Created attachment 467925 [details] testcase to trigger the crash ASSERTION FAILED: *trailingRunIndex >= overflowingRunIndex /app/webkit/Source/WebCore/layout/formattingContexts/inline/InlineContentBreaker.cpp(616) : std::optional<WebCore::Layout::InlineContentBreaker::OverflowingTextContent::BreakingPosition> WebCore::Layout::InlineContentBreaker::tryBreakingNextOverflowingRuns(const LineStatus&, const ContinuousContent::RunList&, size_t, WebCore::Layout::InlineLayoutUnit) const 1 0x7f6f85a5a3f3 WTFCrash 2 0x7f6f8fb1cda9 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0x8d5eda9) [0x7f6f8fb1cda9] 3 0x7f6f94feeb0a /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xe230b0a) [0x7f6f94feeb0a] 4 0x7f6f94fef8e3 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xe2318e3) [0x7f6f94fef8e3] 5 0x7f6f94feb529 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xe22d529) [0x7f6f94feb529] 6 0x7f6f94febde1 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xe22dde1) [0x7f6f94febde1] 7 0x7f6f94feae06 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xe22ce06) [0x7f6f94feae06] 8 0x7f6f94feaefc /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xe22cefc) [0x7f6f94feaefc] 9 0x7f6f95035eb1 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xe277eb1) [0x7f6f95035eb1] 10 0x7f6f95031212 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xe273212) [0x7f6f95031212] 11 0x7f6f95031d02 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xe273d02) [0x7f6f95031d02] 12 0x7f6f9503026d /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xe27226d) [0x7f6f9503026d] 13 0x7f6f94ff7c5d /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xe239c5d) [0x7f6f94ff7c5d] 14 0x7f6f94ff72b9 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xe2392b9) [0x7f6f94ff72b9] 15 0x7f6f950d1983 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xe313983) [0x7f6f950d1983] 16 0x7f6f95e3148d /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xf07348d) [0x7f6f95e3148d] 17 0x7f6f95e1f9aa /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xf0619aa) [0x7f6f95e1f9aa] 18 0x7f6f95e1ea83 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xf060a83) [0x7f6f95e1ea83] 19 0x7f6f95e1da39 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xf05fa39) [0x7f6f95e1da39] 20 0x7f6f95e0b0b3 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xf04d0b3) [0x7f6f95e0b0b3] 21 0x7f6f95e1fde9 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xf061de9) [0x7f6f95e1fde9] 22 0x7f6f95e1f08b /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xf06108b) [0x7f6f95e1f08b] 23 0x7f6f95e1eac2 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xf060ac2) [0x7f6f95e1eac2] 24 0x7f6f95e1da39 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xf05fa39) [0x7f6f95e1da39] 25 0x7f6f95e0b0b3 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xf04d0b3) [0x7f6f95e0b0b3] 26 0x7f6f95e1fde9 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xf061de9) [0x7f6f95e1fde9] 27 0x7f6f95e1f08b /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xf06108b) [0x7f6f95e1f08b] 28 0x7f6f95e1eac2 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xf060ac2) [0x7f6f95e1eac2] 29 0x7f6f95e1da39 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xf05fa39) [0x7f6f95e1da39] 30 0x7f6f95e0b0b3 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xf04d0b3) [0x7f6f95e0b0b3] 31 0x7f6f950b07b1 /app/webkit/WebKitBuild/Debug/lib/libwebkit2gtk-4.1.so.0(+0xe2f27b1) [0x7f6f950b07b1] ** (MiniBrowser:17): WARNING **: 07:23:56.373: WebProcess CRASHED
Created attachment 467973 [details] Test reduction
Created attachment 467974 [details] [fast-cq]Patch
Committed 268772@main (77a511bb1339): <https://commits.webkit.org/268772@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 467974 [details].
<rdar://problem/116400479>