Bug 207261

Summary: New WPT tests css/css-transitions/animations/vertical-align-composition.html and css/css-transitions/animations/vertical-align-interpolation.html are crashes
Product: WebKit Reporter: Antoine Quint <graouts>
Component: CSSAssignee: Nobody <webkit-unassigned>
Status: RESOLVED DUPLICATE    
Severity: Normal CC: ap, koivisto, simon.fraser, webkit-bot-watchers-bugzilla, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: Safari Technology Preview   
Hardware: Unspecified   
OS: Unspecified   
See Also: https://bugs.webkit.org/show_bug.cgi?id=207263

Description Antoine Quint 2020-02-05 05:03:39 PST 
The two new WPT tests css/css-transitions/animations/vertical-align-composition.html and css/css-transitions/animations/vertical-align-interpolation.html crash in debug builds:

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.JavaScriptCore      	0x0000000159f7dd1e WTFCrash + 14 (Assertions.cpp:305)
1   com.apple.WebCore             	0x0000000140004b1b WTFCrashWithInfo(int, char const*, char const*, int) + 27
2   com.apple.WebCore             	0x000000014245e643 WebCore::CSSPrimitiveValue::init(WebCore::Length const&) + 531 (CSSPrimitiveValue.cpp:355)
3   com.apple.WebCore             	0x000000014245e424 WebCore::CSSPrimitiveValue::CSSPrimitiveValue(WebCore::Length const&) + 52 (CSSPrimitiveValue.cpp:271)
4   com.apple.WebCore             	0x000000014245e6ed WebCore::CSSPrimitiveValue::CSSPrimitiveValue(WebCore::Length const&) + 29 (CSSPrimitiveValue.cpp:271)
5   com.apple.WebCore             	0x00000001423cc6bd WTF::Ref<WebCore::CSSPrimitiveValue, WTF::DumbPtrTraits<WebCore::CSSPrimitiveValue> > WebCore::CSSPrimitiveValue::create<WebCore::Length const&>(WebCore::Length const&) + 61 (CSSPrimitiveValue.h:290)
6   com.apple.WebCore             	0x00000001423a1c5f WTF::Ref<WebCore::CSSPrimitiveValue, WTF::DumbPtrTraits<WebCore::CSSPrimitiveValue> > WebCore::CSSValuePool::createValue<WebCore::Length const&>(WebCore::Length const&) + 47 (CSSValuePool.h:70)
7   com.apple.WebCore             	0x000000014239ba64 WebCore::ComputedStyleExtractor::valueForPropertyInStyle(WebCore::RenderStyle const&, WebCore::CSSPropertyID, WebCore::RenderElement*) + 24084 (CSSComputedStyleDeclaration.cpp:3159)
8   com.apple.WebCore             	0x0000000142394dc6 WebCore::ComputedStyleExtractor::propertyValue(WebCore::CSSPropertyID, WebCore::EUpdateLayout) + 662 (CSSComputedStyleDeclaration.cpp:2445)
9   com.apple.WebCore             	0x0000000142394b15 WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue(WebCore::CSSPropertyID, WebCore::EUpdateLayout) const + 117 (CSSComputedStyleDeclaration.cpp:2133)
10  com.apple.WebCore             	0x0000000142393c74 WebCore::CSSComputedStyleDeclaration::getPropertyValue(WebCore::CSSPropertyID) const + 52 (CSSComputedStyleDeclaration.cpp:3869)
11  com.apple.WebCore             	0x00000001423af356 WebCore::CSSComputedStyleDeclaration::getPropertyValue(WTF::String const&) + 246
12  com.apple.WebCore             	0x0000000140561c39 WebCore::jsCSSStyleDeclarationPrototypeFunctionGetPropertyValueBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSCSSStyleDeclaration*, JSC::ThrowScope&) + 329 (JSCSSStyleDeclaration.cpp:441)
13  com.apple.WebCore             	0x00000001404f18a2 long long WebCore::IDLOperation<WebCore::JSCSSStyleDeclaration>::call<&(WebCore::jsCSSStyleDeclarationPrototypeFunctionGetPropertyValueBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSCSSStyleDeclaration*, JSC::ThrowScope&)), (WebCore::CastedThisErrorBehavior)0>(JSC::JSGlobalObject&, JSC::CallFrame&, char const*) + 786 (JSDOMOperation.h:53)
14  com.apple.WebCore             	0x00000001404f1584 WebCore::jsCSSStyleDeclarationPrototypeFunctionGetPropertyValue(JSC::JSGlobalObject*, JSC::CallFrame*) + 36 (JSCSSStyleDeclaration.cpp:446)
15  ???                           	0x0000385c47e01178 0 + 61968994013560
16  ???                           	0x0000385c47e42ea4 0 + 61968994283172
17  com.apple.JavaScriptCore      	0x000000015a46b889 llint_entry + 118987 (LowLevelInterpreter.asm:1000)
18  com.apple.JavaScriptCore      	0x000000015a46b7e6 llint_entry + 118824 (InitBytecodes.asm:225)
19  com.apple.JavaScriptCore      	0x000000015a46b889 llint_entry + 118987 (LowLevelInterpreter.asm:1000)
20  com.apple.JavaScriptCore      	0x000000015a44e553 vmEntryToJavaScript + 273 (LowLevelInterpreter64.asm:298)
21  com.apple.JavaScriptCore      	0x000000015b1d50f7 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 199 (JITCodeInlines.h:38)
22  com.apple.JavaScriptCore      	0x000000015b1d47b5 JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::JSGlobalObject*, JSC::JSObject*) + 6309 (Interpreter.cpp:851)
23  com.apple.JavaScriptCore      	0x000000015b53413c JSC::evaluate(JSC::JSGlobalObject*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) + 556 (Completion.cpp:146)
24  com.apple.JavaScriptCore      	0x000000015b5342e8 JSC::profiledEvaluate(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) + 72 (Completion.cpp:161)
25  com.apple.WebCore             	0x00000001421c7a18 WebCore::JSExecState::profiledEvaluate(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) + 72 (JSExecState.h:79)
26  com.apple.WebCore             	0x00000001421c7667 WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld&) + 359 (ScriptController.cpp:144)
27  com.apple.WebCore             	0x00000001421c74b9 WebCore::ScriptController::evaluateInWorldIgnoringException(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld&) + 41 (ScriptController.cpp:117)
28  com.apple.WebCore             	0x00000001421c7cf5 WebCore::ScriptController::evaluateIgnoringException(WebCore::ScriptSourceCode const&) + 53 (ScriptController.cpp:164)
29  com.apple.WebCore             	0x00000001428475c0 WebCore::ScriptElement::executeClassicScript(WebCore::ScriptSourceCode const&) + 896 (ScriptElement.cpp:393)
30  com.apple.WebCore             	0x00000001428457e6 WebCore::ScriptElement::prepareScript(WTF::TextPosition const&, WebCore::ScriptElement::LegacyTypeSupport) + 2614 (ScriptElement.cpp:268)
31  com.apple.WebCore             	0x0000000142d5c981 WebCore::HTMLScriptRunner::runScript(WebCore::ScriptElement&, WTF::TextPosition const&) + 385 (HTMLScriptRunner.cpp:252)
32  com.apple.WebCore             	0x0000000142d5c787 WebCore::HTMLScriptRunner::execute(WTF::Ref<WebCore::ScriptElement, WTF::DumbPtrTraits<WebCore::ScriptElement> >&&, WTF::TextPosition const&) + 71 (HTMLScriptRunner.cpp:140)
33  com.apple.WebCore             	0x0000000142d41511 WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder() + 897 (HTMLDocumentParser.cpp:236)
34  com.apple.WebCore             	0x0000000142d4198c WebCore::HTMLDocumentParser::pumpTokenizerLoop(WebCore::HTMLDocumentParser::SynchronousMode, bool, WebCore::PumpSession&) + 140 (HTMLDocumentParser.cpp:255)
35  com.apple.WebCore             	0x0000000142d40d39 WebCore::HTMLDocumentParser::pumpTokenizer(WebCore::HTMLDocumentParser::SynchronousMode) + 473 (HTMLDocumentParser.cpp:305)
36  com.apple.WebCore             	0x0000000142d4069d WebCore::HTMLDocumentParser::pumpTokenizerIfPossible(WebCore::HTMLDocumentParser::SynchronousMode) + 205 (HTMLDocumentParser.cpp:189)
37  com.apple.WebCore             	0x0000000142d42d95 WebCore::HTMLDocumentParser::resumeParsingAfterScriptExecution() + 277 (HTMLDocumentParser.cpp:524)
38  com.apple.WebCore             	0x0000000142d43180 WebCore::HTMLDocumentParser::notifyFinished(WebCore::PendingScript&) + 400 (HTMLDocumentParser.cpp:569)
39  com.apple.WebCore             	0x00000001428149b3 WebCore::PendingScript::notifyClientFinished() + 67 (PendingScript.cpp:70)
40  com.apple.WebCore             	0x0000000142814a19 WebCore::PendingScript::notifyFinished(WebCore::LoadableScript&) + 25 (PendingScript.cpp:75)
41  com.apple.WebCore             	0x00000001427af3c1 WebCore::LoadableScript::notifyClientFinished() + 321 (LoadableScript.cpp:59)
42  com.apple.WebCore             	0x00000001427af1ae WebCore::LoadableClassicScript::notifyFinished(WebCore::CachedResource&) + 1390 (LoadableClassicScript.cpp:118)
43  com.apple.WebCore             	0x0000000143209c82 WebCore::CachedResource::checkNotify() + 130 (CachedResource.cpp:354)
44  com.apple.WebCore             	0x0000000143205bf4 WebCore::CachedResource::finishLoading(WebCore::SharedBuffer*) + 52 (CachedResource.cpp:372)
45  com.apple.WebCore             	0x000000014323cccf WebCore::CachedScript::finishLoading(WebCore::SharedBuffer*) + 127 (CachedScript.cpp:104)
46  com.apple.WebCore             	0x0000000143196a76 WebCore::SubresourceLoader::didFinishLoading(WebCore::NetworkLoadMetrics const&) + 1206 (SubresourceLoader.cpp:701)
47  com.apple.WebKit              	0x0000000107488aba WebKit::WebResourceLoader::didFinishResourceLoad(WebCore::NetworkLoadMetrics const&) + 778
48  com.apple.WebKit              	0x0000000107a9f1c0 void IPC::callMemberFunctionImpl<WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&), std::__1::tuple<WebCore::NetworkLoadMetrics>, 0ul>(WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&), std::__1::tuple<WebCore::NetworkLoadMetrics>&&, std::__1::integer_sequence<unsigned long, 0ul>) + 160 (HandleMessage.h:42)
49  com.apple.WebKit              	0x0000000107a9f110 void IPC::callMemberFunction<WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&), std::__1::tuple<WebCore::NetworkLoadMetrics>, std::__1::integer_sequence<unsigned long, 0ul> >(std::__1::tuple<WebCore::NetworkLoadMetrics>&&, WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)) + 112 (HandleMessage.h:48)
50  com.apple.WebKit              	0x0000000107a9cccb void IPC::handleMessage<Messages::WebResourceLoader::DidFinishResourceLoad, WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)>(IPC::Decoder&, WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)) + 283 (HandleMessage.h:121)
51  com.apple.WebKit              	0x0000000107a9c37d WebKit::WebResourceLoader::didReceiveWebResourceLoaderMessage(IPC::Connection&, IPC::Decoder&) + 685 (WebResourceLoaderMessageReceiver.cpp:66)
52  com.apple.WebKit              	0x000000010747be06 WebKit::NetworkProcessConnection::didReceiveMessage(IPC::Connection&, IPC::Decoder&) + 166 (NetworkProcessConnection.cpp:89)
53  com.apple.WebKit              	0x00000001061e0569 IPC::Connection::dispatchMessage(IPC::Decoder&) + 473 (Connection.cpp:1009)
54  com.apple.WebKit              	0x00000001061e0ec2 IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >) + 578
55  com.apple.WebKit              	0x00000001061e1570 IPC::Connection::dispatchOneIncomingMessage() + 208 (Connection.cpp:1146)
56  com.apple.WebKit              	0x00000001061fff5e IPC::Connection::enqueueIncomingMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >)::$_7::operator()() + 94 (Connection.cpp:986)
57  com.apple.WebKit              	0x00000001061ffe6e WTF::Detail::CallableWrapper<IPC::Connection::enqueueIncomingMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >)::$_7, void>::call() + 30 (Function.h:52)
58  com.apple.JavaScriptCore      	0x0000000159fa4ce2 WTF::Function<void ()>::operator()() const + 130 (Function.h:84)
59  com.apple.JavaScriptCore      	0x000000015a011563 WTF::RunLoop::performWork() + 435 (RunLoop.cpp:125)
60  com.apple.JavaScriptCore      	0x000000015a011e91 WTF::RunLoop::performWork(void*) + 33 (RunLoopCF.cpp:39)
61  com.apple.CoreFoundation      	0x00007fff35362342 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17
62  com.apple.CoreFoundation      	0x00007fff353622e1 __CFRunLoopDoSource0 + 103
63  com.apple.CoreFoundation      	0x00007fff353620fb __CFRunLoopDoSources0 + 209
64  com.apple.CoreFoundation      	0x00007fff35360e2a __CFRunLoopRun + 927
65  com.apple.CoreFoundation      	0x00007fff3536042e CFRunLoopRunSpecific + 462
66  com.apple.Foundation          	0x00007fff37a99328 -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 212
67  com.apple.Foundation          	0x00007fff37b4bd5f -[NSRunLoop(NSRunLoop) run] + 76
68  libxpc.dylib                  	0x00007fff70aec51a _xpc_objc_main.cold.4 + 49
69  libxpc.dylib                  	0x00007fff70aec460 _xpc_objc_main + 559
70  libxpc.dylib                  	0x00007fff70aebf93 xpc_main + 377
71  com.apple.WebKit              	0x00000001069b0777 WebKit::XPCServiceMain(int, char const**) + 1303 (XPCServiceMain.mm:160)
72  com.apple.WebKit              	0x0000000107b3c81b WKXPCServiceMain + 27 (WKMain.mm:33)
73  com.apple.WebKit.WebContent   	0x0000000106164eb2 main + 34 (AuxiliaryProcessMain.cpp:30)
74  libdyld.dylib                 	0x00007fff7089ecc9 start + 1
Comment 1 Antoine Quint 2020-02-05 08:38:07 PST 
Also affects css/css-backgrounds/animations/border-image-outset-composition.html and css/css-backgrounds/animations/border-image-width-composition.html
Comment 2 Radar WebKit Bug Importer 2020-04-10 08:48:45 PDT 
<rdar://problem/61585741>
Comment 3 Antoine Quint 2021-03-29 09:41:12 PDT 

*** This bug has been marked as a duplicate of bug 223853 ***