Bug 281041 – REGRESSION: ASSERTION FAILED: repaintRects() in WebCore::RenderLayer::recursiveUpdateLayerPositions

• Status: RESOLVED
• Resolution: FIXED
• Component: Layout and Rendering

[Fujii Hironori]

REGRESSION: [Win] ASSERTION FAILED: repaintRects() in WebCore::RenderLayer::recursiveUpdateLayerPositions

Windows port Debug build layout tests are crashing.

Regressions: Unexpected crashes (3)
  animations/animation-direction-reverse-hardware-opacity.html [ Crash ]
  animations/animation-followed-by-two-transitions.html [ Crash ]
  imported/w3c/web-platform-tests/scroll-animations/css/animation-timeline-view-functional-notation.tentative.html [ Crash ]

ASSERTION FAILED: repaintRects()
C:\ews\work\build\Source\WebCore\rendering/RenderLayer.cpp(1213) : auto WebCore::RenderLayer::recursiveUpdateLayerPositions(RenderElement::LayoutIdentifier, OptionSet<UpdateLayerPositionsFlag>, CanUseSimplifiedRepaintPass)::(anonymous class)::operator()(bool) const
1   00007FFBC6F041CD WebCore::RenderLayer::recursiveUpdateLayerPositions<1>::<lambda_1>::operator()
2   00007FFBC6F03308 WebCore::RenderLayer::recursiveUpdateLayerPositions<1>
3   00007FFBC6F03A12 WebCore::RenderLayer::recursiveUpdateLayerPositions<1>
4   00007FFBC6F03A12 WebCore::RenderLayer::recursiveUpdateLayerPositions<1>
5   00007FFBC6EF1B16 WebCore::RenderLayer::recursiveUpdateLayerPositions<0>
6   00007FFBC6ECEF1C WebCore::RenderLayer::updateLayerPositionsAfterStyleChange
7   00007FFBC664CE2B WebCore::LocalFrameView::updateCompositingLayersAfterStyleChange
8   00007FFBC571C6B7 WebCore::Document::resolveStyle
9   00007FFBC571CDBC WebCore::Document::updateStyleIfNeeded
10  00007FFBC571D164 WebCore::Document::updateLayout
11  00007FFBC6660B15 WebCore::LocalFrameView::updateLayoutAndStyleIfNeededRecursive
12  00007FFBC66E2B22 WebCore::Page::layoutIfNeeded
13  00007FFBC66E392C WebCore::Page::updateRendering
14  00007FFBCFF70350 WebKit::WebPage::updateRendering
15  00007FFBCE3D4F32 WebKit::DrawingAreaWC::updateRendering
16  00007FFBCE3DDF19 std::invoke<void (WebKit::DrawingAreaWC::*&)(),WebKit::DrawingAreaWC *&>
17  00007FFBCE3DDE9D std::_Invoker_ret<std::_Unforced>::_Call<void (WebKit::DrawingAreaWC::*&)(),WebKit::DrawingAreaWC *&>
18  00007FFBCE3DDE59 std::_Call_binder<std::_Unforced,0,void (WebKit::DrawingAreaWC::*)(),std::tuple<WebKit::DrawingAreaWC *>,std::tuple<> >
19  00007FFBCE3DDDF1 std::_Binder<std::_Unforced,void (WebKit::DrawingAreaWC::*&)(),WebKit::DrawingAreaWC *>::operator()<>
20  00007FFBCE3DDCD7 WTF::Detail::CallableWrapper<std::_Binder<std::_Unforced,void (WebKit::DrawingAreaWC::*&)(),WebKit::DrawingAreaWC *>,void>::call
21  00007FFBCE37145E WTF::Function<void ()>::operator()
22  00007FFBCE3DC737 WebCore::Timer::fired
23  00007FFBC68D86F7 WebCore::ThreadTimers::sharedTimerFiredInternal
24  00007FFBC68DAB8E WebCore::ThreadTimers::setSharedTimer::<lambda_0>::operator()
25  00007FFBC68DAB47 WTF::Detail::CallableWrapper<`lambda at C:\ews\work\build\Source\WebCore\platform\ThreadTimers.cpp:68:41',void>::call
26  00007FFBC289EB7E WTF::Function<void ()>::operator()
27  00007FFBC6880C3D WebCore::MainThreadSharedTimer::fired
28  00007FFBC29DE648 WebCore::TimerWindowWndProc
29  00007FFC44ACEF5C CallWindowProcW
30  00007FFC44ACE684 DispatchMessageW
31  00007FFBCD314B32 WTF::RunLoop::run
C:\ews\work\build\Source\WebKit\UIProcess/WebProcessProxy.cpp(1241) : virtual void WebKit::WebProcessProxy::didClose(IPC::Connection &)
ERROR: 00000195D1726C60 - [PID=10044] WebProcessProxy::processDidTerminateOrFailedToLaunch: reason=Crash
C:\ews\work\build\Source\WebKit\UIProcess/WebProcessProxy.cpp(1249) : void WebKit::WebProcessProxy::processDidTerminateOrFailedToLaunch(ProcessTerminationReason)
ERROR: 00000195D16FE800 - [pageProxyID=8, webPageID=9, PID=10044] WebPageProxy::processDidTerminate: (pid 10044), reason=Crash
C:\ews\work\build\Source\WebKit\UIProcess/WebPageProxy.cpp(10433) : void WebKit::WebPageProxy::resetStateAfterProcessTermination(ProcessTerminationReason)
ERROR: 00000195D16FE800 - [pageProxyID=8, webPageID=9, PID=10044] WebPageProxy::dispatchProcessDidTerminate: reason=Crash
C:\ews\work\build\Source\WebKit\UIProcess/WebPageProxy.cpp(10495) : void WebKit::WebPageProxy::dispatchProcessDidTerminate(ProcessTerminationReason)
WebProcess terminated (pid 10044) for reason: crash
#CRASHED - WebProcess (pid 10044)

[Fujii Hironori]

284805@main: bad
284796@main: good

284802@main (bug#280316) seems to be a culprit.

[Fujii Hironori]

History:
  https://results.webkit.org/?suite=layout-tests&suite=layout-tests&suite=layout-tests&test=imported%2Fw3c%2Fweb-platform-tests%2Fscroll-animations%2Fcss%2Fanimation-timeline-view-functional-notation.tentative.html&test=animations%2Fanimation-followed-by-two-transitions.html&test=animations%2Fanimation-direction-reverse-hardware-opacity.html&style=debug

[Fujii Hironori]

This is not Windows port specific.
Mac port Debug build uses ENABLE_CONJECTURE_ASSERT=1. This crash is reproducible with __XPC_ENABLE_WEBKIT_CONJECTURE_ASSERT.

> ./Tools/Scripts/run-webkit-tests --debug --no-build --additional-env-var=__XPC_ENABLE_WEBKIT_CONJECTURE_ASSERT=1 animations/animation-direction-reverse-hardware-opacity.html animations/animation-followed-by-two-transitions.html imported/w3c/web-platform-tests/scroll-animations/css/animation-timeline-view-functional-notation.tentative.html

[Fujii Hironori]

284780@main added the conjecture assertion.

*** Bug 281207 has been marked as a duplicate of this bug. ***

[Radar WebKit Bug Importer]

<rdar://problem/137722495>

[Matt Woodrow]

Pull request: https://github.com/WebKit/WebKit/pull/35021

[EWS]

Committed 285155@main (b37bf876c9b7): <https://commits.webkit.org/285155@main>

Reviewed commits have been landed. Closing PR #35021 and removing active labels.