Bug 258135 - REGRESSION(264701@main): wpt/css/CSS2/normal-flow/crashtests/block-in-inline-ax-crash.html
Summary: REGRESSION(264701@main): wpt/css/CSS2/normal-flow/crashtests/block-in-inline-...
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebCore Misc. (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2023-06-15 07:53 PDT by Sam Sneddon [:gsnedders]
Modified: 2023-10-30 09:56 PDT (History)
2 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 Radar WebKit Bug Importer 2023-06-15 07:53:20 PDT
<rdar://problem/110839883>
Comment 2 Chris Dumez 2023-06-15 09:04:01 PDT
This is a crash test, not a correctness test.

264701@main aligned our behavior with Firefox when it comes to timer ordering (Chrome still has the bug). As a result, it is a little surprising Firefox is passing this crash test and we're not. I looked into it and Chrome & Firefox's output is very different. Chrome runs the whole test without JS exception and produces a large output. Firefox produces a much smaller output because they throw exceptions.

We have Firefox's timer ordering but don't end up throwing exception. As a result, the test ends up in an infinite loop and the WebProcess hangs.

I wouldn't say this is a true regression given that this isn't a correctness and given that our new timer ordering is correct.
Comment 3 Chris Dumez 2023-06-15 09:04:33 PDT
Exceptions thrown by Firefox:
```
Uncaught TypeError: oRange is null
    event_handler_ECA_DOMCharacterDataModified http://wpt.live/css/CSS2/normal-flow/crashtests/block-in-inline-ax-crash.html:50
    event_handler_EC9_load http://wpt.live/css/CSS2/normal-flow/crashtests/block-in-inline-ax-crash.html:20
block-in-inline-ax-crash.html:50:25
Uncaught TypeError: oRange is null
    event_handler_EC9_load http://wpt.live/css/CSS2/normal-flow/crashtests/block-in-inline-ax-crash.html:31
block-in-inline-ax-crash.html:31:1
Uncaught DOMException: Node.insertBefore: The new child is an ancestor of the parent
    <anonymous> http://wpt.live/css/CSS2/normal-flow/crashtests/block-in-inline-ax-crash.html:127
block-in-inline-ax-crash.html:127
```