NEW 228983
ASSERT(!m_visibleContentStatusDirty) in RenderLayer::clearRepaintRects() 
https://bugs.webkit.org/show_bug.cgi?id=228983
Summary ASSERT(!m_visibleContentStatusDirty) in RenderLayer::clearRepaintRects()
Jean-Yves Avenard [:jya]
Reported 2021-08-10 21:19:58 PDT
STR: - Start debug build of MiniBrowser - Open YouTube - Scroll down and click on a video Happens all the time. warning: could not execute support code to read Objective-C class data in the process. This may reduce the quality of type information available. (lldb) bt * thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0xbbadbeef) frame #0: 0x000000078ab7558e JavaScriptCore`::WTFCrash() at Assertions.cpp:321:35 frame #1: 0x000000079beae9ab WebCore`WTFCrashWithInfo((null)=1100, (null)="./rendering/RenderLayer.cpp", (null)="void WebCore::RenderLayer::clearRepaintRects()", (null)=2262) at Assertions.h:703:5 * frame #2: 0x00000007a0392d72 WebCore`WebCore::RenderLayer::clearRepaintRects(this=0x00007f98fc45ec60) at RenderLayer.cpp:1100:5 frame #3: 0x00000007a0394043 WebCore`WebCore::RenderLayer::updateSelfPaintingLayer(this=0x00007f98fc45ec60) at RenderLayer.cpp:5154:9 frame #4: 0x00000007a03ac86a WebCore`WebCore::RenderLayer::styleChanged(this=0x00007f98fc45ec60, diff=Repaint, oldStyle=0x00007ff7b40861f0) at RenderLayer.cpp:5328:5 frame #5: 0x00000007a03842fb WebCore`WebCore::RenderLayerModelObject::styleDidChange(this=0x00007f98fc45eb40, diff=Repaint, oldStyle=0x00007ff7b40861f0) at RenderLayerModelObject.cpp:143:18 frame #6: 0x00000007a02afcde WebCore`WebCore::RenderBox::styleDidChange(this=0x00007f98fc45eb40, diff=Repaint, oldStyle=0x00007ff7b40861f0) at RenderBox.cpp:299:27 frame #7: 0x00000007a0234bd5 WebCore`WebCore::RenderBlock::styleDidChange(this=0x00007f98fc45eb40, diff=Repaint, oldStyle=0x00007ff7b40861f0) at RenderBlock.cpp:436:16 frame #8: 0x00000007a02a489d WebCore`WebCore::RenderBlockFlow::styleDidChange(this=0x00007f98fc45eb40, diff=Repaint, oldStyle=0x00007ff7b40861f0) at RenderBlockFlow.cpp:2103:18 frame #9: 0x00000007a0318976 WebCore`WebCore::RenderElement::setStyle(this=0x00007f98fc45eb40, style=0x00007f98dbf99260, minimalStyleDifference=Equal) at RenderElement.cpp:534:5 frame #10: 0x00000007a0667f20 WebCore`WebCore::RenderTreeUpdater::updateRendererStyle(this=0x00007ff7b4088df8, renderer=0x00007f98fc45eb40, newStyle=0x00007f98dbf99260, minimalStyleDifference=Equal) at RenderTreeUpdater.cpp:299:14 frame #11: 0x00000007a066746d WebCore`WebCore::RenderTreeUpdater::updateElementRenderer(this=0x00007ff7b4088df8, element=0x00007f990dc291e0, updates=0x00007f999027b1e0) at RenderTreeUpdater.cpp:366:5 frame #12: 0x00000007a0666881 WebCore`WebCore::RenderTreeUpdater::updateRenderTree(this=0x00007ff7b4088df8, root=0x00007f990dc273b0) at RenderTreeUpdater.cpp:194:13 frame #13: 0x00000007a0666125 WebCore`WebCore::RenderTreeUpdater::commit(this=0x00007ff7b4088df8, styleUpdate=nullptr) at RenderTreeUpdater.cpp:126:9 frame #14: 0x000000079ebde28b WebCore`WebCore::Document::updateRenderTree(this=0x00007f99ee009000, styleUpdate=nullptr) at Document.cpp:1996:21 frame #15: 0x000000079ebde875 WebCore`WebCore::Document::resolveStyle(this=0x00007f99ee009000, type=Normal) at Document.cpp:2086:13 frame #16: 0x000000079ebdf50d WebCore`WebCore::Document::updateStyleIfNeeded(this=0x00007f99ee009000) at Document.cpp:2178:5 frame #17: 0x000000079ebdfdda WebCore`WebCore::Document::updateLayoutIfDimensionsOutOfDate(this=0x00007f99ee009000, element=0x00007f9a1ce4b5f0, dimensionsCheck=WidthDimensionsCheck) at Document.cpp:2277:5 frame #18: 0x000000079ecb5a8a WebCore`WebCore::Element::clientWidth(this=0x00007f9a1ce4b5f0) at Element.cpp:1265:16 frame #19: 0x000000079c9648fc WebCore`WebCore::jsElement_clientWidthGetter(lexicalGlobalObject=0x00007f99ee00a868, thisObject=0x00007f9a2c351c98) at JSElement.cpp:2817:5 frame #20: 0x000000079c7fa8cc WebCore`long long WebCore::IDLAttribute<WebCore::JSElement>::get<&(lexicalGlobalObject=0x00007f99ee00a868, thisValue=140300143369368, attributeName=PropertyName @ 0x00007ff7b40897d0)), (WebCore::CastedThisErrorBehavior)3>(JSC::JSGlobalObject&, long long, JSC::PropertyName) at JSDOMAttribute.h:88:13 frame #21: 0x000000079c7fa77d WebCore`WebCore::jsElement_clientWidth(lexicalGlobalObject=0x00007f99ee00a868, thisValue=140300143369368, attributeName=PropertyName @ 0x00007ff7b4089808) at JSElement.cpp:2822:12 frame #22: 0x000000078c763f48 JavaScriptCore`JSC::PropertySlot::customGetter(this=0x00007ff7b4089b38, vm=0x00007f99f0008000, propertyName=PropertyName @ 0x00007ff7b4089920) const at PropertySlot.cpp:47:28 frame #23: 0x000000078c3a3386 JavaScriptCore`JSC::PropertySlot::getValue(this=0x00007ff7b4089b38, globalObject=0x00007f99ee00a868, propertyName=PropertyName @ 0x00007ff7b4089960) const at PropertySlot.h:408:12 frame #24: 0x000000078c3a30dd JavaScriptCore`JSC::JSValue::get(this=0x00007ff7b4089c18, globalObject=0x00007f99ee00a868, propertyName=PropertyName @ 0x00007ff7b4089a40, slot=0x00007ff7b4089b38) const at JSCJSValueInlines.h:950:5 frame #25: 0x000000078c1b5835 JavaScriptCore`JSC::LLInt::performLLIntGetByID(pc=0x00007f9a1cdf4ac2, codeBlock=0x00007f9a2d197d40, globalObject=0x00007f99ee00a868, baseValue=JSValue @ 0x00007ff7b4089c18, ident=0x00007f9a1cd8e920, metadata=0x00007f9a1cdf4910) at LLIntSlowPaths.cpp:770:32 frame #26: 0x000000078c1b55d1 JavaScriptCore`::llint_slow_path_get_by_id(callFrame=0x00007ff7b4089e50, pc=0x00007f9a1cdf4ac2) at LLIntSlowPaths.cpp:844:22 frame #27: 0x000000078b17c6a4 JavaScriptCore`llint_entry at LowLevelInterpreter64.asm:97 frame #28: 0x000000078b194094 JavaScriptCore`llint_entry at LowLevelInterpreter.asm:1097 frame #29: 0x000000078b194094 JavaScriptCore`llint_entry at LowLevelInterpreter.asm:1097 frame #30: 0x000000078b194094 JavaScriptCore`llint_entry at LowLevelInterpreter.asm:1097 frame #31: 0x0000493e485bf659 frame #32: 0x0000493e4779e204 frame #33: 0x0000493e4795777a frame #34: 0x0000493e47556fcd frame #35: 0x000000078b1718f0 JavaScriptCore`vmEntryToJavaScript at LowLevelInterpreter64.asm:316 frame #36: 0x000000078c035ea5 JavaScriptCore`JSC::JITCode::execute(this=0x00007f9a2c290240, vm=0x00007f99f0008000, protoCallFrame=0x00007ff7b408a7a0) at JITCodeInlines.h:42:38 frame #37: 0x000000078c0365eb JavaScriptCore`JSC::Interpreter::executeCall(this=0x00007f9a2c208870, lexicalGlobalObject=0x00007f99ee00a868, function=0x00007f995ee60a20, callData=0x00007ff7b408a9d8, thisValue=JSValue @ 0x00007ff7b408a8e0, args=0x00007ff7b408a9b8) at Interpreter.cpp:903:27 frame #38: 0x000000078c3ee17a JavaScriptCore`JSC::call(globalObject=0x00007f99ee00a868, functionObject=JSValue @ 0x00007ff7b408a950, callData=0x00007ff7b408a9d8, thisValue=JSValue @ 0x00007ff7b408a948, args=0x00007ff7b408a9b8) at CallData.cpp:57:28 frame #39: 0x000000078c4b57e6 JavaScriptCore`JSC::GetterSetter::callSetter(this=0x00007f997c03b980, globalObject=0x00007f99ee00a868, thisValue=JSValue @ 0x00007ff7b408aaf0, value=JSValue @ 0x00007ff7b408aae8, shouldThrow=true) at GetterSetter.cpp:79:5 frame #40: 0x000000078c63e33b JavaScriptCore`JSC::JSObject::putInlineSlow(this=0x00007f98dcba4b70, globalObject=0x00007f99ee00a868, propertyName=PropertyName @ 0x00007ff7b408ad70, value=JSValue @ 0x00007ff7b408ad68, slot=0x00007ff7b408b108) at JSObject.cpp:810:17 frame #41: 0x000000078bcc2bdc JavaScriptCore`JSC::JSObject::putInlineForJSObject(cell=0x00007f98dcba4b70, globalObject=0x00007f99ee00a868, propertyName=PropertyName @ 0x00007ff7b408ae80, value=JSValue @ 0x00007ff7b408ae78, slot=0x00007ff7b408b108) at JSObjectInlines.h:272:28 frame #42: 0x000000078bcc28c4 JavaScriptCore`JSC::JSCell::putInline(this=0x00007f98dcba4b70, globalObject=0x00007f99ee00a868, propertyName=PropertyName @ 0x00007ff7b408aef0, value=JSValue @ 0x00007ff7b408aee8, slot=0x00007ff7b408b108) at JSCellInlines.h:447:16 frame #43: 0x000000078bcc3580 JavaScriptCore`JSC::JSValue::putInline(this=0x00007ff7b408b130, globalObject=0x00007f99ee00a868, propertyName=PropertyName @ 0x00007ff7b408af60, value=JSValue @ 0x00007ff7b408af58, slot=0x00007ff7b408b108) at JSCJSValueInlines.h:1072:22 frame #44: 0x000000078c1b6e20 JavaScriptCore`::llint_slow_path_put_by_id(callFrame=0x00007ff7b408b320, pc=0x00007f9a1cd8d150) at LLIntSlowPaths.cpp:918:19 frame #45: 0x000000078b17d3ac JavaScriptCore`llint_entry at LowLevelInterpreter64.asm:97 frame #46: 0x000000078b194094 JavaScriptCore`llint_entry at LowLevelInterpreter.asm:1097 frame #47: 0x000000078b194094 JavaScriptCore`llint_entry at LowLevelInterpreter.asm:1097 frame #48: 0x000000078b1718f0 JavaScriptCore`vmEntryToJavaScript at LowLevelInterpreter64.asm:316 frame #49: 0x000000078c035ea5 JavaScriptCore`JSC::JITCode::execute(this=0x00007f9a0bf58300, vm=0x00007f99f0008000, protoCallFrame=0x00007ff7b408b650) at JITCodeInlines.h:42:38 frame #50: 0x000000078c0365eb JavaScriptCore`JSC::Interpreter::executeCall(this=0x00007f9a2c208870, lexicalGlobalObject=0x00007f99ee00a868, function=0x00007f99def91080, callData=0x00007ff7b408b870, thisValue=JSValue @ 0x00007ff7b408b790, args=0x00007ff7b408b848) at Interpreter.cpp:903:27 frame #51: 0x000000078c3ee17a JavaScriptCore`JSC::call(globalObject=0x00007f99ee00a868, functionObject=JSValue @ 0x00007ff7b408b800, callData=0x00007ff7b408b870, thisValue=JSValue @ 0x00007ff7b408b7f8, args=0x00007ff7b408b848) at CallData.cpp:57:28 frame #52: 0x000000078c563581 JavaScriptCore`JSC::boundThisNoArgsFunctionCall(globalObject=0x00007f99ee00a868, callFrame=0x00007ff7b408b950) at JSBoundFunction.cpp:60:28 frame #53: 0x0000493e4740baf7 frame #54: 0x0000493e4787352f frame #55: 0x000000078b195402 JavaScriptCore`llint_entry at LowLevelInterpreter.asm:1097 frame #56: 0x000000078b194094 JavaScriptCore`llint_entry at LowLevelInterpreter.asm:1097 frame #57: 0x000000078b193fec JavaScriptCore`llint_entry at LowLevelInterpreter.asm:1097 frame #58: 0x0000493e478482f8 frame #59: 0x000000078b193fec JavaScriptCore`llint_entry at LowLevelInterpreter.asm:1097 frame #60: 0x000000078b194094 JavaScriptCore`llint_entry at LowLevelInterpreter.asm:1097 frame #61: 0x000000078b194094 JavaScriptCore`llint_entry at LowLevelInterpreter.asm:1097 frame #62: 0x000000078b193fec JavaScriptCore`llint_entry at LowLevelInterpreter.asm:1097 frame #63: 0x000000078b193fec JavaScriptCore`llint_entry at LowLevelInterpreter.asm:1097 frame #64: 0x000000078b193fec JavaScriptCore`llint_entry at LowLevelInterpreter.asm:1097 frame #65: 0x000000078b194094 JavaScriptCore`llint_entry at LowLevelInterpreter.asm:1097 frame #66: 0x0000493e4761e0ce frame #67: 0x0000493e48601beb frame #68: 0x0000493e47986933 frame #69: 0x0000493e47617f05 frame #70: 0x000000078b1718f0 JavaScriptCore`vmEntryToJavaScript at LowLevelInterpreter64.asm:316 frame #71: 0x000000078c035ea5 JavaScriptCore`JSC::JITCode::execute(this=0x00007f990d9e9440, vm=0x00007f99f0008000, protoCallFrame=0x00007ff7b408c520) at JITCodeInlines.h:42:38 frame #72: 0x000000078c0365eb JavaScriptCore`JSC::Interpreter::executeCall(this=0x00007f9a2c208870, lexicalGlobalObject=0x00007f99ee00a868, function=0x00007f99de826be0, callData=0x00007ff7b408c868, thisValue=JSValue @ 0x00007ff7b408c660, args=0x00007ff7b408c7c0) at Interpreter.cpp:903:27 frame #73: 0x000000078c3ee17a JavaScriptCore`JSC::call(globalObject=0x00007f99ee00a868, functionObject=JSValue @ 0x00007ff7b408c6d0, callData=0x00007ff7b408c868, thisValue=JSValue @ 0x00007ff7b408c6c8, args=0x00007ff7b408c7c0) at CallData.cpp:57:28 frame #74: 0x000000078c3ee435 JavaScriptCore`JSC::profiledCall(globalObject=0x00007f99ee00a868, reason=Microtask, functionObject=JSValue @ 0x00007ff7b408c750, callData=0x00007ff7b408c868, thisValue=JSValue @ 0x00007ff7b408c748, args=0x00007ff7b408c7c0) at CallData.cpp:78:12 frame #75: 0x000000078c620b30 JavaScriptCore`JSC::JSMicrotask::run(this=0x00007f999bf830e0, globalObject=0x00007f99ee00a868) at JSMicrotask.cpp:93:5 frame #76: 0x000000079e5f571b WebCore`WebCore::JSExecState::runTask(lexicalGlobalObject=0x00007f99ee00a868, task=0x00007f999bf830e0) at JSExecState.h:91:14 frame #77: 0x000000079e5fbcbe WebCore`WebCore::JSMicrotaskCallback::call(this=0x00007f999bf83530) at JSMicrotaskCallback.h:47:9 frame #78: 0x000000079e5fbb4f WebCore`WebCore::JSDOMWindowBase::queueMicrotaskToEventLoop(this=0x00007f999bf83558)::$_40::operator()() at JSDOMWindowBase.cpp:237:19 frame #79: 0x000000079e5fba29 WebCore`WTF::Detail::CallableWrapper<WebCore::JSDOMWindowBase::queueMicrotaskToEventLoop(JSC::JSGlobalObject&, WTF::Ref<JSC::Microtask, WTF::RawPtrTraits<JSC::Microtask> >&&)::$_40, void>::call(this=0x00007f999bf83550) at Function.h:53:39 frame #80: 0x000000079bec6592 WebCore`WTF::Function<void ()>::operator(this=0x00007f999bf83590)() const at Function.h:82:35 frame #81: 0x000000079ecf2a39 WebCore`WebCore::EventLoopFunctionDispatchTask::execute(this=0x00007f999bf83570) at EventLoop.cpp:159:28 frame #82: 0x000000079ed2f0c1 WebCore`WebCore::MicrotaskQueue::performMicrotaskCheckpoint(this=0x00007f9a1ce74810) at Microtasks.cpp:64:23 frame #83: 0x000000079ece8c7e WebCore`WebCore::EventLoop::performMicrotaskCheckpoint(this=0x00007f9a1ce74940) at EventLoop.cpp:51:22 frame #84: 0x000000079ecea13f WebCore`WebCore::EventLoopTaskGroup::performMicrotaskCheckpoint(this=0x00007f9a1ce4b570) at EventLoop.cpp:180:22 frame #85: 0x000000079e5a909b WebCore`WebCore::JSExecState::didLeaveScriptContext(lexicalGlobalObject=0x00007f99ee00a868) at JSExecState.cpp:42:26 frame #86: 0x000000079e5b2eaa WebCore`WebCore::JSExecState::~JSExecState(this=0x00007ff7b408ccb8) at JSExecState.h:143:13 frame #87: 0x000000079e5b2ce5 WebCore`WebCore::JSExecState::~JSExecState(this=0x00007ff7b408ccb8) at JSExecState.h:132:5 frame #88: 0x000000079e5881a9 WebCore`WebCore::JSExecState::profiledCall(lexicalGlobalObject=0x00007f99ee00a868, reason=Other, functionObject=JSValue @ 0x00007ff7b408ccf0, callData=0x00007ff7b408cea0, thisValue=JSValue @ 0x00007ff7b408cce8, args=0x00007ff7b408cd78, returnedException=0x00007ff7b408cd98) at JSExecState.h:74:5 frame #89: 0x000000079e63f5c8 WebCore`WebCore::ScheduledAction::executeFunctionInContext(this=0x00007f9a1cbae9e0, globalObject=0x00007f99ee00a868, thisValue=JSValue @ 0x00007ff7b408cf38, context=0x00007f99ee009000) at ScheduledAction.cpp:121:5 frame #90: 0x000000079e63f038 WebCore`WebCore::ScheduledAction::execute(this=0x00007f9a1cbae9e0, document=0x00007f99ee009000) at ScheduledAction.cpp:141:9 frame #91: 0x000000079e63ef03 WebCore`WebCore::ScheduledAction::execute(this=0x00007f9a1cbae9e0, context=0x00007f99ee009000) at ScheduledAction.cpp:86:9 frame #92: 0x000000079f90fa8b WebCore`WebCore::DOMTimer::fired(this=0x00007f9a1cbb55c0) at DOMTimer.cpp:337:15 frame #93: 0x000000079fbeaf2f WebCore`WebCore::ThreadTimers::sharedTimerFiredInternal(this=0x00007f9a1cb06280) at ThreadTimers.cpp:127:23 frame #94: 0x000000079fbf38a1 WebCore`WebCore::ThreadTimers::setSharedTimer(this=0x00007f9a1cb062b8)::$_0::operator()() const at ThreadTimers.cpp:67:80 frame #95: 0x000000079fbf3839 WebCore`WTF::Detail::CallableWrapper<WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0, void>::call(this=0x00007f9a1cb062b0) at Function.h:53:39 frame #96: 0x000000079bec6592 WebCore`WTF::Function<void ()>::operator(this=0x00000007a29ddbb8)() const at Function.h:82:35 frame #97: 0x000000079fba81f1 WebCore`WebCore::MainThreadSharedTimer::fired(this=0x00000007a29ddbb0) at MainThreadSharedTimer.cpp:83:5 frame #98: 0x000000079fc69056 WebCore`WebCore::timerFired((null)=0x0000600001cd4240, (null)=0x0000000000000000) at MainThreadSharedTimerCF.cpp:85:40 frame #99: 0x00007ff8105dc7df CoreFoundation`__CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 20 frame #100: 0x00007ff8105dc2ce CoreFoundation`__CFRunLoopDoTimer + 927 frame #101: 0x00007ff8105dbe2d CoreFoundation`__CFRunLoopDoTimers + 307 frame #102: 0x00007ff8105c246f CoreFoundation`__CFRunLoopRun + 1985 frame #103: 0x00007ff8105c15ed CoreFoundation`CFRunLoopRunSpecific + 563 frame #104: 0x00007ff81142253e Foundation`-[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 216 frame #105: 0x00007ff8114ac753 Foundation`-[NSRunLoop(NSRunLoop) run] + 76 frame #106: 0x00007ff810250233 libxpc.dylib`_xpc_objc_main + 825 frame #107: 0x00007ff81024fc22 libxpc.dylib`xpc_main + 99 frame #108: 0x000000077274f3df WebKit`WebKit::XPCServiceMain(argc=1, argv=0x00007ff7b408f508) at XPCServiceMain.mm:243:5 frame #109: 0x0000000773e1914b WebKit`WKXPCServiceMain(argc=1, argv=0x00007ff7b408f508) at WKMain.mm:33:12 frame #110: 0x000000010be73ea2 com.apple.WebKit.WebContent.Development`main(argc=1, argv=0x00007ff7b408f508) at AuxiliaryProcessMain.cpp:30:12 frame #111: 0x00000001112df4d5 dyld`start + 421 (lldb)
Attachments
Add attachment proposed patch, testcase, etc.
Radar WebKit Bug Importer
Comment 1 2021-08-10 21:20:20 PDT
<rdar://problem/81775884>
Jean-Yves Avenard [:jya]
Comment 2 2021-09-15 21:43:52 PDT
*** Bug 230334 has been marked as a duplicate of this bug. ***
Note You need to log in before you can comment on or make changes to this bug.