Bug 207841

Summary:	REGRESSION: (r256712?) [ iOS wk2 ] fast/block/block-only/floats-and-block-formatting-roots.html is crashing.
Product:	WebKit	Reporter:	Jason Lawrence <Lawrence.j>
Component:	New Bugs	Assignee:	Nobody <webkit-unassigned>
Status:	RESOLVED FIXED
Severity:	Normal	CC:	webkit-bot-watchers-bugzilla, webkit-bug-importer, zalan
Priority:	P2	Keywords:	InRadar
Version:	WebKit Nightly Build
Hardware:	iPhone / iPad
OS:	iOS 13

Description Jason Lawrence 2020-02-17 08:34:31 PST

fast/block/block-only/floats-and-block-formatting-roots.html

Description:
This test is crashing on iOS wk2. It looks as thought this is likely related to the changes made with r256712.

History:
https://results.webkit.org/?suite=layout-tests&test=fast%2Fblock%2Fblock-only%2Ffloats-and-block-formatting-roots.html&platform=ios&limit=50000

Diff:
No crash log found for com.apple.WebKit.WebContent.Development:16680.

stdout:

stderr:

(B)lock/(I)nline/I(N)line-block, (A)bsolute/Fi(X)ed/(R)elative/Stic(K)y, (F)loating, (O)verflow clip, Anon(Y)mous, (G)enerated, has(L)ayer, (C)omposited, (+)Dirty style, (+)Dirty layout
B---YGLC --* RenderView at (0,0) size 800x600 renderer->(0x1496f12b0)
B-----L- --    HTML RenderBlock at (0,0) size 800x116 renderer->(0x1496f1730) node->(0x1469f8350)
B------- --      BODY RenderBody at (8,8) size 784x100 renderer->(0x1496f1860) node->(0x1469f8470)
B------- --        DIV RenderBlock at (0,0) size 400x100 renderer->(0x1469f8c80) node->(0x1469f8560)
B-F----- --          DIV RenderBlock at (0,0) size 50x25 renderer->(0x1469f8db0) node->(0x1469f8650)
B-F----- --          DIV RenderBlock at (50,0) size 50x50 renderer->(0x1469f8ee0) node->(0x1469f8740)
B-F----- --          DIV RenderBlock at (100,0) size 50x5 renderer->(0x1469f9010) node->(0x1469f8830)
B-F----- --          DIV RenderBlock at (150,0) size 50x40 renderer->(0x1469f9140) node->(0x1469f8920)
B-F----- --          DIV RenderBlock at (220,0) size 180x80 renderer->(0x1469f9270) node->(0x1469f8a10)
B--O--L- --          DIV RenderBlock at (100,40) size 50x50 renderer->(0x14b0d8120) node->(0x1469f8b00)
B--O--L- --          DIV RenderBlock at (0,90) size 50x50 renderer->(0x14b0d8240) node->(0x1469f8bf0)

Initial containing block at (0,0) size 800x600 layout box->(0x1496f1990)
  HTML at (0,0) size 800x208 layout box->(0x1496f1af0)
    BODY at (8,8) size 784x100 layout box->(0x1496f1bc0)
      block box at (0,0) size 400x100 layout box->(0x1469f93a0)
        [float] block box at (100,40) size 50x25 layout box->(0x1469f9470)
        [float] block box at (150,40) size 50x50 layout box->(0x1469f9540)
        [float] block box at (200,80) size 50x5 layout box->(0x1469f9610)
        [float] block box at (250,80) size 50x40 layout box->(0x1469f96e0)
        [float] block box at (220,120) size 180x80 layout box->(0x14b0dc0c0)
        block box at (0,120) size 50x50 layout box->(0x14b0dc180)
        block box at (0,170) size 50x50 layout box->(0x14b0dc240)

HTML RenderBlock(0x1496f1730) layoutBox(0x1496f1af0)
frameBox	renderer->(0,0) (800x116)	layout->(0,0) (800x208)
DIV RenderBlock (floating)(0x1469f8db0) layoutBox(0x1469f9470)
frameBox	renderer->(0,0) (50x25)	layout->(100,40) (50x25)
DIV RenderBlock (floating)(0x1469f8ee0) layoutBox(0x1469f9540)
frameBox	renderer->(50,0) (50x50)	layout->(150,40) (50x50)
DIV RenderBlock (floating)(0x1469f9010) layoutBox(0x1469f9610)
frameBox	renderer->(100,0) (50x5)	layout->(200,80) (50x5)
DIV RenderBlock (floating)(0x1469f9140) layoutBox(0x1469f96e0)
frameBox	renderer->(150,0) (50x40)	layout->(250,80) (50x40)
DIV RenderBlock (floating)(0x1469f9270) layoutBox(0x14b0dc0c0)
frameBox	renderer->(220,0) (180x80)	layout->(220,120) (180x80)
DIV RenderBlock(0x14b0d8120) layoutBox(0x14b0dc180)
frameBox	renderer->(100,40) (50x50)	layout->(0,120) (50x50)
DIV RenderBlock(0x14b0d8240) layoutBox(0x14b0dc240)
frameBox	renderer->(0,90) (50x50)	layout->(0,170) (50x50)

SHOULD NEVER BE REACHED
./layout/Verification.cpp(349) : static void WebCore::Layout::LayoutContext::verifyAndOutputMismatchingLayoutTree(const WebCore::Layout::LayoutState &, const WebCore::RenderView &)
1   0x1176b9779 WTFCrash
2   0x11caac6db WTFCrashWithInfo(int, char const*, char const*, int)
3   0x11f9b0353 WebCore::Layout::LayoutContext::verifyAndOutputMismatchingLayoutTree(WebCore::Layout::LayoutState const&, WebCore::RenderView const&)
4   0x11fd1b02d WebCore::FrameViewLayoutContext::layoutUsingFormattingContext()
5   0x11fd1c26e WebCore::FrameViewLayoutContext::layout()
6   0x11fd1b74c WebCore::FrameViewLayoutContext::layoutTimerFired()
7   0x11fd2cc81 decltype(*(std::__1::forward<WebCore::FrameViewLayoutContext*&>(fp0)).*fp()) std::__1::__invoke<void (WebCore::FrameViewLayoutContext::*&)(), WebCore::FrameViewLayoutContext*&, void>(void (WebCore::FrameViewLayoutContext::*&)(), WebCore::FrameViewLayoutContext*&)
8   0x11fd2cbe0 std::__1::__bind_return<void (WebCore::FrameViewLayoutContext::*)(), std::__1::tuple<WebCore::FrameViewLayoutContext*>, std::__1::tuple<>, __is_valid_bind_return<void (WebCore::FrameViewLayoutContext::*)(), std::__1::tuple<WebCore::FrameViewLayoutContext*>, std::__1::tuple<> >::value>::type std::__1::__apply_functor<void (WebCore::FrameViewLayoutContext::*)(), std::__1::tuple<WebCore::FrameViewLayoutContext*>, 0ul, std::__1::tuple<> >(void (WebCore::FrameViewLayoutContext::*&)(), std::__1::tuple<WebCore::FrameViewLayoutContext*>&, std::__1::__tuple_indices<0ul>, std::__1::tuple<>&&)
9   0x11fd2cb8c std::__1::__bind_return<void (WebCore::FrameViewLayoutContext::*)(), std::__1::tuple<WebCore::FrameViewLayoutContext*>, std::__1::tuple<>, __is_valid_bind_return<void (WebCore::FrameViewLayoutContext::*)(), std::__1::tuple<WebCore::FrameViewLayoutContext*>, std::__1::tuple<> >::value>::type std::__1::__bind<void (WebCore::FrameViewLayoutContext::*&)(), WebCore::FrameViewLayoutContext*>::operator()<>()
10  0x11fd2cb29 WTF::Detail::CallableWrapper<std::__1::__bind<void (WebCore::FrameViewLayoutContext::*&)(), WebCore::FrameViewLayoutContext*>, void>::call()
11  0x11cac098a WTF::Function<void ()>::operator()() const
12  0x11cb760c9 WebCore::Timer::fired()
13  0x11ff7599a WebCore::ThreadTimers::sharedTimerFiredInternal()
14  0x11ff81671 WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0::operator()() const
15  0x11ff81629 WTF::Detail::CallableWrapper<WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0, void>::call()
16  0x11cac098a WTF::Function<void ()>::operator()() const
17  0x11ff398b7 WebCore::MainThreadSharedTimer::fired()
18  0x11ffe09b6 WebCore::timerFired(__CFRunLoopTimer*, void*)
19  0x1044f4b94 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__
20  0x1044f4882 __CFRunLoopDoTimer
21  0x1044f3eda __CFRunLoopDoTimers
22  0x1044eec4e __CFRunLoopRun
23  0x1044ee066 CFRunLoopRunSpecific
24  0x103dff86f -[NSRunLoop(NSRunLoop) runMode:beforeDate:]
25  0x103dffa87 -[NSRunLoop(NSRunLoop) run]
26  0x1060c43ee _xpc_objc_main
27  0x1060c6a8f xpc_main
28  0x108adbfc9 WebKit::XPCServiceMain(int, char const**)
29  0x109dc50eb WKXPCServiceMain
30  0x103ca1d72 main
31  0x105d99c25 start

Comment 1 Radar WebKit Bug Importer 2020-02-17 08:35:06 PST

<rdar://problem/59511769>

Comment 2 Jason Lawrence 2020-02-17 08:41:06 PST

I have marked this test as crashing while the issue is investigated.
https://trac.webkit.org/changeset/256735/webkit

Comment 3 Jason Lawrence 2020-02-17 09:35:26 PST

This issue appears to be affecting other debug tests too, including these:
fast/block/block-only/abs-pos-with-border-padding-and-float-child.html
fast/block/block-only/block-replaced-with-vertical-margins.html
fast/block/block-only/float-avoider-multiple-roots.html
fast/block/block-only/float-avoider-simple-right.html
fast/block/block-only/float-left-when-container-has-padding-margin.html
fast/block/block-only/float-min-max-width.html	crash log sample
fast/block/block-only/floating-and-next-previous-inflow-with-margin.html
fast/block/block-only/floating-box-right-simple.html
fast/block/block-only/floating-box-with-clear-simple.html
fast/block/block-only/floating-box-with-relative-positioned-sibling.html
fast/block/block-only/floating-left-right-simple.html
fast/block/block-only/floating-multiple-lefts-in-body.html
fast/block/block-only/floating-multiple-lefts.html
fast/block/block-only/floats-and-block-formatting-roots.html
fast/block/block-only/margin-collapse-simple.html
fast/block/block-only/margin-left-right-sizing-out-of-flow.html
fast/block/block-only/min-max-and-preferred-width-simple.html
fast/block/block-only/replaced-intrinsic-width-simple.html

Comment 4 zalan 2020-02-17 13:10:32 PST

Committed r256763: <https://trac.webkit.org/changeset/256763>