RESOLVED FIXED 221275
REGRESSION(r272128): ASSERTION FAILED: run.inlineItem.isText() || run.inlineItem.isInlineBoxStart() || run.inlineItem.isInlineBoxEnd() on fast/layoutformattingcontext/table-basic-row-baseline-align.html 
https://bugs.webkit.org/show_bug.cgi?id=221275
Summary REGRESSION(r272128): ASSERTION FAILED: run.inlineItem.isText() || run.inlineI...
Robert Jenner
Reported 2021-02-02 11:07:02 PST
fast/layoutformattingcontext/table-basic-row-baseline-align.html Is Flakey crashing on macOS Catalina and BigSur in wk2. HISTORY: https://results.webkit.org/?suite=layout-tests&test=fast%2Flayoutformattingcontext%2Ftable-basic-row-baseline-align.html&platform=mac
Attachments
crash log (73.67 KB, text/plain)
2021-02-02 20:34 PST, Ryan Haddad 		no flags
Details
Patch (9.26 KB, patch)
2021-02-03 17:00 PST, zalan 		no flags
DetailsFormatted DiffDiff
Patch (9.25 KB, patch)
2021-02-03 20:32 PST, zalan 		no flags
DetailsFormatted DiffDiff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.
Radar WebKit Bug Importer
Comment 1 2021-02-02 11:08:04 PST
<rdar://problem/73888807>
Robert Jenner
Comment 2 2021-02-02 11:26:30 PST
Was not able to reproduce the test crash, likely due to the test being incredibly flakey.However, the history does indicate a potential regression point. History chart indicates crashes started at r272128
Ryan Haddad
Comment 3 2021-02-02 20:34:56 PST
Created attachment 419098 [details] crash log ASSERTION FAILED: run.inlineItem.isText() || run.inlineItem.isInlineBoxStart() || run.inlineItem.isInlineBoxEnd() ./layout/inlineformatting/InlineContentBreaker.cpp(286) : auto WebCore::Layout::InlineContentBreaker::processOverflowingTextContent(const WebCore::Layout::InlineContentBreaker::ContinuousContent &, const WebCore::Layout::InlineContentBreaker::LineStatus &)::(anonymous class)::operator()(auto &) const 1 0x6f2b0c649 WTFCrash 2 0x6cfaf392b WTFCrashWithInfo(int, char const*, char const*, int) 3 0x6d362aac2 auto WebCore::Layout::InlineContentBreaker::processOverflowingTextContent(WebCore::Layout::InlineContentBreaker::ContinuousContent const&, WebCore::Layout::InlineContentBreaker::LineStatus const&) const::$_15::operator()<WebCore::Layout::InlineContentBreaker::ContinuousContent::Run const>(WebCore::Layout::InlineContentBreaker::ContinuousContent::Run const&) const 4 0x6d36237ed WebCore::Layout::InlineContentBreaker::processOverflowingTextContent(WebCore::Layout::InlineContentBreaker::ContinuousContent const&, WebCore::Layout::InlineContentBreaker::LineStatus const&) const::$_22::operator()() const 5 0x6d36230bf WebCore::Layout::InlineContentBreaker::processOverflowingTextContent(WebCore::Layout::InlineContentBreaker::ContinuousContent const&, WebCore::Layout::InlineContentBreaker::LineStatus const&) const 6 0x6d3622655 WebCore::Layout::InlineContentBreaker::processOverflowingContent(WebCore::Layout::InlineContentBreaker::ContinuousContent const&, WebCore::Layout::InlineContentBreaker::LineStatus const&) const::$_18::operator()() const 7 0x6d3622129 WebCore::Layout::InlineContentBreaker::processOverflowingContent(WebCore::Layout::InlineContentBreaker::ContinuousContent const&, WebCore::Layout::InlineContentBreaker::LineStatus const&) const 8 0x6d3621ab1 WebCore::Layout::InlineContentBreaker::processInlineContent(WebCore::Layout::InlineContentBreaker::ContinuousContent const&, WebCore::Layout::InlineContentBreaker::LineStatus const&)::$_17::operator()() const 9 0x6d3621810 WebCore::Layout::InlineContentBreaker::processInlineContent(WebCore::Layout::InlineContentBreaker::ContinuousContent const&, WebCore::Layout::InlineContentBreaker::LineStatus const&) 10 0x6d3641b48 WebCore::Layout::LineBuilder::handleInlineContent(WebCore::Layout::InlineContentBreaker&, WebCore::Layout::LineBuilder::InlineItemRange const&, WebCore::Layout::LineCandidate const&) 11 0x6d36406e7 WebCore::Layout::LineBuilder::placeInlineContent(WebCore::Layout::LineBuilder::InlineItemRange const&, unsigned long) 12 0x6d363510a WebCore::Layout::LineBuilder::computedIntrinsicWidth(WebCore::Layout::LineBuilder::InlineItemRange const&, float) 13 0x6d3634ec6 WebCore::Layout::InlineFormattingContext::computedIntrinsicWidthForConstraint(float) const 14 0x6d3634cac auto WebCore::Layout::InlineFormattingContext::computedIntrinsicWidthConstraints()::$_0::operator()<int>(int) const 15 0x6d363483c WebCore::Layout::InlineFormattingContext::computedIntrinsicWidthConstraints() 16 0x6d36c4c6c WebCore::Layout::TableFormattingContext::Geometry::intrinsicWidthConstraintsForCell(WebCore::Layout::TableGrid::Cell const&)::$_8::operator()() const 17 0x6d36c3e01 WebCore::Layout::TableFormattingContext::Geometry::intrinsicWidthConstraintsForCell(WebCore::Layout::TableGrid::Cell const&) 18 0x6d36c2d37 WebCore::Layout::TableFormattingContext::computedPreferredWidthForColumns() 19 0x6d36c2ae9 WebCore::Layout::TableFormattingContext::computedIntrinsicWidthConstraints() 20 0x6d36022fb WebCore::Layout::TableWrapperBlockFormattingContext::computeWidthAndMarginForTableBox(WebCore::Layout::ContainerBox const&, WebCore::Layout::HorizontalConstraints const&) 21 0x6d360167a WebCore::Layout::TableWrapperBlockFormattingContext::layoutTableBox(WebCore::Layout::ContainerBox const&, WebCore::Layout::FormattingContext::ConstraintsForInFlowContent const&) 22 0x6d3601407 WebCore::Layout::TableWrapperBlockFormattingContext::layoutInFlowContent(WebCore::Layout::InvalidationState&, WebCore::Layout::FormattingContext::ConstraintsForInFlowContent const&) 23 0x6d35f69b8 WebCore::Layout::BlockFormattingContext::layoutInFlowContent(WebCore::Layout::InvalidationState&, WebCore::Layout::FormattingContext::ConstraintsForInFlowContent const&) 24 0x6d35d8097 WebCore::Layout::LayoutContext::layoutFormattingContextSubtree(WebCore::Layout::ContainerBox const&, WebCore::Layout::InvalidationState&) 25 0x6d35d7d67 WebCore::Layout::LayoutContext::layoutWithPreparedRootGeometry(WebCore::Layout::InvalidationState&) 26 0x6d35d7c0b WebCore::Layout::LayoutContext::layout(WebCore::LayoutSize const&, WebCore::Layout::InvalidationState&) 27 0x6d39c952d WebCore::FrameViewLayoutContext::layoutUsingFormattingContext() 28 0x6d39aa69d WebCore::FrameViewLayoutContext::layout() 29 0x6d39c9caf WebCore::FrameViewLayoutContext::layoutTimerFired()
zalan
Comment 5 2021-02-03 17:00:17 PST
Created attachment 419208 [details] Patch
Simon Fraser (smfr)
Comment 6 2021-02-03 19:28:04 PST
Comment on attachment 419208 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=419208&action=review > Source/WebCore/layout/inlineformatting/InlineContentBreaker.cpp:69 > + // Based on standards commit boundary ruless it would be enough to check the first inline item, but due to the table quirk, we can have standard commit boundary rules
zalan
Comment 7 2021-02-03 20:32:49 PST
Created attachment 419224 [details] Patch
EWS
Comment 8 2021-02-03 21:08:00 PST
Committed r272356: <https://trac.webkit.org/changeset/272356> All reviewed patches have been landed. Closing bug and clearing flags on attachment 419224 [details].
Note You need to log in before you can comment on or make changes to this bug.