117e29d9 WTFCrash 2 0x11518e23b WTFCrashWithInfo(int, char const*, char const*, int) 3 0x117a6bfc5 WebCore::RenderTreeNeedsLayoutChecker::~RenderTreeNeedsLayoutChecker()::'lambda'(WebCore::RenderObject const&)::operator()(WebCore::RenderObject const&) const 4 0x117a6bf12 WebCore::RenderTreeNeedsLayoutChecker::~RenderTreeNeedsLayoutChecker() 5 0x117a632f5 WebCore::RenderTreeNeedsLayoutChecker::~RenderTreeNeedsLayoutChecker() 6 0x117a43761 WebCore::FrameViewLayoutContext::layout() 7 0x117a62a6c WebCore::FrameViewLayoutContext::layoutTimerFired() 8 0x117a85e37 WTF::Function<void ()>::CallableWrapper<std::__1::__bind<void (WebCore::FrameViewLayoutContext::*&)(), WebCore::FrameViewLayoutContext*> >::call() 9 0x11518f6bd WTF::Function<void ()>::operator()() const 10 0x11521c8a9 WebCore::Timer::fired() 11 0x117c33b46 WebCore::ThreadTimers::sharedTimerFiredInternal() 12 0x117c4a811 WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0::operator()() const 13 0x117c4a7c9 WTF::Function<void ()>::CallableWrapper<WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0>::call() 14 0x11518f6bd WTF::Function<void ()>::operator()() const 15 0x117c0aab7 WebCore::MainThreadSharedTimer::fired() 16 0x117cb2709 WebCore::timerFired(__CFRunLoopTimer*, void*) 17 0x107fb1e64 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ 18 0x107fb1a52 __CFRunLoopDoTimer 19 0x107fb160a __CFRunLoopDoTimers 20 0x107fa8e4c __CFRunLoopRun 21 0x107fa830b CFRunLoopRunSpecific 22 0x1027d2b4a -[NSRunLoop(NSRunLoop) runMode:beforeDate:] 23 0x1027d2a25 -[NSRunLoop(NSRunLoop) run] 24 0x109bd08c9 _xpc_objc_main 25 0x109bd2d73 xpc_main 26 0x102726bc4 WebKit::XPCServiceMain() 27 0x102726f0b main 28 0x109818955 start 29 0x1 LEAK: 1 WebPageProxy https://build.webkit.org/results/Apple%20iOS%2011%20Simulator%20Debug%20WK2%20(Tests)/r235991%20(6431)/results.html
Same assertion failure (with different output) also seen with imported/w3c/web-platform-tests/html/syntax/parsing/html5lib_tests2.html on the same run: stderr: ERROR: post-layout: dirty renderer(s) ./page/FrameViewLayoutContext.cpp(87) : auto WebCore::RenderTreeNeedsLayoutChecker::~RenderTreeNeedsLayoutChecker()::(anonymous class)::operator()(const WebCore::RenderObject &) const (B)lock/(I)nline/I(N)line-block, (A)bsolute/Fi(X)ed/(R)elative/Stic(K)y, (F)loating, (O)verflow clip, Anon(Y)mous, (G)enerated, has(L)ayer, (C)omposited, (+)Dirty style, (+)Dirty layout B---YGL- -- RenderView at (0,0) size 0x0 renderer->(0x14a303278) B-----L- -- HTML RenderBlock at (0,0) size 0x0 renderer->(0x13b202400) node->(0x158e03bb8) B------- -- FRAMESET RenderFrameSet at (0,0) size 0x0 renderer->(0x171501570) node->(0x16ac00b40) B------- -- FRAME RenderFrame at (0,0) size 0x0 renderer->(0x177100120) node->(0x175300120) B------- -- FRAMESET RenderFrameSet at (0,0) size 0x0 renderer->(0x1715016f8) node->(0x16ac00bd0) B------- -+* FRAME RenderFrame at (0,0) size 0x0 renderer->(0x177100240) node->(0x1753001b0) layout->[self]
https://webkit-test-results.webkit.org/dashboards/flakiness_dashboard.html#showAllRuns=true&tests=fast%2Fframes%2Finvalid-frameset.html%20imported%2Fw3c%2Fweb-platform-tests%2Fhtml%2Fsyntax%2Fparsing%2Fhtml5lib_tests2.html
<rdar://problem/44473299>
fast/frames/invalid-frameset.html is hitting this consistently. The first occurrence blames: https://trac.webkit.org/log/webkit/?verbose=on&rev=235923&stop_rev=235920 imported/w3c/web-platform-tests/html/syntax/parsing/html5lib_tests2.html is flaky, with the first occurrence blaming this range: https://trac.webkit.org/log/webkit/?verbose=on&rev=235939&stop_rev=235938
I can reproduce the crash locally with fast/frames/invalid-frameset.html on r235921. I cannot reproduce with r235920. This seems to have regressed with https://trac.webkit.org/changeset/235921/webkit
I haven't yet been able to reproduce the crash with imported/w3c/web-platform-tests/html/syntax/parsing/html5lib_tests2.html, so this could be related to test order.
Zalan, is this something you could take a look at?
(In reply to Ryan Haddad from comment #7) > Zalan, is this something you could take a look at? Yes, unless it's a new test (or can be regressed to a certain commit).
Created attachment 358369 [details] Patch
Comment on attachment 358369 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=358369&action=review > Source/WebCore/rendering/RenderFrameSet.cpp:497 > +static void clearSiblingSubtrees(RenderBox* sibling, RenderFrameSet& frameSet) resetFrameRendererAndDescendents > Source/WebCore/rendering/RenderFrameSet.cpp:549 > // all the remaining frames are hidden to avoid ugly spurious unflowed frames Make this a full sentence. > Source/WebCore/rendering/RenderFrameSet.cpp:653 > // all the remaining frames are hidden to avoid ugly spurious unflowed frames Make this a full sentence.
Created attachment 358373 [details] Patch
Comment on attachment 358373 [details] Patch Clearing flags on attachment: 358373 Committed r239645: <https://trac.webkit.org/changeset/239645>
All reviewed patches have been landed. Closing bug.