Bug 262157 – [content-visibility] ASSERTION FAILED: !renderer.needsLayout() causing imported/w3c/web-platform-tests/css/css-contain/content-visibility/content-visibility-video.html to constantly crash

• Status: RESOLVED
• Resolution: FIXED
• Component: Media

[Ben Schwartz]

Created attachment 467885 [details]
content-visibility-video-diff.png

imported/w3c/web-platform-tests/css/css-contain/content-visibility/content-visibility-video.html

This test is:
 - A constant crash on wk2 debug (including gpuprocess)
 - A constant ImageOnlyFailure on wk2 release (expectation was previously set for macOS but removed in 268447@main)

HISTORY:

https://results.webkit.org/?suite=layout-tests&test=imported%2Fw3c%2Fweb-platform-tests%2Fcss%2Fcss-contain%2Fcontent-visibility%2Fcontent-visibility-video.html&flavor=wk2&flavor=gpuprocess&platform=ios&platform=mac

CRASH LOG:

(cpu_info.cc:53): Available number of cores: 8
ASSERTION FAILED: !renderer.needsLayout()
/Volumes/Data/worker/Apple-Ventura-Debug-Build/build/Source/WebCore/rendering/RenderBlock.cpp(3152) : void WebCore::RenderBlock::checkPositionedObjectsNeedLayout()
1   0x105503128 WTFCrash
2   0x2cb04cc90 WTF::RefPtr<WebCore::AudioWorkletMessagingProxy, WTF::RawPtrTraits<WebCore::AudioWorkletMessagingProxy>, WTF::DefaultRefDerefTraits<WebCore::AudioWorkletMessagingProxy>>::operator->() const
3   0x2cd775328 WebCore::RenderBlock::checkPositionedObjectsNeedLayout()
4   0x2cd92ce0c WebCore::RenderObject::checkBlockPositionedObjectsNeedLayout()
5   0x2cd92cd6c WebCore::RenderObject::clearNeedsLayout()
6   0x2cd81d1bc WebCore::RenderElement::clearNeedsLayoutForDescendants()
7   0x2cd77eda4 WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&)
8   0x2cd77d620 WebCore::RenderBlockFlow::layoutInFlowChildren(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&, WebCore::LayoutUnit&)
9   0x2cd77c7d0 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit)
10  0x2cd7600f0 WebCore::RenderBlock::layout()
11  0x2cccf3580 WebCore::LocalFrameViewLayoutContext::performLayout()
12  0x2cccd1ae0 WebCore::LocalFrameViewLayoutContext::layout()
13  0x2cccece40 WebCore::LocalFrameView::updateLayoutAndStyleIfNeededRecursive()
14  0x2ccd54764 WebCore::Page::layoutIfNeeded()
15  0x2ccd5549c WebCore::Page::updateRendering()
16  0x1321bd578 WebKit::WebPage::updateRendering()
17  0x13129dd5c WebKit::TiledCoreAnimationDrawingArea::updateRendering(WebKit::TiledCoreAnimationDrawingArea::UpdateRenderingType)
18  0x1312a2550 WebKit::TiledCoreAnimationDrawingArea::renderingUpdateRunLoopCallback()
19  0x1312a3894 WebKit::TiledCoreAnimationDrawingArea::TiledCoreAnimationDrawingArea(WebKit::WebPage&, WebKit::WebPageCreationParameters const&)::$_0::operator()() const
20  0x1312a3840 WTF::Detail::CallableWrapper<WebKit::TiledCoreAnimationDrawingArea::TiledCoreAnimationDrawingArea(WebKit::WebPage&, WebKit::WebPageCreationParameters const&)::$_0, void>::call()
21  0x2c85ec7dc WTF::Function<void ()>::operator()() const
22  0x2ccf6fa18 WebCore::RunLoopObserver::runLoopObserverFired()
23  0x2cd043dd0 WebCore::RunLoopObserver::runLoopObserverFired(__CFRunLoopObserver*, unsigned long, void*)
24  0x19b5c99f0 __CFRUNLOOP_IS_CALLING_OUT_TO_AN_OBSERVER_CALLBACK_FUNCTION__
25  0x19b5c98dc __CFRunLoopDoObservers
26  0x19b5c8514 CFRunLoopRunSpecific
27  0x19c541fbc -[NSRunLoop(NSRunLoop) runMode:beforeDate:]
28  0x19c5bacbc -[NSRunLoop(NSRunLoop) run]
29  0x19b23a594 _xpc_objc_main
30  0x19b239eb4 xpc_main
31  0x1305c6af4 WebKit::XPCServiceMain(int, char const**)
com.apple.WebKit.WebContent.Development terminated (pid 95629) for reason: crash
LEAK: 1 WebPageProxy

IMAGE DIFF:

Attached.

IMAGES URL (for failure):

https://build.webkit.org/results/Apple-Ventura-Release-AppleSilicon-WK2-Tests/268483@main%20(5138)/imported/w3c/web-platform-tests/css/css-contain/content-visibility/content-visibility-video-diffs.html

[Radar WebKit Bug Importer]

<rdar://problem/116093262>

[Ben Schwartz]

REPRODUCIBILITY:

I was able to reproduce these issues on macOS Ventura (13.5, 22G74/arm64) ToT using the following commands:

run-webkit-tests --debug --verbose imported/w3c/web-platform-tests/css/css-contain/content-visibility/content-visibility-video.html
run-webkit-tests --verbose imported/w3c/web-platform-tests/css/css-contain/content-visibility/content-visibility-video.html

REGRESSION:

I was able to identify a potential regression point at 268154@main. As I don't have access to a reliable testing environment, I can't bisect to be sure; however, changes at this point seem directly related to the issue and the constant ImageOnlyFailures/crashes began at this point.

[EWS]

Test gardening commit 268490@main (29955443e6a9): <https://commits.webkit.org/268490@main>

Reviewed commits have been landed. Closing PR #18257 and removing active labels.

[Tim Nguyen (:ntim)]

*** Bug 263910 has been marked as a duplicate of this bug. ***

[Tim Nguyen (:ntim)]

From zalan in the duplicate bug:
This is caused by the incorrect order of clearing the needsLayout bits when skipping a subtree (out of flow vs. simple preorder tree traversal)

From Rob Buis:
This seems a dupe of bug 262157.

I think https://github.com/WebKit/WebKit/pull/19710 fixes this.

[Vitaly Dyackhov]

Pull request: https://github.com/WebKit/WebKit/pull/25713

[EWS]

Committed 277019@main (836cb999ce8c): <https://commits.webkit.org/277019@main>

Reviewed commits have been landed. Closing PR #25713 and removing active labels.