Bug 257279 - ASSERTION FAILED: rootRenderer.isDocumentElementRenderer() for fast/body-propagation/background-image/007-xhtml.xhtml
Summary: ASSERTION FAILED: rootRenderer.isDocumentElementRenderer() for fast/body-prop...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Layout and Rendering (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: zalan
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2023-05-24 13:51 PDT by Fujii Hironori
Modified: 2023-05-25 13:06 PDT (History)
10 users (show)

See Also:


Attachments
test case (307 bytes, application/xhtml+xml)
2023-05-24 14:50 PDT, Fujii Hironori
no flags Details
Patch (2.18 KB, patch)
2023-05-24 20:39 PDT, zalan
no flags Details | Formatted Diff | Diff
Patch (2.17 KB, patch)
2023-05-24 20:52 PDT, zalan
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Fujii Hironori 2023-05-24 13:51:51 PDT
Apple-iOS-16-Simulator-Debug-WK2-Tests is randomly failing an assertion after 264443@main.
Apple-iPadOS-16-Simulator-Debug-WK2-Tests is after 264442@main.

https://results.webkit.org/?suite=layout-tests&suite=layout-tests&test=fast%2Fbody-propagation%2Fbackground-image%2F008-xhtml.xhtml&test=fast%2Fbody-propagation%2Fbackground-image%2F007-xhtml.xhtml

fast/body-propagation/background-image/007-xhtml.xhtml
fast/body-propagation/background-image/008-xhtml.xhtml

https://build.webkit.org/results/Apple-iPadOS-16-Simulator-Debug-WK2-Tests/264442@main%20(1478)/results.html
https://build.webkit.org/results/Apple-iOS-16-Simulator-Debug-WK2-Tests/264443@main%20(1231)/results.html

stderr:
ASSERTION FAILED: rootRenderer.isDocumentElementRenderer()
/Volumes/Data/worker/Apple-iOS-16-Simulator-Debug-Build/build/Source/WebCore/rendering/RenderElement.cpp(1428) : bool WebCore::RenderElement::isVisibleInDocumentRect(const WebCore::IntRect &) const
1   0x10e536898 WTFCrash
2   0x14b700690 WebCore::NetworkResourcesData::ResourceData::hasContent() const
3   0x14c706ea4 WebCore::RenderElement::isVisibleInDocumentRect(WebCore::IntRect const&) const
4   0x14c7071d4 WebCore::RenderElement::isVisibleInViewport() const
5   0x14c6a3eb8 WebCore::RenderBoxModelObject::decodingModeForImageDraw(WebCore::Image const&, WebCore::PaintInfo const&) const
6   0x14c5581e0 WebCore::BackgroundPainter::paintFillLayer(WebCore::Color const&, WebCore::FillLayer const&, WebCore::LayoutRect const&, WebCore::BackgroundBleedAvoidance, WebCore::InlineIterator::InlineBoxIterator const&, WebCore::LayoutRect const&, WebCore::CompositeOperator, WebCore::RenderElement*, WebCore::BaseBackgroundColorUsage)
7   0x14c5565c8 WebCore::BackgroundPainter::paintFillLayers(WebCore::Color const&, WebCore::FillLayer const&, WebCore::LayoutRect const&, WebCore::BackgroundBleedAvoidance, WebCore::CompositeOperator, WebCore::RenderElement*)
8   0x14c555c34 WebCore::BackgroundPainter::paintBackground(WebCore::LayoutRect const&, WebCore::BackgroundBleedAvoidance)
9   0x14c68ed3c WebCore::RenderBox::paintBoxDecorations(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
10  0x14c6575c4 WebCore::RenderBlock::paintObject(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
11  0x14c6563c4 WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
12  0x14c65709c WebCore::RenderBlock::paintChild(WebCore::RenderBox&, WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool, WebCore::RenderBlock::PaintBlockType)
13  0x14c656cf4 WebCore::RenderBlock::paintChildren(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool)
14  0x14c656c34 WebCore::RenderBlock::paintContents(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
15  0x14c658060 WebCore::RenderBlock::paintObject(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
16  0x14c6563c4 WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
17  0x14c65709c WebCore::RenderBlock::paintChild(WebCore::RenderBox&, WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool, WebCore::RenderBlock::PaintBlockType)
18  0x14c656cf4 WebCore::RenderBlock::paintChildren(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool)
19  0x14c656c34 WebCore::RenderBlock::paintContents(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
20  0x14c658060 WebCore::RenderBlock::paintObject(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
21  0x14c6563c4 WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
22  0x14c780be0 WebCore::RenderLayer::paintForegroundForFragmentsWithPhase(WebCore::PaintPhase, WTF::Vector<WebCore::LayerFragment, 1ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&, WebCore::GraphicsContext&, WebCore::RenderLayer::LayerPaintingInfo const&, WTF::OptionSet<WebCore::PaintBehavior>, WebCore::RenderObject*)
23  0x14c77e860 WebCore::RenderLayer::paintForegroundForFragments(WTF::Vector<WebCore::LayerFragment, 1ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&, WebCore::GraphicsContext&, WebCore::GraphicsContext&, WebCore::LayoutRect const&, bool, WebCore::RenderLayer::LayerPaintingInfo const&, WTF::OptionSet<WebCore::PaintBehavior>, WebCore::RenderObject*)
24  0x14c77a7d8 WebCore::RenderLayer::paintLayerContents(WebCore::GraphicsContext&, WebCore::RenderLayer::LayerPaintingInfo const&, WTF::OptionSet<WebCore::RenderLayer::PaintLayerFlag>)
25  0x14c779ba4 WebCore::RenderLayer::paintLayerContentsAndReflection(WebCore::GraphicsContext&, WebCore::RenderLayer::LayerPaintingInfo const&, WTF::OptionSet<WebCore::RenderLayer::PaintLayerFlag>)
26  0x14c778ba4 WebCore::RenderLayer::paintLayerWithEffects(WebCore::GraphicsContext&, WebCore::RenderLayer::LayerPaintingInfo const&, WTF::OptionSet<WebCore::RenderLayer::PaintLayerFlag>)
27  0x14c777e78 WebCore::RenderLayer::paintLayer(WebCore::GraphicsContext&, WebCore::RenderLayer::LayerPaintingInfo const&, WTF::OptionSet<WebCore::RenderLayer::PaintLayerFlag>)
28  0x14c77e424 WebCore::RenderLayer::paintList(WebCore::RenderLayer::LayerList, WebCore::GraphicsContext&, WebCore::RenderLayer::LayerPaintingInfo const&, WTF::OptionSet<WebCore::RenderLayer::PaintLayerFlag>)
29  0x14c77a91c WebCore::RenderLayer::paintLayerContents(WebCore::GraphicsContext&, WebCore::RenderLayer::LayerPaintingInfo const&, WTF::OptionSet<WebCore::RenderLayer::PaintLayerFlag>)
30  0x14c79ec58 WebCore::RenderLayerBacking::paintIntoLayer(WebCore::GraphicsLayer const*, WebCore::GraphicsContext&, WebCore::IntRect const&, WTF::OptionSet<WebCore::PaintBehavior>, WebCore::RegionContext*)::$_30::operator()(WebCore::RenderLayer&, WTF::OptionSet<WebCore::RenderLayer::PaintLayerFlag>) const
31  0x14c79e614 WebCore::RenderLayerBacking::paintIntoLayer(WebCore::GraphicsLayer const*, WebCore::GraphicsContext&, WebCore::IntRect const&, WTF::OptionSet<WebCore::PaintBehavior>, WebCore::RegionContext*)
com.apple.WebKit.WebContent.Development terminated (pid 95131) for reason: crash
Comment 1 Fujii Hironori 2023-05-24 13:54:09 PDT
WinCairo-64-bit-Debug-Tests is constantly failing.

https://build.webkit.org/results/WinCairo-64-bit-Debug-Tests/264434@main%20(20315)/results.html

264434@main: first bad
264419@main: last good
Comment 2 Fujii Hironori 2023-05-24 14:27:05 PDT
This code is assuming the parent of <body> is <html>. But, it's <bogus> in the tests.

I think we should copy the following code from RenderElement::styleWillChange.
https://github.com/WebKit/WebKit/blob/48c6a9eda4fdc93834a69222bd4db466c7b94e52/Source/WebCore/rendering/RenderElement.cpp#L882
> bool drawsRootBackground = isDocumentElementRenderer() || (isBody() && !rendererHasBackground(document().documentElement()->renderer()));
Comment 3 Fujii Hironori 2023-05-24 14:50:28 PDT
Created attachment 466485 [details]
test case

WinCairo Debug MiniBrowser can crash just by loading this test case.
Comment 4 Fujii Hironori 2023-05-24 16:17:42 PDT
Mac Debug MiniBrowser also can crash for the test case (attachment#466485 [details]). But, it needs some reloading.
Comment 5 zalan 2023-05-24 20:11:08 PDT
You are right, https://trac.webkit.org/changeset/179145/webkit made some incorrect assumption on the <body>'s parent. Will fix.
Thank you!
Comment 6 zalan 2023-05-24 20:39:19 PDT
Created attachment 466492 [details]
Patch
Comment 7 zalan 2023-05-24 20:52:54 PDT
Created attachment 466493 [details]
Patch
Comment 8 EWS 2023-05-25 13:05:15 PDT
Committed 264535@main (7e2da0a4cfeb): <https://commits.webkit.org/264535@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 466493 [details].
Comment 9 Radar WebKit Bug Importer 2023-05-25 13:06:17 PDT
<rdar://problem/109849818>