Bug 286777 – REGRESSION(289503@main): [macOS iOS wk2 Debug] ASSERTION FAILED: clipRectsContext.rootLayer == m_clipRectsCache->m_clipRectsRoot (failure in EWS)

• Status: RESOLVED
• Resolution: FIXED
• Component: New Bugs

[Marta Darbinyan]

The following test is a flaky crash on macOS. The test started crashing within the range of 289503@main...289510@main.
fast/css/view-transitions-zoom.html

Crash log:
0  com.apple.WebCore          	       0x142c5f5a8 WTFCrashWithInfo(int, char const*, char const*, int)
1  com.apple.WebCore          	       0x1497d3c84 WebCore::RenderLayer::updateClipRects(WebCore::RenderLayer::ClipRectsContext const&)
2  com.apple.WebCore          	       0x1497d4328 WebCore::RenderLayer::parentClipRects(WebCore::RenderLayer::ClipRectsContext const&) const
3  com.apple.WebCore          	       0x1497d3df4 WebCore::RenderLayer::updateClipRects(WebCore::RenderLayer::ClipRectsContext const&)
4  com.apple.WebCore          	       0x1497d4328 WebCore::RenderLayer::parentClipRects(WebCore::RenderLayer::ClipRectsContext const&) const
5  com.apple.WebCore          	       0x1497c8a2c WebCore::RenderLayer::backgroundClipRect(WebCore::RenderLayer::ClipRectsContext const&) const
6  com.apple.WebCore          	       0x1497cf840 WebCore::RenderLayer::calculateRects(WebCore::RenderLayer::ClipRectsContext const&, WebCore::LayoutRect const&, WebCore::LayoutRect&, WebCore::ClipRect&, WebCore::ClipRect&, WebCore::LayoutSize const&) const
7  com.apple.WebCore          	       0x1497cd270 WebCore::RenderLayer::collectFragments(WTF::Vector<WebCore::LayerFragment, 1ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&, WebCore::RenderLayer const*, WebCore::LayoutRect const&, WebCore::RenderLayer::PaginationInclusionMode, WebCore::ClipRectsType, WTF::OptionSet<WebCore::RenderLayer::ClipRectsOption>, WebCore::LayoutSize const&, WebCore::LayoutRect const*, WebCore::ShouldApplyRootOffsetToFragments)
8  com.apple.WebCore          	       0x1497ca084 WebCore::RenderLayer::paintLayerContents(WebCore::GraphicsContext&, WebCore::RenderLayer::LayerPaintingInfo const&, WTF::OptionSet<WebCore::RenderLayer::PaintLayerFlag>)
9  com.apple.WebCore          	       0x1497c9354 WebCore::RenderLayer::paintLayerContentsAndReflection(WebCore::GraphicsContext&, WebCore::RenderLayer::LayerPaintingInfo const&, WTF::OptionSet<WebCore::RenderLayer::PaintLayerFlag>)
10  com.apple.WebCore          	       0x1497c8200 WebCore::RenderLayer::paintLayerWithEffects(WebCore::GraphicsContext&, WebCore::RenderLayer::LayerPaintingInfo const&, WTF::OptionSet<WebCore::RenderLayer::PaintLayerFlag>)
11  com.apple.WebCore          	       0x1497c71b4 WebCore::RenderLayer::paintLayer(WebCore::GraphicsContext&, WebCore::RenderLayer::LayerPaintingInfo const&, WTF::OptionSet<WebCore::RenderLayer::PaintLayerFlag>)

Test result link:
https://build.webkit.org/#/builders/1226/builds/682

History:
https://results.webkit.org/?suite=layout-tests&test=fast%2Fcss%2Fview-transitions-zoom.html&flavor=wk2&style=debug

[Radar WebKit Bug Importer]

<rdar://problem/143918241>

[EWS]

Test gardening commit 289586@main (1814ea8e6823): <https://commits.webkit.org/289586@main>

Reviewed commits have been landed. Closing PR #39788 and removing active labels.

[Robert Jenner]

This crash does not reproduce on standalone. However, I am able to reproduce it in a test list at Sequoia Debug ToT running the test as follows:


run-webkit-tests --debug --test-list <test_list_goes_here> --child-process=1 


I will attach the test list to this bug.

[Robert Jenner]

Created attachment 474077 [details]
Test list attachment for reproducing crash

[Marta Darbinyan]

fast/multicol/assert-with-nested-columns-and-spanner.html
imported/w3c/web-platform-tests/css/css-break/table/repeated-section/special-elements-crash.html

I found more crashing tests with the much narrowed down range. Those tests most likely regressed on 289503@main based on the test run results in EWS. 

I could reproduce the crash on 289503@main by running 

run-webkit-tests --root  --debug imported/w3c/web-platform-tests/css/css-break/table/repeated-section/special-elements-crash.html --child-process=1

Test history:
https://results.webkit.org/?flavor=wk2&style=debug&suite=layout-tests&suite=layout-tests&test=fast%2Fmulticol%2Fassert-with-nested-columns-and-spanner.html&test=imported%2Fw3c%2Fweb-platform-tests%2Fcss%2Fcss-break%2Ftable%2Frepeated-section%2Fspecial-elements-crash.html


stderr:
ASSERTION FAILED: clipRectsContext.rootLayer == m_clipRectsCache->m_clipRectsRoot[clipRectsType]
/Volumes/Data/worker/Apple-Sonoma-Debug-Build/build/Source/WebCore/rendering/RenderLayer.cpp(4933) : Ref<ClipRects> WebCore::RenderLayer::updateClipRects(const ClipRectsContext &)
1   0x36b397780 WebCore::RenderLayer::updateClipRects(WebCore::RenderLayer::ClipRectsContext const&)
2   0x36b397e48 WebCore::RenderLayer::parentClipRects(WebCore::RenderLayer::ClipRectsContext const&) const
3   0x36b39791c WebCore::RenderLayer::updateClipRects(WebCore::RenderLayer::ClipRectsContext const&)
4   0x36b397e48 WebCore::RenderLayer::parentClipRects(WebCore::RenderLayer::ClipRectsContext const&) const
5   0x36b38c56c WebCore::RenderLayer::backgroundClipRect(WebCore::RenderLayer::ClipRectsContext const&) const
6   0x36b393370 WebCore::RenderLayer::calculateRects(WebCore::RenderLayer::ClipRectsContext const&, WebCore::LayoutRect const&, WebCore::LayoutRect&, WebCore::ClipRect&, WebCore::ClipRect&, WebCore::LayoutSize const&) const
7   0x36b390da4 WebCore::RenderLayer::collectFragments(WTF::Vector<WebCore::LayerFragment, 1ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&, WebCore::RenderLayer const*, WebCore::LayoutRect const&, WebCore::RenderLayer::PaginationInclusionMode, WebCore::ClipRectsType, WTF::OptionSet<WebCore::RenderLayer::ClipRectsOption>, WebCore::LayoutSize const&, WebCore::LayoutRect const*, WebCore::ShouldApplyRootOffsetToFragments)

[EWS]

Test gardening commit 289588@main (eb32f4820c61): <https://commits.webkit.org/289588@main>

Reviewed commits have been landed. Closing PR #39793 and removing active labels.

[Matt Woodrow]

Pull request: https://github.com/WebKit/WebKit/pull/39800

[EWS]

Committed 289597@main (2541a0af24cd): <https://commits.webkit.org/289597@main>

Reviewed commits have been landed. Closing PR #39800 and removing active labels.