Bug 222711 – ASSERTION FAILED: contentSize >= 0 in WebCore::RenderFlexibleBox::adjustChildSizeForMinAndMax

• Status: RESOLVED
• Resolution: FIXED
• Component: Layout and Rendering

[Ryan Haddad]

imported/w3c/web-platform-tests/css/css-flexbox/frameset-crash.html, which was recently imported with https://trac.webkit.org/changeset/273825/webkit, is frequently asserting on iOS and macOS debug bots.

https://results.webkit.org/?suite=layout-tests&test=imported%2Fw3c%2Fweb-platform-tests%2Fcss%2Fcss-flexbox%2Fframeset-crash.html

ASSERTION FAILED: contentSize >= 0
./rendering/RenderFlexibleBox.cpp(1210) : WebCore::LayoutUnit WefbCore::RenderFlexibleBox::adjustChildSizeForMinAndMax(const WebCore::RenderBox &, WebCore::LayoutUnit)
1   0x144404329 WTFCrash
2   0x127ee57db WTFCrashWithInfo(int, char const*, char const*, int)
3   0x12c8ccbaa WebCore::RenderFlexibleBox::adjustChildSizeForMinAndMax(WebCore::RenderBox const&, WebCore::LayoutUnit)
4   0x12c8ca6f0 WebCore::RenderFlexibleBox::constructFlexItem(WebCore::RenderBox&, bool)
5   0x12c8c585a WebCore::RenderFlexibleBox::layoutFlexItems(bool)
6   0x12c8c5364 WebCore::RenderFlexibleBox::layoutBlock(bool, WebCore::LayoutUnit)
7   0x12c7db8b9 WebCore::RenderBlock::layout()
8   0x12c7f6a02 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&)
9   0x12c7f5344 WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&)
10  0x12c7f41c3 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit)
11  0x12c7db8b9 WebCore::RenderBlock::layout()
12  0x12c7f6a02 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&)
13  0x12c7f5344 WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&)
14  0x12c7f41c3 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit)
15  0x12c7db8b9 WebCore::RenderBlock::layout()
16  0x12c7f6a02 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&)
17  0x12c7f5344 WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&)
18  0x12c7f41c3 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit)
19  0x12c7db8b9 WebCore::RenderBlock::layout()
20  0x12caaee33 WebCore::RenderView::layout()
21  0x12be804b1 WebCore::FrameViewLayoutContext::layout()
22  0x12af61ce6 WebCore::Document::implicitClose()
23  0x12bc44d6b WebCore::FrameLoader::checkCallImplicitClose()
24  0x12bc4479a WebCore::FrameLoader::checkCompleted()
25  0x12bc42887 WebCore::FrameLoader::finishedParsing()
26  0x12af76866 WebCore::Document::finishedParsing()
27  0x12b76fdd8 WebCore::HTMLConstructionSite::finishedParsing()
28  0x12b7b8c97 WebCore::HTMLTreeBuilder::finished()
29  0x12b777418 WebCore::HTMLDocumentParser::end()
30  0x12b7750e8 WebCore::HTMLDocumentParser::attemptToRunDeferredScriptsAndEnd()
31  0x12b774e27 WebCore::HTMLDocumentParser::prepareToStopParsing()

[Radar WebKit Bug Importer]

<rdar://problem/75022692>

[Sergio Villar Senin]

Committed r273876 (234837@main): <https://commits.webkit.org/234837@main>

[Sergio Villar Senin]

This was not meant to be closed.

I've just landed in r273876 a gardening patch skipping this test in Debug until we figure out what's going on.

[Sergio Villar Senin]

Created attachment 423322 [details]
Patch

[Sergio Villar Senin]

Ping reviewers

[Sergio Villar Senin]

Another gentle ping

[zalan]

Comment on attachment 423322 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=423322&action=review

> Source/WebCore/rendering/RenderFrameSet.cpp:437
> +    ASSERT(preferredLogicalWidthsDirty());
> +
> +    RenderBox::computePreferredLogicalWidths(style().logicalMinWidth(), style().logicalMaxWidth(), borderAndPaddingLogicalWidth());
> +    setPreferredLogicalWidthsDirty(false);

I am curious as to why RenderBox::computePreferredLogicalWidths() does not simply call the other computePreferredLogicalWidths() function. I did a quick grep and it looked like many RenderBox subclasses override this function. It would be interesting to know if there's another class that's missing the override and whether it is intentional or just a mistake like this. I'd move this functionality up to the RenderBox unless there's a good reason not to (so that we don't end up with this exact same bug if someone introduces a new subclass).

[Sergio Villar Senin]

Created attachment 427650 [details]
Patch

Something like this Alan?

[zalan]

(In reply to Sergio Villar Senin from comment #8)
> Created attachment 427650 [details]
> Patch
> 
> Something like this Alan?
Exactly like this! Thanks! Will review it in a bit.

[zalan]

Comment on attachment 427650 [details]
Patch

So it looks like there are 2 classes with no computePreferredLogicalWidths override, RenderTableRow and RenderMultiColumnSpannerPlaceholder. If this patch regresses them in any way, we could just override and leave them empty with an explanation of why they should not need to provide the preferred logical width.

[EWS]

Committed r276971 (237300@main): <https://commits.webkit.org/237300@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 427650 [details].