Bug 219905 - REGRESSION (r269627?): ASSERTION FAILED: &layoutState().establishedFormattingState(layoutBox.formattingContextRoot()) == this in WebCore::Layout::FormattingState::boxGeometry
Summary: REGRESSION (r269627?): ASSERTION FAILED: &layoutState().establishedFormatting...
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: Layout and Rendering (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2020-12-15 11:28 PST by Ryan Haddad
Modified: 2021-01-13 13:39 PST (History)
6 users (show)

See Also:


Attachments
crash log (70.44 KB, text/plain)
2020-12-15 11:30 PST, Ryan Haddad
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Ryan Haddad 2020-12-15 11:28:56 PST
fast/layoutformattingcontext/subframe-with-display-none-html.html is a flaky crash on debug macOS bots

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.JavaScriptCore      	0x00000002524f11ce WTFCrash + 14 (Assertions.cpp:295)
1   com.apple.WebCore             	0x000000022f6b51ab WTFCrashWithInfo(int, char const*, char const*, int) + 27
2   com.apple.WebCore             	0x0000000233145c2d WebCore::Layout::FormattingState::boxGeometry(WebCore::Layout::Box const&) + 141 (FormattingState.cpp:54)
3   com.apple.WebCore             	0x0000000233146343 WebCore::Layout::FormattingContext::computeBorderAndPadding(WebCore::Layout::Box const&, WebCore::Layout::HorizontalConstraints const&) + 51 (FormattingContext.cpp:131)
4   com.apple.WebCore             	0x00000002331730bb WebCore::Layout::BlockFormattingContext::layoutInFlowContent(WebCore::Layout::InvalidationState&, WebCore::Layout::FormattingContext::ConstraintsForInFlowContent const&) + 635 (BlockFormattingContext.cpp:115)
5   com.apple.WebCore             	0x00000002331545e7 WebCore::Layout::LayoutContext::layoutFormattingContextSubtree(WebCore::Layout::ContainerBox const&, WebCore::Layout::InvalidationState&) + 327 (LayoutContext.cpp:111)
6   com.apple.WebCore             	0x00000002331542b7 WebCore::Layout::LayoutContext::layoutWithPreparedRootGeometry(WebCore::Layout::InvalidationState&) + 151 (LayoutContext.cpp:87)
7   com.apple.WebCore             	0x000000023315415b WebCore::Layout::LayoutContext::layout(WebCore::LayoutSize const&, WebCore::Layout::InvalidationState&) + 443 (LayoutContext.cpp:78)
8   com.apple.WebCore             	0x000000023354475d WebCore::FrameViewLayoutContext::layoutUsingFormattingContext() + 349 (FrameViewLayoutContext.cpp:75)
9   com.apple.WebCore             	0x0000000233525c9d WebCore::FrameViewLayoutContext::layout() + 2141 (FrameViewLayoutContext.cpp:234)
10  com.apple.WebCore             	0x0000000233544edf WebCore::FrameViewLayoutContext::layoutTimerFired() + 127 (FrameViewLayoutContext.cpp:469)

https://results.webkit.org/?suite=layout-tests&test=fast%2Flayoutformattingcontext%2Fsubframe-with-display-none-html.html
Comment 1 Ryan Haddad 2020-12-15 11:29:51 PST
This is the assert from FormattingState.cpp:54
>    // Should never need to mutate a display box outside of the formatting context.
>    > ASSERT(&layoutState().establishedFormattingState(layoutBox.formattingContextRoot()) == this);
Comment 2 Ryan Haddad 2020-12-15 11:30:40 PST
Created attachment 416269 [details]
crash log
Comment 3 Radar WebKit Bug Importer 2020-12-15 11:31:28 PST
<rdar://problem/72350516>
Comment 4 Ryan Haddad 2020-12-15 11:32:37 PST
The first instance of this I see appears to be at https://trac.webkit.org/changeset/269627/webkit
Comment 5 Truitt Savell 2021-01-12 15:21:43 PST
I am able to reproduce this using command 
rwt fast/layoutformattingcontext/subframe-with-display-none-html.html --iterations 2000 -f --exit-after-n-crashes-or-timeout 1
Comment 6 Truitt Savell 2021-01-13 10:17:32 PST
there is a large regression range due to a lack of builds during this time. I can reproduce this on 269629 but not on 269601
Comment 7 Truitt Savell 2021-01-13 13:39:14 PST
marked this test as crashing in https://trac.webkit.org/changeset/271454/webkit