Bug 73250 – REGRESSION(r101268): Intermittent assertion failure in fast/block/child-not-removed-from-parent-lineboxes-crash.html

• Status: RESOLVED
• Resolution: FIXED
• Component: New Bugs

[Zhenyao Mo]

This starts happening after r101268.

[Zhenyao Mo]

Added to test_expectations.txt in r101282

[Ryosuke Niwa]

Seems like this is a dup of 69275 or 69267.

http://test-results.appspot.com/dashboards/flakiness_dashboard.html#showExpectations=true&tests=fast%2Fblock%2Fchild-not-removed-from-parent-lineboxes-crash.html

ASSERTION FAILED: m_nestedIsolateCount >= 1
third_party/WebKit/Source/WebCore/platform/text/BidiResolver.h(203) : void WebCore::BidiResolver<Iterator, Run>::exitIsolate() [with Iterator = WebCore::InlineIterator, Run = WebCore::BidiRun]
1   0x159b84e
2   0x15b849b
3   0x15b81cb
4   0x15b80b6
5   0x15b9a46
6   0x15b9c79
7   0x15b3f2c
8   0x15b4cce
9   0x15b071f
10  0x15b03e9
11  0x15b2172
12  0x15735e2
13  0x1572dee
14  0x157686e
15  0x1576490
16  0x1573600
17  0x1572dee
18  0x157686e
19  0x1576490
20  0x1573600
21  0x1572dee
22  0x157686e
23  0x1576490
24  0x1573600
25  0x1572dee
26  0x16ab2be
27  0x12f52de
28  0xc85df7
29  0xc85ecb
30  0xcc9ec3
31  0x1741a41
[6729:6729:8033864725538:ERROR:process_util_posix.cc(134)] Received signal 11
	base::debug::StackTrace::StackTrace() [0x711356]
	base::(anonymous namespace)::StackDumpSignalHandler() [0x6ce0b9]
	0x7f40f34eaaf0
	WebCore::BidiResolver<>::exitIsolate() [0x159b853]
	WebCore::notifyObserverWillExitObject<>() [0x15b849b]
	WebCore::bidiNextShared<>() [0x15b81cb]
	WebCore::bidiNextSkippingEmptyInlines<>() [0x15b80b6]
	WebCore::InlineIterator::increment() [0x15b9a46]
	WebCore::BidiResolver<>::increment() [0x15b9c79]
	WebCore::RenderBlock::LineBreaker::skipLeadingWhitespace() [0x15b3f2c]
	WebCore::RenderBlock::LineBreaker::nextLineBreak() [0x15b4cce]
	WebCore::RenderBlock::layoutRunsAndFloatsInRange() [0x15b071f]
	WebCore::RenderBlock::layoutRunsAndFloats() [0x15b03e9]
	WebCore::RenderBlock::layoutInlineChildren() [0x15b2172]
	WebCore::RenderBlock::layoutBlock() [0x15735e2]
	WebCore::RenderBlock::layout() [0x1572dee]
	WebCore::RenderBlock::layoutBlockChild() [0x157686e]
	WebCore::RenderBlock::layoutBlockChildren() [0x1576490]
	WebCore::RenderBlock::layoutBlock() [0x1573600]
	WebCore::RenderBlock::layout() [0x1572dee]
	WebCore::RenderBlock::layoutBlockChild() [0x157686e]
	WebCore::RenderBlock::layoutBlockChildren() [0x1576490]
	WebCore::RenderBlock::layoutBlock() [0x1573600]
	WebCore::RenderBlock::layout() [0x1572dee]
	WebCore::RenderBlock::layoutBlockChild() [0x157686e]
	WebCore::RenderBlock::layoutBlockChildren() [0x1576490]
	WebCore::RenderBlock::layoutBlock() [0x1573600]
	WebCore::RenderBlock::layout() [0x1572dee]
	WebCore::RenderView::layout() [0x16ab2be]
	WebCore::FrameView::layout() [0x12f52de]
	WebCore::Document::updateLayout() [0xc85df7]
	WebCore::Document::updateLayoutIgnorePendingStylesheets() [0xc85ecb]
	WebCore::Element::offsetTop() [0xcc9ec3]
	WebCore::ElementInternal::offsetTopAttrGetter() [0x1741a41]
	0x6deacd2f240

[Csaba Osztrogonác]

Same assertion on Qt platform:

ASSERTION FAILED: m_nestedIsolateCount >= 1
../../../../Source/WebCore/platform/text/BidiResolver.h(203) : void WebCore::BidiResolver<Iterator, Run>::exitIsolate() [with Iterator = WebCore::InlineIterator, Run = WebCore::BidiRun]

[Csaba Osztrogonác]

Created attachment 116968 [details]
QtWebKit gdb backtrace

[Csaba Osztrogonác]

It is P1/critical bug, because it is a crash.

[Csaba Osztrogonác]

I added this test to the Qt Skipped list: http://trac.webkit.org/changeset/101389

Please unskip it with the proper fix. Thanks in advance.

[Ryosuke Niwa]

*** This bug has been marked as a duplicate of bug 69267 ***

[Ryosuke Niwa]

It appears that the assertion failure is still happening at least on Chromium bots:
http://test-results.appspot.com/dashboards/flakiness_dashboard.html#showExpectations=true&tests=fast%2Fblock%2Fchild-not-removed-from-parent-lineboxes-crash.html

[Ryosuke Niwa]

This is actually different assertion:
ASSERTION FAILED: !m_nestedIsolateCount
/Volumes/Data/webkit3/Source/WebCore/platform/text/BidiResolver.h(278) : WebCore::BidiResolver<Iterator, Run>::~BidiResolver() [with Iterator = WebCore::InlineIterator, Run = WebCore::BidiRun]
1   0x102ac166d WebCore::BidiResolver<WebCore::InlineIterator, WebCore::BidiRun>::~BidiResolver()
2   0x102ab9027 WebCore::RenderBlock::layoutRunsAndFloats(WebCore::LineLayoutState&, bool)
3   0x102ab952b WebCore::RenderBlock::layoutInlineChildren(bool, int&, int&)
4   0x102a8e116 WebCore::RenderBlock::layoutBlock(bool, int, WebCore::RenderBlock::BlockLayoutPass)
5   0x102a82087 WebCore::RenderBlock::layout()
6   0x102a8bbba WebCore::RenderBlock::layoutBlockChild(WebCore::RenderBox*, WebCore::RenderBlock::MarginInfo&, int&, int&)
7   0x102a8cb6a WebCore::RenderBlock::layoutBlockChildren(bool, int&)
8   0x102a8e12f WebCore::RenderBlock::layoutBlock(bool, int, WebCore::RenderBlock::BlockLayoutPass)
9   0x102a82087 WebCore::RenderBlock::layout()

The problem is that layoutRunsAndFloatsInRange could bail out early without exiting all inlines at:

        if (checkForEndLineMatch) {
            layoutState.setEndLineMatched(matchedEndLine(layoutState, resolver, cleanLineStart, cleanLineBidiStatus));
            if (layoutState.endLineMatched()) {
               break;

and

        end = lineBreaker.nextLineBreak(resolver, layoutState.lineInfo(), lineBreakIteratorInfo, lastFloatFromPreviousLine, consecutiveHyphenatedLines);
        if (resolver.position().atEnd()) {
            // FIXME: We shouldn't be creating any runs in findNextLineBreak to begin with!
            // Once BidiRunList is separated from BidiResolver this will not be needed.
            resolver.runs().deleteRuns();
            resolver.markCurrentRunEmpty(); // FIXME: This can probably be replaced by an ASSERT (or just removed).
            layoutState.setCheckForFloatsFromLastLine(true);
            break;

When this happens, the count hasn't been reset to 0 and we hit the assertion. I could either reset the counter before breaking in those two places or remove the assertion.

Eric & Mitz, do you have a preference?

[Eric Seidel (no email)]

It seems this assertion has been useful and we should keep it if possible.

[Ryosuke Niwa]

(In reply to comment #10)
> It seems this assertion has been useful and we should keep it if possible.

The assertion that has been useful is "m_nestedIsolateCount >= 1" in exitIsolate. The one we're hitting now is "!m_nestedIsolateCount" in ~BidiResolver.

[Ryosuke Niwa]

Created attachment 117536 [details]
fixes the bug

[Ryosuke Niwa]

Here's a patch to keep the assertion and reset the position.

[Darin Adler]

Comment on attachment 117536 [details]
fixes the bug

View in context: https://bugs.webkit.org/attachment.cgi?id=117536&action=review

> Source/WebCore/rendering/RenderBlockLineLayout.cpp:1212
> +                resolver.setPosition(InlineIterator(resolver.position().root(), 0, 0), 0);

Tragically verbose!

[Ryosuke Niwa]

Comment on attachment 117536 [details]
fixes the bug

View in context: https://bugs.webkit.org/attachment.cgi?id=117536&action=review

>> Source/WebCore/rendering/RenderBlockLineLayout.cpp:1212
>> +                resolver.setPosition(InlineIterator(resolver.position().root(), 0, 0), 0);
> 
> Tragically verbose!

I know :(  I'm hoping to get back to refactoring BidiResolver / InlineIterator in Q1 though.

[Ryosuke Niwa]

Committed r101733: <http://trac.webkit.org/changeset/101733>