NEW268789
NEW TEST (271917@main): ASSERTION FAILED: removed in FloatingObjects::removePlacedObject on imported/w3c/web-platform-tests/css/css-break/table/repeated-section/special-elements-crash.html. 
https://bugs.webkit.org/show_bug.cgi?id=268789
Summary NEW TEST (271917@main): ASSERTION FAILED: removed in FloatingObjects::removeP...
Marta Darbinyan
Reported 2024-02-05 16:20:26 PST
Description: imported/w3c/web-platform-tests/css/css-break/table/repeated-section/special-elements-crash.html Is a flaky crash on Debug Monterey and Ventura wk2 with assertion failure. The test has been failing on this configuration since it was added in 271917@main History: https://results.webkit.org/?suite=layout-tests&test=imported%2Fw3c%2Fweb-platform-tests%2Fcss%2Fcss-break%2Ftable%2Frepeated-section%2Fspecial-elements-crash.html&style=debug&flavor=wk2&version_name=Ventura&version_name=Monterey&recent=false Crash Log: ASSERTION FAILED: removed /Volumes/Data/worker/trunk-romee-debug-archive/build/OpenSource/Source/WebCore/rendering/FloatingObjects.cpp(352) : void WebCore::FloatingObjects::removePlacedObject(WebCore::FloatingObject *) 1 0x1078bee40 WTFCrash 2 0x2cdac5084 WTFCrashWithInfo(int, char const*, char const*, int) 3 0x2d002c32c WebCore::FloatingObjects::removePlacedObject(WebCore::FloatingObject*) 4 0x2d002c6a4 WebCore::FloatingObjects::remove(WebCore::FloatingObject*) 5 0x2d012fa8c WebCore::RenderBlockFlow::removeFloatingObject(WebCore::RenderBox&) 6 0x2d011c83c WebCore::RenderBlockFlow::markAllDescendantsWithFloatsForLayout(WebCore::RenderBox*, bool) 7 0x2d011c9a8 WebCore::RenderBlockFlow::markAllDescendantsWithFloatsForLayout(WebCore::RenderBox*, bool) 8 0x2d0139688 WebCore::RenderBox::removeFloatingAndInvalidateForLayout() 9 0x2d0139868 WebCore::RenderBox::removeFloatingOrPositionedChildFromBlockLists() 10 0x2d056ff24 WebCore::RenderTreeBuilder::destroyAndCleanUpAnonymousWrappers(WebCore::RenderObject&)::$_9::operator()() const 11 0x2d056fb84 WebCore::RenderTreeBuilder::destroyAndCleanUpAnonymousWrappers(WebCore::RenderObject&) 12 0x2d0586c6c WebCore::RenderTreeUpdater::tearDownRenderers(WebCore::Element&, WebCore::RenderTreeUpdater::TeardownType, WebCore::RenderTreeBuilder&)::$_13::operator()(unsigned int) const 13 0x2d0585624 WebCore::RenderTreeUpdater::tearDownRenderers(WebCore::Element&, WebCore::RenderTreeUpdater::TeardownType, WebCore::RenderTreeBuilder&) 14 0x2d05849f0 WebCore::RenderTreeUpdater::updateElementRenderer(WebCore::Element&, WebCore::Style::ElementUpdate const&) 15 0x2d0583d00 WebCore::RenderTreeUpdater::updateRenderTree(WebCore::ContainerNode&) 16 0x2d0583528 WebCore::RenderTreeUpdater::commit(std::__1::unique_ptr<WebCore::Style::Update, std::__1::default_delete<WebCore::Style::Update>>) 17 0x2ce453c84 WebCore::Document::updateRenderTree(std::__1::unique_ptr<WebCore::Style::Update, std::__1::default_delete<WebCore::Style::Update>>) 18 0x2ce454238 WebCore::Document::resolveStyle(WebCore::Document::ResolveStyleType) 19 0x2ce454f90 WebCore::Document::updateStyleIfNeeded() 20 0x2ce44f490 WebCore::Document::updateLayout(WTF::OptionSet<WebCore::LayoutOptions>, WebCore::Element const*) 21 0x2cf4ff034 WebCore::LocalFrameView::updateLayoutAndStyleIfNeededRecursive(WTF::OptionSet<WebCore::LayoutOptions>) 22 0x2cf5789ac WebCore::Page::layoutIfNeeded(WTF::OptionSet<WebCore::LayoutOptions>) 23 0x2cf579858 WebCore::Page::updateRendering() 24 0x13e53d788 WebKit::WebPage::updateRendering() 25 0x13d2c8944 WebKit::TiledCoreAnimationDrawingArea::updateRendering(WebKit::TiledCoreAnimationDrawingArea::UpdateRenderingType) 26 0x13d2c8840 WebKit::TiledCoreAnimationDrawingArea::forceRepaint() 27 0x13e53c194 WebKit::WebPage::forceRepaintWithoutCallback() 28 0x13dc500ac WKBundlePageForceRepaint 29 0x1061ee1ac WTR::InjectedBundlePage::dump(bool) 30 0x1061f2784 WTR::dumpAfterWaitAttributeIsRemoved(OpaqueWKBundlePage const*) 31 0x1061ed968 WTR::InjectedBundlePage::frameDidChangeLocation(OpaqueWKBundleFrame const*) com.apple.WebKit.WebContent.Development terminated (pid 11791) for reason: crash LEAK: 1 WebPageProxy Link: https://build-safari.apple.com/results/Trunk-RomeE-AppleSilicon-Debug-WK2-Tests/274090@main_e3455de67c7fdcdc59ebed414282b58946a8f7f2%20(5489)/imported/w3c/web-platform-tests/css/css-break/table/repeated-section/special-elements-crash-crash-log.txt
Attachments
Add attachment proposed patch, testcase, etc.
Radar WebKit Bug Importer
Comment 1 2024-02-05 16:21:06 PST
<rdar://problem/122350152>
EWS
Comment 2 2024-02-13 14:35:59 PST
Test gardening commit 274579@main (9e00c8503545): <https://commits.webkit.org/274579@main> Reviewed commits have been landed. Closing PR #24371 and removing active labels.
Note You need to log in before you can comment on or make changes to this bug.