Bug 73250 - REGRESSION(r101268): Intermittent assertion failure in fast/block/child-not-removed-from-parent-lineboxes-crash.html
Summary: REGRESSION(r101268): Intermittent assertion failure in fast/block/child-not-r...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: New Bugs (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P1 Critical
Assignee: Ryosuke Niwa
URL:
Keywords:
Depends on:
Blocks: 63903
  Show dependency treegraph
 
Reported: 2011-11-28 14:27 PST by Zhenyao Mo
Modified: 2011-12-01 18:39 PST (History)
4 users (show)

See Also:


Attachments
QtWebKit gdb backtrace (16.96 KB, text/plain)
2011-11-29 07:54 PST, Csaba Osztrogonác
no flags Details
fixes the bug (2.33 KB, patch)
2011-12-01 17:55 PST, Ryosuke Niwa
darin: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Zhenyao Mo 2011-11-28 14:27:34 PST
This starts happening after r101268.
Comment 1 Zhenyao Mo 2011-11-28 14:31:09 PST
Added to test_expectations.txt in r101282
Comment 2 Ryosuke Niwa 2011-11-28 15:40:27 PST
Seems like this is a dup of 69275 or 69267.

http://test-results.appspot.com/dashboards/flakiness_dashboard.html#showExpectations=true&tests=fast%2Fblock%2Fchild-not-removed-from-parent-lineboxes-crash.html

ASSERTION FAILED: m_nestedIsolateCount >= 1
third_party/WebKit/Source/WebCore/platform/text/BidiResolver.h(203) : void WebCore::BidiResolver<Iterator, Run>::exitIsolate() [with Iterator = WebCore::InlineIterator, Run = WebCore::BidiRun]
1   0x159b84e
2   0x15b849b
3   0x15b81cb
4   0x15b80b6
5   0x15b9a46
6   0x15b9c79
7   0x15b3f2c
8   0x15b4cce
9   0x15b071f
10  0x15b03e9
11  0x15b2172
12  0x15735e2
13  0x1572dee
14  0x157686e
15  0x1576490
16  0x1573600
17  0x1572dee
18  0x157686e
19  0x1576490
20  0x1573600
21  0x1572dee
22  0x157686e
23  0x1576490
24  0x1573600
25  0x1572dee
26  0x16ab2be
27  0x12f52de
28  0xc85df7
29  0xc85ecb
30  0xcc9ec3
31  0x1741a41
[6729:6729:8033864725538:ERROR:process_util_posix.cc(134)] Received signal 11
	base::debug::StackTrace::StackTrace() [0x711356]
	base::(anonymous namespace)::StackDumpSignalHandler() [0x6ce0b9]
	0x7f40f34eaaf0
	WebCore::BidiResolver<>::exitIsolate() [0x159b853]
	WebCore::notifyObserverWillExitObject<>() [0x15b849b]
	WebCore::bidiNextShared<>() [0x15b81cb]
	WebCore::bidiNextSkippingEmptyInlines<>() [0x15b80b6]
	WebCore::InlineIterator::increment() [0x15b9a46]
	WebCore::BidiResolver<>::increment() [0x15b9c79]
	WebCore::RenderBlock::LineBreaker::skipLeadingWhitespace() [0x15b3f2c]
	WebCore::RenderBlock::LineBreaker::nextLineBreak() [0x15b4cce]
	WebCore::RenderBlock::layoutRunsAndFloatsInRange() [0x15b071f]
	WebCore::RenderBlock::layoutRunsAndFloats() [0x15b03e9]
	WebCore::RenderBlock::layoutInlineChildren() [0x15b2172]
	WebCore::RenderBlock::layoutBlock() [0x15735e2]
	WebCore::RenderBlock::layout() [0x1572dee]
	WebCore::RenderBlock::layoutBlockChild() [0x157686e]
	WebCore::RenderBlock::layoutBlockChildren() [0x1576490]
	WebCore::RenderBlock::layoutBlock() [0x1573600]
	WebCore::RenderBlock::layout() [0x1572dee]
	WebCore::RenderBlock::layoutBlockChild() [0x157686e]
	WebCore::RenderBlock::layoutBlockChildren() [0x1576490]
	WebCore::RenderBlock::layoutBlock() [0x1573600]
	WebCore::RenderBlock::layout() [0x1572dee]
	WebCore::RenderBlock::layoutBlockChild() [0x157686e]
	WebCore::RenderBlock::layoutBlockChildren() [0x1576490]
	WebCore::RenderBlock::layoutBlock() [0x1573600]
	WebCore::RenderBlock::layout() [0x1572dee]
	WebCore::RenderView::layout() [0x16ab2be]
	WebCore::FrameView::layout() [0x12f52de]
	WebCore::Document::updateLayout() [0xc85df7]
	WebCore::Document::updateLayoutIgnorePendingStylesheets() [0xc85ecb]
	WebCore::Element::offsetTop() [0xcc9ec3]
	WebCore::ElementInternal::offsetTopAttrGetter() [0x1741a41]
	0x6deacd2f240
Comment 3 Csaba Osztrogonác 2011-11-29 07:29:47 PST
Same assertion on Qt platform:

ASSERTION FAILED: m_nestedIsolateCount >= 1
../../../../Source/WebCore/platform/text/BidiResolver.h(203) : void WebCore::BidiResolver<Iterator, Run>::exitIsolate() [with Iterator = WebCore::InlineIterator, Run = WebCore::BidiRun]
Comment 4 Csaba Osztrogonác 2011-11-29 07:54:46 PST
Created attachment 116968 [details]
QtWebKit gdb backtrace
Comment 5 Csaba Osztrogonác 2011-11-29 08:46:35 PST
It is P1/critical bug, because it is a crash.
Comment 6 Csaba Osztrogonác 2011-11-29 09:11:45 PST
I added this test to the Qt Skipped list: http://trac.webkit.org/changeset/101389

Please unskip it with the proper fix. Thanks in advance.
Comment 7 Ryosuke Niwa 2011-11-29 14:03:00 PST

*** This bug has been marked as a duplicate of bug 69267 ***
Comment 8 Ryosuke Niwa 2011-12-01 12:31:33 PST
It appears that the assertion failure is still happening at least on Chromium bots:
http://test-results.appspot.com/dashboards/flakiness_dashboard.html#showExpectations=true&tests=fast%2Fblock%2Fchild-not-removed-from-parent-lineboxes-crash.html
Comment 9 Ryosuke Niwa 2011-12-01 14:19:38 PST
This is actually different assertion:
ASSERTION FAILED: !m_nestedIsolateCount
/Volumes/Data/webkit3/Source/WebCore/platform/text/BidiResolver.h(278) : WebCore::BidiResolver<Iterator, Run>::~BidiResolver() [with Iterator = WebCore::InlineIterator, Run = WebCore::BidiRun]
1   0x102ac166d WebCore::BidiResolver<WebCore::InlineIterator, WebCore::BidiRun>::~BidiResolver()
2   0x102ab9027 WebCore::RenderBlock::layoutRunsAndFloats(WebCore::LineLayoutState&, bool)
3   0x102ab952b WebCore::RenderBlock::layoutInlineChildren(bool, int&, int&)
4   0x102a8e116 WebCore::RenderBlock::layoutBlock(bool, int, WebCore::RenderBlock::BlockLayoutPass)
5   0x102a82087 WebCore::RenderBlock::layout()
6   0x102a8bbba WebCore::RenderBlock::layoutBlockChild(WebCore::RenderBox*, WebCore::RenderBlock::MarginInfo&, int&, int&)
7   0x102a8cb6a WebCore::RenderBlock::layoutBlockChildren(bool, int&)
8   0x102a8e12f WebCore::RenderBlock::layoutBlock(bool, int, WebCore::RenderBlock::BlockLayoutPass)
9   0x102a82087 WebCore::RenderBlock::layout()

The problem is that layoutRunsAndFloatsInRange could bail out early without exiting all inlines at:

        if (checkForEndLineMatch) {
            layoutState.setEndLineMatched(matchedEndLine(layoutState, resolver, cleanLineStart, cleanLineBidiStatus));
            if (layoutState.endLineMatched()) {
               break;

and

        end = lineBreaker.nextLineBreak(resolver, layoutState.lineInfo(), lineBreakIteratorInfo, lastFloatFromPreviousLine, consecutiveHyphenatedLines);
        if (resolver.position().atEnd()) {
            // FIXME: We shouldn't be creating any runs in findNextLineBreak to begin with!
            // Once BidiRunList is separated from BidiResolver this will not be needed.
            resolver.runs().deleteRuns();
            resolver.markCurrentRunEmpty(); // FIXME: This can probably be replaced by an ASSERT (or just removed).
            layoutState.setCheckForFloatsFromLastLine(true);
            break;

When this happens, the count hasn't been reset to 0 and we hit the assertion. I could either reset the counter before breaking in those two places or remove the assertion.

Eric & Mitz, do you have a preference?
Comment 10 Eric Seidel (no email) 2011-12-01 14:40:00 PST
It seems this assertion has been useful and we should keep it if possible.
Comment 11 Ryosuke Niwa 2011-12-01 14:44:31 PST
(In reply to comment #10)
> It seems this assertion has been useful and we should keep it if possible.

The assertion that has been useful is "m_nestedIsolateCount >= 1" in exitIsolate. The one we're hitting now is "!m_nestedIsolateCount" in ~BidiResolver.
Comment 12 Ryosuke Niwa 2011-12-01 17:55:54 PST
Created attachment 117536 [details]
fixes the bug
Comment 13 Ryosuke Niwa 2011-12-01 17:57:00 PST
Here's a patch to keep the assertion and reset the position.
Comment 14 Darin Adler 2011-12-01 18:01:54 PST
Comment on attachment 117536 [details]
fixes the bug

View in context: https://bugs.webkit.org/attachment.cgi?id=117536&action=review

> Source/WebCore/rendering/RenderBlockLineLayout.cpp:1212
> +                resolver.setPosition(InlineIterator(resolver.position().root(), 0, 0), 0);

Tragically verbose!
Comment 15 Ryosuke Niwa 2011-12-01 18:03:51 PST
Comment on attachment 117536 [details]
fixes the bug

View in context: https://bugs.webkit.org/attachment.cgi?id=117536&action=review

>> Source/WebCore/rendering/RenderBlockLineLayout.cpp:1212
>> +                resolver.setPosition(InlineIterator(resolver.position().root(), 0, 0), 0);
> 
> Tragically verbose!

I know :(  I'm hoping to get back to refactoring BidiResolver / InlineIterator in Q1 though.
Comment 16 Ryosuke Niwa 2011-12-01 18:39:18 PST
Committed r101733: <http://trac.webkit.org/changeset/101733>