REOPENED 259342
REGRESSION(265506@Main): [ Monterey+ Release ] fast/layoutformattingcontext (Layout-Tests) are a constant crash 
https://bugs.webkit.org/show_bug.cgi?id=259342
Summary REGRESSION(265506@Main): [ Monterey+ Release ] fast/layoutformattingcontext (...
Robert Jenner
Reported 2023-07-19 10:33:36 PDT
The following 10 fast/layoutformattingcontext layout-tests are constant crashes on Release for Monterey and higher: fast/layoutformattingcontext/fit-content-width-simple.html fast/layoutformattingcontext/inline-text-outside-of-inline-container-simple.html fast/layoutformattingcontext/line-heigt-when-text-is-inside-inline-container.html fast/layoutformattingcontext/table-basic-row-baseline-align.html fast/layoutformattingcontext/table-basic-row-vertical-align-baseline.html fast/layoutformattingcontext/table-cell-baseline-offset-simple.html fast/layoutformattingcontext/table-cell-baseline-offset-simple2.html fast/layoutformattingcontext/table-cell-vertical-alignment-simple.html fast/layoutformattingcontext/table-with-margin-content-simple.html fast/layoutformattingcontext/vertical-align-middle-simple.html HISTORY: https://results.webkit.org/?suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&test=fast%2Flayoutformattingcontext%2Ffit-content-width-simple.html&test=fast%2Flayoutformattingcontext%2Finline-text-outside-of-inline-container-simple.html&test=fast%2Flayoutformattingcontext%2Fline-heigt-when-text-is-inside-inline-container.html&test=fast%2Flayoutformattingcontext%2Ftable-basic-row-baseline-align.html&test=fast%2Flayoutformattingcontext%2Ftable-basic-row-vertical-align-baseline.html&test=fast%2Flayoutformattingcontext%2Ftable-cell-baseline-offset-simple.html&test=fast%2Flayoutformattingcontext%2Ftable-cell-baseline-offset-simple2.html&test=fast%2Flayoutformattingcontext%2Ftable-cell-vertical-alignment-simple.html&test=fast%2Flayoutformattingcontext%2Ftable-with-margin-content-simple.html&test=fast%2Flayoutformattingcontext%2Fvertical-align-middle-simple.html There is no crash log that appears to have been collected. The following is the stdout from these tests: STDOUT TEXT: No crash log found for com.apple.WebKit.WebContent.Development:39354. stdout: stderr: com.apple.WebKit.WebContent.Development terminated (pid 39354) for reason: crash https://build.webkit.org/results/Apple-Ventura-Release-WK2-Tests/266158@main%20(2948)/fast/layoutformattingcontext/fit-content-width-simple-crash-log.txt
Attachments
Add attachment proposed patch, testcase, etc.
Robert Jenner
Comment 1 2023-07-19 10:34:42 PDT
These tests all appear to have a pretty clear cut regression point as well. All starting at crashing at: https://commits.webkit.org/265506@main
Radar WebKit Bug Importer
Comment 2 2023-07-19 10:35:05 PDT
<rdar://problem/112540099>
Robert Jenner
Comment 3 2023-07-19 10:42:11 PDT
I was also able reproduce the crash at Ventura Release ToT running the test as follows: Run-webkit-tests <test_goes_here> Here is the crashed thread from my local repo case: Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 WebCore 0x10f129d14 WebCore::Layout::LineBuilder::inlineItemWidth(WebCore::Layout::InlineItem const&, float) const + 380 1 WebCore 0x10f12be98 WebCore::Layout::LineBuilder::placeInlineAndFloatContent(WebCore::Layout::InlineItemRange const&) + 4292 2 WebCore 0x10f12a0c4 WebCore::Layout::LineBuilder::layoutInlineContent(WebCore::Layout::LineBuilder::LineInput const&, std::__1::optional<WebCore::Layout::PreviousLine> const&) + 136 3 WebCore 0x10f11b778 WebCore::Layout::InlineFormattingContext::computedIntrinsicWidthForConstraint(WebCore::Layout::IntrinsicWidthMode) const + 496 4 WebCore 0x10f11b4cc WebCore::Layout::InlineFormattingContext::computedIntrinsicWidthConstraints() + 116 5 WebCore 0x10f0ffe18 WebCore::Layout::FormattingGeometry::computedWidthValue(WebCore::Layout::Box const&, WebCore::Layout::FormattingGeometry::WidthType, WebCore::LayoutUnit) const + 1280 6 WebCore 0x10f100098 WebCore::Layout::FormattingGeometry::computedWidth(WebCore::Layout::Box const&, WebCore::LayoutUnit) const + 36 7 WebCore 0x10f10a01c WebCore::Layout::BlockFormattingGeometry::inFlowNonReplacedContentWidthAndMargin(WebCore::Layout::ElementBox const&, WebCore::Layout::HorizontalConstraints const&, WebCore::Layout::OverriddenHorizontalValues const&) const + 272 8 WebCore 0x10f10ad28 auto WebCore::Layout::BlockFormattingGeometry::computedContentWidthAndMargin(WebCore::Layout::ElementBox const&, WebCore::Layout::HorizontalConstraints const&, std::__1::optional<WebCore::LayoutUnit>) const::$_17::operator()<WebCore::Layout::HorizontalConstraints>(WebCore::Layout::HorizontalConstraints, std::__1::optional<WebCore::LayoutUnit>) const + 440 9 WebCore 0x10f105fc4 WebCore::Layout::BlockFormattingContext::layoutInFlowContent(WebCore::Layout::ConstraintsForInFlowContent const&) + 1620 10 WebCore 0x10f0f76cc WebCore::Layout::LayoutContext::layout(WebCore::LayoutSize const&) + 556 11 WebCore 0x10f2c9b88 WebCore::LocalFrameViewLayoutContext::performLayout() + 2592 12 WebCore 0x10f2acc34 WebCore::LocalFrameViewLayoutContext::layout() + 44 13 WebCore 0x10d611d80 WebCore::Document::implicitClose() + 772 14 WebCore 0x10d6118ec WebCore::FrameLoader::checkCompleted() + 312 15 WebCore 0x10d6109b0 WebCore::FrameLoader::finishedParsing() + 340 16 WebCore 0x10d60fbec WebCore::Document::finishedParsing() + 612 17 WebCore 0x10d6094e4 WebCore::HTMLDocumentParser::prepareToStopParsing() + 256 18 WebCore 0x10d6091b0 WebCore::HTMLDocumentParser::finish() + 236 19 WebCore 0x10d608ddc WebCore::DocumentWriter::end() + 148 20 WebCore 0x10f175748 WebCore::DocumentLoader::finishedLoading() + 308 21 WebCore 0x10f2232a8 WebCore::CachedResource::checkNotify(WebCore::NetworkLoadMetrics const&) + 404 22 WebCore 0x10f220fd8 WebCore::CachedRawResource::finishLoading(WebCore::FragmentedSharedBuffer const*, WebCore::NetworkLoadMetrics const&) + 360 23 WebCore 0x10f1e9820 WebCore::SubresourceLoader::didFinishLoading(WebCore::NetworkLoadMetrics const&) + 692 24 WebKit 0x1042ed700 WebKit::WebResourceLoader::didFinishResourceLoad(WebCore::NetworkLoadMetrics&&) + 232 25 WebKit 0x1044be810 WebKit::WebResourceLoader::didReceiveWebResourceLoaderMessage(IPC::Connection&, IPC::Decoder&) + 748 26 WebKit 0x1044f1460 IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder>>) + 332 27 WebKit 0x1044f3ef4 WTF::Detail::CallableWrapper<IPC::Connection::enqueueIncomingMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder>>)::$_15, void>::call() + 148 28 JavaScriptCore 0x101575360 WTF::RunLoop::performWork() + 200 29 JavaScriptCore 0x10157622c WTF::RunLoop::performWork(void*) + 36 30 CoreFoundation 0x18e38e63c __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 28 31 CoreFoundation 0x18e38e5d0 __CFRunLoopDoSource0 + 176 32 CoreFoundation 0x18e38e340 __CFRunLoopDoSources0 + 244 33 CoreFoundation 0x18e38cf48 __CFRunLoopRun + 828 34 CoreFoundation 0x18e38c4b8 CFRunLoopRunSpecific + 612 35 Foundation 0x18f305fcc -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 212 36 Foundation 0x18f37eccc -[NSRunLoop(NSRunLoop) run] + 64 37 libxpc.dylib 0x18dffe594 _xpc_objc_main + 860 38 libxpc.dylib 0x18dffdeb4 xpc_main + 108 39 WebKit 0x103cd2d34 WebKit::XPCServiceMain(int, char const**) + 248 40 dyld 0x18df57f28 start + 2236
Robert Jenner
Comment 4 2023-07-19 10:51:11 PDT
I have also confirmed that 265506@main is what introduced this. These all start crashing when testing at 265506@main. They were not crashing at 265505@main. Starting on Alan who introduced: https://commits.webkit.org/265506@main that caused these tests to start crashing constantly.
EWS
Comment 5 2023-07-20 09:33:14 PDT
Test gardening commit 266181@main (3b4b5509d96e): <https://commits.webkit.org/266181@main> Reviewed commits have been landed. Closing PR #15948 and removing active labels.
zalan
Comment 6 2023-07-20 09:36:27 PDT
Thank you for taking care of this.
EWS
Comment 7 2023-08-07 17:57:41 PDT
Test gardening commit 266670@main (7e928333021b): <https://commits.webkit.org/266670@main> Reviewed commits have been landed. Closing PR #16458 and removing active labels.
Robert Jenner
Comment 8 2023-09-13 17:30:33 PDT
Re-opening for pull request https://github.com/apple/WebKit/pull/770
EWS
Comment 9 2023-09-13 17:35:43 PDT
Test gardening commit 265870.556@safari-7616-branch (e28e46dcc8a9): <https://commits.webkit.org/265870.556@safari-7616-branch> Reviewed commits have been landed. Closing PR #770 and removing active labels.
Note You need to log in before you can comment on or make changes to this bug.