Bug 206241

Summary: REGRESSION: WK1 Accessibility: ASSERTION FAILED: FontCache::singleton().generation() == m_generation
Product: WebKit Reporter: David Kilzer (:ddkilzer) <ddkilzer>
Component: TextAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: aakash_jain, ap, cdumez, cfleizach, commit-queue, dbates, esprehn+autocc, ews-watchlist, jlewis3, kangil.han, koivisto, mmaxfield, tsavell, webkit-bot-watchers-bugzilla, webkit-bug-importer, zalan
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
See Also: https://bugs.webkit.org/show_bug.cgi?id=204933
https://bugs.webkit.org/show_bug.cgi?id=206599
https://bugs.webkit.org/show_bug.cgi?id=206991
Attachments:
Description Flags
try to get backtrace from bot
none
again
none
again
none
again
none
again
none
again
none
again
none
again
none
again
none
another
none
patch
none
patch
none
patch
none
alternative approach none

Description David Kilzer (:ddkilzer) 2020-01-14 09:28:09 PST 
The following layout tests are flakey crashes on Apple Mojave Debug WK1 (Tests):

  accessibility/mac/search-text/search-text.html
  <https://webkit-test-results.webkit.org/dashboards/flakiness_dashboard.html#showAllRuns=true&tests=accessibility%2Fmac%2Fsearch-text%2Fsearch-text.html>

  accessibility/mac/select-text/select-text-1.html
  <https://webkit-test-results.webkit.org/dashboards/flakiness_dashboard.html#showAllRuns=true&revision=254433&tests=accessibility%2Fmac%2Fselect-text%2Fselect-text-1.html>

Example test run:  <https://build.webkit.org/builders/Apple%20Mojave%20Debug%20WK1%20(Tests)/builds/7970>
Example test results:  <https://build.webkit.org/results/Apple%20Mojave%20Debug%20WK1%20(Tests)/r254433%20(7970)/results.html>

This crash is the same assertion as this bug, but seems to have a different cause (and different stack trace):

  Bug 204933: REGRESSION: ASSERTION FAILED: FontCache::singleton().generation() == m_generation

Assertion failure:

ASSERTION FAILED: FontCache::singleton().generation() == m_generation
./platform/graphics/FontCascadeFonts.cpp(180) : const WebCore::FontRanges &WebCore::FontCascadeFonts::realizeFallbackRangesAt(const WebCore::FontCascadeDescription &, unsigned int)
1   0x115928659 WTFCrash
2   0x126a72f8b WTFCrashWithInfo(int, char const*, char const*, int)
3   0x12a30617d WebCore::FontCascadeFonts::realizeFallbackRangesAt(WebCore::FontCascadeDescription const&, unsigned int)
4   0x126c12101 WebCore::FontCascadeFonts::primaryFont(WebCore::FontCascadeDescription const&)
5   0x126c0c1e4 WebCore::FontCascade::primaryFont() const
6   0x1298bc475 WebCore::FontCascade::fontMetrics() const
7   0x12aae5a55 WebCore::RenderStyle::fontMetrics() const
8   0x128fee241 WebCore::CSSPrimitiveValue::equalForLengthResolution(WebCore::RenderStyle const&, WebCore::RenderStyle const&)
9   0x12ac10884 WebCore::Style::MatchedDeclarationsCache::Entry::isUsableAfterHighPriorityProperties(WebCore::RenderStyle const&) const
10  0x12ac5e429 WebCore::Style::Resolver::applyMatchedProperties(WebCore::Style::Resolver::State&, WebCore::Style::MatchResult const&, WebCore::Style::Resolver::UseMatchedDeclarationsCache)
11  0x12ac5cdcc WebCore::Style::Resolver::styleForElement(WebCore::Element const&, WebCore::RenderStyle const*, WebCore::RenderStyle const*, WebCore::RuleMatchingBehavior, WebCore::SelectorFilter const*)
12  0x12ac89e52 WebCore::Style::TreeResolver::styleForElement(WebCore::Element&, WebCore::RenderStyle const&)
13  0x12ac8a37b WebCore::Style::TreeResolver::resolveElement(WebCore::Element&)
14  0x12ac8be09 WebCore::Style::TreeResolver::resolveComposedTree()
15  0x12ac8cbc8 WebCore::Style::TreeResolver::resolve()
16  0x12922d34d WebCore::Document::resolveStyle(WebCore::Document::ResolveStyleType)
17  0x12922debd WebCore::Document::updateStyleIfNeeded()
18  0x129229249 WebCore::Document::updateLayout()
19  0x12922a7ce WebCore::Document::updateLayoutIgnorePendingStylesheets(WebCore::Document::RunPostLayoutTasks)
20  0x128bd982e WebCore::AccessibilityObject::updateBackingStore()
21  0x12b2461ba -[WebAccessibilityObjectWrapperBase updateObjectBackingStore]
22  0x12b255ab5 -[WebAccessibilityObjectWrapper accessibilityAttributeValue:]
23  0x10eac8709 AccessibilityController::accessibleElementById(OpaqueJSString*)
24  0x10eac7e6b getAccessibleElementByIdCallback(OpaqueJSContext const*, OpaqueJSValue*, OpaqueJSValue*, unsigned long, OpaqueJSValue const* const*, OpaqueJSValue const**)
25  0x115f43741 long long JSC::APICallbackFunction::call<JSC::JSCallbackFunction>(JSC::JSGlobalObject*, JSC::CallFrame*)
26  0x4a6f8f201027
27  0x115e45fd0 llint_entry
28  0x115e28ef3 vmEntryToJavaScript
29  0x116bf9d57 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*)
30  0x116bf93b6 JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::JSGlobalObject*, JSC::JSObject*)
31  0x116f5ef1c JSC::evaluate(JSC::JSGlobalObject*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&)
Comment 1 Radar WebKit Bug Importer 2020-01-14 09:28:33 PST 
<rdar://problem/58570085>
Comment 2 Truitt Savell 2020-01-16 10:15:59 PST 
Skipping this test while is it investigated: https://trac.webkit.org/changeset/254690/webkit
Comment 3 Aakash Jain 2020-01-22 11:18:36 PST 
(In reply to Truitt Savell from comment #2)
> Skipping this test while is it investigated:
> https://trac.webkit.org/changeset/254690/webkit

accessibility/mac/select-text/select-text-1.html also needs to be handled appropriately, filed https://bugs.webkit.org/show_bug.cgi?id=206599
Comment 4 Ryan Haddad 2020-01-22 11:31:45 PST 
*** Bug 206599 has been marked as a duplicate of this bug. ***
Comment 5 Antti Koivisto 2020-01-28 02:52:51 PST 
Created attachment 388977 [details]
try to get backtrace from bot
Comment 6 Antti Koivisto 2020-01-28 04:13:43 PST 
Created attachment 388979 [details]
again
Comment 7 Antti Koivisto 2020-01-28 04:59:46 PST 
Created attachment 388982 [details]
again
Comment 8 Antti Koivisto 2020-01-28 05:40:39 PST 
Created attachment 388983 [details]
again
Comment 9 Antti Koivisto 2020-01-28 05:41:53 PST 
Created attachment 388984 [details]
again
Comment 10 Antti Koivisto 2020-01-28 06:44:17 PST 
Created attachment 388987 [details]
again
Comment 11 Antti Koivisto 2020-01-28 08:23:13 PST 
Created attachment 388997 [details]
again
Comment 12 Antti Koivisto 2020-01-29 01:43:33 PST 
Created attachment 389113 [details]
again
Comment 13 Antti Koivisto 2020-01-29 02:31:17 PST 
Created attachment 389116 [details]
again
Comment 14 Antti Koivisto 2020-01-29 04:09:07 PST 
Created attachment 389119 [details]
another
Comment 15 Antti Koivisto 2020-01-29 05:09:04 PST 
Created attachment 389124 [details]
patch
Comment 16 Antti Koivisto 2020-01-29 05:22:18 PST 
Created attachment 389126 [details]
patch
Comment 17 Antti Koivisto 2020-01-29 05:24:11 PST 
Created attachment 389127 [details]
patch
Comment 18 WebKit Commit Bot 2020-01-29 08:52:02 PST 
Comment on attachment 389127 [details]
patch

Clearing flags on attachment: 389127

Committed r255359: <https://trac.webkit.org/changeset/255359>
Comment 19 WebKit Commit Bot 2020-01-29 08:52:04 PST 
All reviewed patches have been landed.  Closing bug.
Comment 20 Aakash Jain 2020-01-30 04:29:02 PST 
> Committed r255359: <https://trac.webkit.org/changeset/255359>
This seems to have caused 1 test failure on windows imported/mozilla/svg/svg-integration/clipPath-html-06.xhtml. Tracked in Bug 206991.

This failure was also indicated by EWS.
Comment 21 Antti Koivisto 2020-01-30 07:19:21 PST 
Created attachment 389245 [details]
alternative approach
Comment 22 Antti Koivisto 2020-02-03 11:36:35 PST 
...which landed in https://trac.webkit.org/changeset/255490/webkit