Since a few days ago I'm unable to use slack because my web process crashes: 1 0x7f63279098d9 WTFCrash 2 0x7f632c0f9154 WebCore::LayoutIntegration::LineLayout::contentLogicalHeight() const 3 0x7f632c5af081 WebCore::RenderBlockFlow::layoutModernLines(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 4 0x7f632c5f36f8 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) 5 0x7f632c5c3c2a WebCore::RenderBlock::layout() 6 0x7f632c5e822f WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 7 0x7f632c5f32cd WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) 8 0x7f632c5f3add WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) 9 0x7f632c5c3c2a WebCore::RenderBlock::layout() 10 0x7f632c64046c WebCore::RenderFlexibleBox::layoutAndPlaceChildren(WebCore::LayoutUnit&, WTF::Vector<WebCore::FlexItem, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&, WebCore::LayoutUnit, bool, WTF::Vector<WebCore::RenderFlexibleBox::LineContext, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&, WebCore::LayoutUnit) 11 0x7f632c643ac3 WebCore::RenderFlexibleBox::layoutFlexItems(bool) 12 0x7f632c644286 WebCore::RenderFlexibleBox::layoutBlock(bool, WebCore::LayoutUnit) 13 0x7f632c5c3c2a WebCore::RenderBlock::layout() 14 0x7f632c5e822f WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 15 0x7f632c5f32cd WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) 16 0x7f632c5f3add WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) 17 0x7f632c5c3c2a WebCore::RenderBlock::layout() 18 0x7f632c5e822f WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 19 0x7f632c5f32cd WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) 20 0x7f632c5f3add WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) 21 0x7f632c5c3c2a WebCore::RenderBlock::layout() 22 0x7f632c5e822f WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 23 0x7f632c5f32cd WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) 24 0x7f632c5f3add WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) 25 0x7f632c5c3c2a WebCore::RenderBlock::layout() 26 0x7f632c5e822f WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 27 0x7f632c5f32cd WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) 28 0x7f632c5f3add WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) 29 0x7f632c5c3c2a WebCore::RenderBlock::layout() 30 0x7f632c64046c WebCore::RenderFlexibleBox::layoutAndPlaceChildren(WebCore::LayoutUnit&, WTF::Vector<WebCore::FlexItem, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&, WebCore::LayoutUnit, bool, WTF::Vector<WebCore::RenderFlexibleBox::LineContext, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&, WebCore::LayoutUnit) 31 0x7f632c643ac3 WebCore::RenderFlexibleBox::layoutFlexItems(bool)
I'm getting a crash but due to ASSERTs failing ASSERTION FAILED: !m_impl || Thread::mayBeGCThread() || m_impl->wasConstructedOnMainThread() == isMainThread() DerivedSources/ForwardingHeaders/wtf/WeakPtr.h(94) : T* WTF::WeakPtr< <template-parameter-1-1>, <template-parameter-1-2> >::get() const [with T = WebCore::Frame; Counter = WTF::EmptyCounter] ASSERTION FAILED: !m_impl || Thread::mayBeGCThread() || m_impl->wasConstructedOnMainThread() == isMainThread() DerivedSources/ForwardingHeaders/wtf/WeakPtr.h(94) : T* WTF::WeakPtr< <template-parameter-1-1>, <template-parameter-1-2> >::get() const [with T = WebCore::Frame; Counter = WTF::EmptyCounter] ASSERTION FAILED: !m_impl || Thread::mayBeGCThread() || m_impl->wasConstructedOnMainThread() == isMainThread() DerivedSources/ForwardingHeaders/wtf/WeakPtr.h(94) : T* WTF::WeakPtr< <template-parameter-1-1>, <template-parameter-1-2> >::get() const [with T = WebCore::Frame; Counter = WTF::EmptyCounter] ASSERTION FAILED: !m_impl || Thread::mayBeGCThread() || m_impl->wasConstructedOnMainThread() == isMainThread() DerivedSources/ForwardingHeaders/wtf/WeakPtr.h(94) : T* WTF::WeakPtr< <template-parameter-1-1>, <template-parameter-1-2> >::get() const [with T = WebCore::Frame; Counter = WTF::EmptyCounter] 1 0x7f81b193878b WTFCrash 2 0x7f81abdebf0e WTF::CrashOnOverflow::overflowed() 1 0x7f81b193878b WTFCrash 3 0x7f81acc360de WTF::WeakPtr<WebCore::Frame, WTF::EmptyCounter>::get() const 1 0x7f81b193878b WTFCrash 2 0x7f81abdebf0e WTF::CrashOnOverflow::overflowed() 2 0x7f81abdebf0e WTF::CrashOnOverflow::overflowed() 3 0x7f81acc360de WTF::WeakPtr<WebCore::Frame, WTF::EmptyCounter>::get() const 4 0x7f81aef98daa WebCore::FrameDestructionObserver::frame() const 3 0x7f81acc360de WTF::WeakPtr<WebCore::Frame, WTF::EmptyCounter>::get() const 4 0x7f81aef98daa WebCore::FrameDestructionObserver::frame() const 1 0x7f81b193878b WTFCrash 5 0x7f81ae961233 WebCore::HTMLMediaElement::mediaPlayerReferrer() const 4 0x7f81aef98daa WebCore::FrameDestructionObserver::frame() const 5 0x7f81ae961233 WebCore::HTMLMediaElement::mediaPlayerReferrer() const 2 0x7f81abdebf0e WTF::CrashOnOverflow::overflowed() 6 0x7f81af2b0c5d WebCore::MediaPlayer::referrer() const 5 0x7f81ae961233 WebCore::HTMLMediaElement::mediaPlayerReferrer() const 6 0x7f81af2b0c5d WebCore::MediaPlayer::referrer() const 7 0x7f81acf5e02f ~/checkout/WebKit/WebKitBuild/Debug/lib/libWPEWebKit-1.0.so.3(+0xe2b102f) [0x7f81acf5e02f] 8 0x7f81acf5cc7e ~/checkout/WebKit/WebKitBuild/Debug/lib/libWPEWebKit-1.0.so.3(+0xe2afc7e) [0x7f81acf5cc7e] 6 0x7f81af2b0c5d WebCore::MediaPlayer::referrer() const 3 0x7f81acc360de WTF::WeakPtr<WebCore::Frame, WTF::EmptyCounter>::get() const 7 0x7f81acf5e02f ~/checkout/WebKit/WebKitBuild/Debug/lib/libWPEWebKit-1.0.so.3(+0xe2b102f) [0x7f81acf5e02f] 9 0x7f819d8fd13d ~/checkout/WebKit/WebKitBuild/DependenciesWPE/Root/lib/libgstbase-1.0.so.0(+0x3c13d) [0x7f819d8fd13d] 8 0x7f81acf5cc7e ~/checkout/WebKit/WebKitBuild/Debug/lib/libWPEWebKit-1.0.so.3(+0xe2afc7e) [0x7f81acf5cc7e] 4 0x7f81aef98daa WebCore::FrameDestructionObserver::frame() const 10 0x7f819d8ff346 ~/checkout/WebKit/WebKitBuild/DependenciesWPE/Root/lib/libgstbase-1.0.so.0(+0x3e346) [0x7f819d8ff346] 7 0x7f81acf5e02f ~/checkout/WebKit/WebKitBuild/Debug/lib/libWPEWebKit-1.0.so.3(+0xe2b102f) [0x7f81acf5e02f] 9 0x7f819d8fd13d ~/checkout/WebKit/WebKitBuild/DependenciesWPE/Root/lib/libgstbase-1.0.so.0(+0x3c13d) [0x7f819d8fd13d] 8 0x7f81acf5cc7e ~/checkout/WebKit/WebKitBuild/Debug/lib/libWPEWebKit-1.0.so.3(+0xe2afc7e) [0x7f81acf5cc7e] 11 0x7f819e3d969f ~/checkout/WebKit/WebKitBuild/DependenciesWPE/Root/lib/libgstreamer-1.0.so.0(+0xb669f) [0x7f819e3d969f] 12 0x7f819e601ee4 ~/checkout/WebKit/WebKitBuild/DependenciesWPE/Root/lib/libglib-2.0.so.0(+0x74ee4) [0x7f819e601ee4] 5 0x7f81ae961233 WebCore::HTMLMediaElement::mediaPlayerReferrer() const 9 0x7f819d8fd13d ~/checkout/WebKit/WebKitBuild/DependenciesWPE/Root/lib/libgstbase-1.0.so.0(+0x3c13d) [0x7f819d8fd13d] 6 0x7f81af2b0c5d WebCore::MediaPlayer::referrer() const 13 0x7f819e6017c5 ~/checkout/WebKit/WebKitBuild/DependenciesWPE/Root/lib/libglib-2.0.so.0(+0x747c5) [0x7f819e6017c5] 7 0x7f81acf5e02f ~/checkout/WebKit/WebKitBuild/Debug/lib/libWPEWebKit-1.0.so.3(+0xe2b102f) [0x7f81acf5e02f] 10 0x7f819d8ff346 ~/checkout/WebKit/WebKitBuild/DependenciesWPE/Root/lib/libgstbase-1.0.so.0(+0x3e346) [0x7f819d8ff346] 8 0x7f81acf5cc7e ~/checkout/WebKit/WebKitBuild/Debug/lib/libWPEWebKit-1.0.so.3(+0xe2afc7e) [0x7f81acf5cc7e] 14 0x7f819daa6ea7 /lib/x86_64-linux-gnu/libpthread.so.0(+0x8ea7) [0x7f819daa6ea7] 10 0x7f819d8ff346 ~/checkout/WebKit/WebKitBuild/DependenciesWPE/Root/lib/libgstbase-1.0.so.0(+0x3e346) [0x7f819d8ff346] 11 0x7f819e3d969f ~/checkout/WebKit/WebKitBuild/DependenciesWPE/Root/lib/libgstreamer-1.0.so.0(+0xb669f) [0x7f819e3d969f] 9 0x7f819d8fd13d ~/checkout/WebKit/WebKitBuild/DependenciesWPE/Root/lib/libgstbase-1.0.so.0(+0x3c13d) [0x7f819d8fd13d] 15 0x7f819ea8eeaf clone 11 0x7f819e3d969f ~/checkout/WebKit/WebKitBuild/DependenciesWPE/Root/lib/libgstreamer-1.0.so.0(+0xb669f) [0x7f819e3d969f] 12 0x7f819e601ee4 ~/checkout/WebKit/WebKitBuild/DependenciesWPE/Root/lib/libglib-2.0.so.0(+0x74ee4) [0x7f819e601ee4] 10 0x7f819d8ff346 ~/checkout/WebKit/WebKitBuild/DependenciesWPE/Root/lib/libgstbase-1.0.so.0(+0x3e346) [0x7f819d8ff346] 12 0x7f819e601ee4 ~/checkout/WebKit/WebKitBuild/DependenciesWPE/Root/lib/libglib-2.0.so.0(+0x74ee4) [0x7f819e601ee4] 13 0x7f819e6017c5 ~/checkout/WebKit/WebKitBuild/DependenciesWPE/Root/lib/libglib-2.0.so.0(+0x747c5) [0x7f819e6017c5] 11 0x7f819e3d969f ~/checkout/WebKit/WebKitBuild/DependenciesWPE/Root/lib/libgstreamer-1.0.so.0(+0xb669f) [0x7f819e3d969f]
Do you have repro steps or a test reduction? (my ToT WebKit debug build works fine with the slack channels I am in).
It started to happen even with the same WebKit version, so I guess something changed in the current room or something like that, that revealed the bug. The only step to reproduce it for me is opening webkit slack in my browser. I don't have a test case, so I'll try to debug it.
I found some time to debug the issue. The problem is that in LineLayout::contentLogicalHeight() we have a m_inlineContent, but lines is empty. I don't have time right now to figure out why, or whether that's expected or not, but checking also lines is not empty fixes the issue.
Created attachment 414825 [details] Patch
Comment on attachment 414825 [details] Patch Please upload a test reduction (or some kind of test content with repro steps). While the patch certainly fixes the crash, it'd be great to understand under what circumstances it happens (to check if it needs additional changes) and also it'd be nice to regression test it.
<rdar://problem/71747792>
<rdar://problem/71814675>
Created attachment 415401 [details] Patch
(In reply to zalan from comment #6) > Comment on attachment 414825 [details] > Patch > > Please upload a test reduction (or some kind of test content with repro > steps). While the patch certainly fixes the crash, it'd be great to > understand under what circumstances it happens (to check if it needs > additional changes) and also it'd be nice to regression test it. The patch was just papering over the actual issue of missing additional inline types.
Committed r270428: <https://trac.webkit.org/changeset/270428> All reviewed patches have been landed. Closing bug and clearing flags on attachment 415401 [details].