RESOLVED FIXED 254034
[ iOS , macOS Debug ] ASSERTION FAILED: !isCalculated() in WebCore::Length::value() seen with imported/w3c/web-platform-tests/css/css-tables/auto-layout-calc-width-001.html 
https://bugs.webkit.org/show_bug.cgi?id=254034
Summary [ iOS , macOS Debug ] ASSERTION FAILED: !isCalculated() in WebCore::Length::v...
Bri Harris
Reported 2023-03-16 10:27:41 PDT
imported/w3c/web-platform-tests/css/css-tables/auto-layout-calc-width-001.html is a constant crash on iOS and macOS affecting Debug only. HISTORY: https://results.webkit.org/?suite=layout-tests&test=imported%2Fw3c%2Fweb-platform-tests%2Fcss%2Fcss-tables%2Fauto-layout-calc-width-001.html CRASH LOG TEXT: ASSERTION FAILED: !isCalculated() /Volumes/Data/worker/macOS-AppleSilicon-Ventura-Debug-Build-EWS/build/Source/WebCore/platform/Length.h(341) : float WebCore::Length::value() const 1 0x13a6d32b0 WTFCrash 2 0x28065d6a0 WebCore::JSANGLEInstancedArrays::createPrototype(JSC::VM&, WebCore::JSDOMGlobalObject&) 3 0x28218076c WebCore::Length::value() const 4 0x2857fc288 WebCore::AutoTableLayout::recalcColumn(unsigned int) 5 0x2857fd304 WebCore::AutoTableLayout::fullRecalc() 6 0x2857fd528 WebCore::AutoTableLayout::computeIntrinsicLogicalWidths(WebCore::LayoutUnit&, WebCore::LayoutUnit&, WebCore::TableIntrinsics) 7 0x285b72314 WebCore::RenderTable::computeIntrinsicLogicalWidths(WebCore::LayoutUnit&, WebCore::LayoutUnit&, WebCore::TableIntrinsics) const 8 0x285b7234c WebCore::RenderTable::computeIntrinsicLogicalWidths(WebCore::LayoutUnit&, WebCore::LayoutUnit&) const 9 0x285b72418 WebCore::RenderTable::computePreferredLogicalWidths() 10 0x285983444 WebCore::RenderBox::minPreferredLogicalWidth() const 11 0x285b6dee8 WebCore::RenderTable::updateLogicalWidth() 12 0x285b6f3cc WebCore::RenderTable::layout() 13 0x285920518 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 14 0x28591f9f8 WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) 15 0x28591e3c8 WebCore::RenderBlockFlow::layoutInFlowChildren(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 16 0x28591d774 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) 17 0x285906578 WebCore::RenderBlock::layout() 18 0x285920518 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 19 0x28591f9f8 WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) 20 0x28591e3c8 WebCore::RenderBlockFlow::layoutInFlowChildren(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 21 0x28591d774 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) 22 0x285906578 WebCore::RenderBlock::layout() 23 0x285920518 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 24 0x28591f9f8 WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) 25 0x28591e3c8 WebCore::RenderBlockFlow::layoutInFlowChildren(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 26 0x28591d774 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) 27 0x285906578 WebCore::RenderBlock::layout() 28 0x285be8d40 WebCore::RenderView::layout() 29 0x284c7f140 WebCore::FrameViewLayoutContext::performLayout() 30 0x284c7ea54 WebCore::FrameViewLayoutContext::layout() 31 0x283bbd624 WebCore::Document::updateLayout() com.apple.WebKit.WebContent.Development terminated (pid 7907) for reason: crash LEAK: 1 WebPageProxy
Attachments
Add attachment proposed patch, testcase, etc.
Bri Harris
Comment 1 2023-03-16 10:28:17 PDT
I was able to replicate this crash on iOS 16 and Ventura ToT as follows: run-webkit-tests imported/w3c/web-platform-tests/css/css-tables/auto-layout-calc-width-001.html
Radar WebKit Bug Importer
Comment 2 2023-03-16 10:28:32 PDT
<rdar://problem/106814579>
EWS
Comment 3 2023-03-16 10:53:45 PDT
Test gardening commit 261752@main (b17c4ce2bf89): <https://commits.webkit.org/261752@main> Reviewed commits have been landed. Closing PR #11614 and removing active labels.
Ryan Haddad
Comment 4 2023-03-17 09:57:56 PDT
This test was added with https://commits.webkit.org/261623@main, the test has been asserting from the start.
Ryan Haddad
Comment 5 2023-03-17 10:01:45 PDT
*** This bug has been marked as a duplicate of bug 254030 ***
Ryan Haddad
Comment 6 2023-03-17 10:03:11 PDT
The change responsible was reverted in https://commits.webkit.org/261755@main>
Ryan Haddad
Comment 7 2023-03-17 10:03:36 PDT
*** Bug 254030 has been marked as a duplicate of this bug. ***
Note You need to log in before you can comment on or make changes to this bug.