Bug 210244

Summary:	REGRESSION (r259760-r259762): [iOS] ASSERTION FAILED: !needsLayout() in WebCore::FrameView::paintContents
Product:	WebKit	Reporter:	Ryan Haddad <ryanhaddad>
Component:	New Bugs	Assignee:	Nobody <webkit-unassigned>
Status:	RESOLVED DUPLICATE
Severity:	Normal	CC:	dbates, simon.fraser, webkit-bot-watchers-bugzilla, webkit-bug-importer
Priority:	P2	Keywords:	InRadar
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified
See Also:	https://bugs.webkit.org/show_bug.cgi?id=210278

Description Ryan Haddad 2020-04-08 20:53:56 PDT

ASSERTION FAILED: !needsLayout()
./page/FrameView.cpp(4276) : virtual void WebCore::FrameView::paintContents(WebCore::GraphicsContext &, const WebCore::IntRect &, WebCore::Widget::SecurityOriginPaintPolicy, WebCore::EventRegionContext *)
2020-04-08 18:26:15.752 WebKitTestRunnerApp[47622:406829439] PBItemCollectionServicer connection disconnected.
1   0x2fc9b4da9 WTFCrash
2   0x301e5d38b WTFCrashWithInfo(int, char const*, char const*, int)
3   0x305187cf6 WebCore::FrameView::paintContents(WebCore::GraphicsContext&, WebCore::IntRect const&, WebCore::Widget::SecurityOriginPaintPolicy, WebCore::EventRegionContext*)
4   0x30540299a WebCore::ScrollView::paint(WebCore::GraphicsContext&, WebCore::IntRect const&, WebCore::Widget::SecurityOriginPaintPolicy, WebCore::EventRegionContext*)
5   0x305c6465b WebCore::RenderWidget::paintContents(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
6   0x305c64f17 WebCore::RenderWidget::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
7   0x305a4b7a7 WebCore::RenderElement::paintAsInlineBlock(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
8   0x305930880 WebCore::InlineElementBox::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::LayoutUnit, WebCore::LayoutUnit)
9   0x30595fc5b WebCore::InlineFlowBox::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::LayoutUnit, WebCore::LayoutUnit)
10  0x305c66ee1 WebCore::RootInlineBox::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::LayoutUnit, WebCore::LayoutUnit)
11  0x305b4cf78 WebCore::RenderLineBoxList::paint(WebCore::RenderBoxModelObject*, WebCore::PaintInfo&, WebCore::LayoutPoint const&) const
12  0x3059c0641 WebCore::RenderBlockFlow::paintInlineChildren(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
13  0x30599562e WebCore::RenderBlock::paintContents(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
14  0x305996691 WebCore::RenderBlock::paintObject(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
15  0x305994e69 WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
16  0x305995bcc WebCore::RenderBlock::paintChild(WebCore::RenderBox&, WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool, WebCore::RenderBlock::PaintBlockType)
17  0x3059957e1 WebCore::RenderBlock::paintChildren(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool)
18  0x30599572b WebCore::RenderBlock::paintContents(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
19  0x305996691 WebCore::RenderBlock::paintObject(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
20  0x305994e69 WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
21  0x305995bcc WebCore::RenderBlock::paintChild(WebCore::RenderBox&, WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool, WebCore::RenderBlock::PaintBlockType)
22  0x3059957e1 WebCore::RenderBlock::paintChildren(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool)
23  0x30599572b WebCore::RenderBlock::paintContents(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
24  0x305996691 WebCore::RenderBlock::paintObject(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
25  0x305994e69 WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
26  0x305ae68f4 WebCore::RenderLayer::collectEventRegionForFragments(WTF::Vector<WebCore::LayerFragment, 1ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&, WebCore::GraphicsContext&, WebCore::RenderLayer::LayerPaintingInfo const&)
27  0x305ae2aff WebCore::RenderLayer::paintLayerContents(WebCore::GraphicsContext&, WebCore::RenderLayer::LayerPaintingInfo const&, WTF::OptionSet<WebCore::RenderLayer::PaintLayerFlag>)
28  0x305ae1c84 WebCore::RenderLayer::paintLayerContentsAndReflection(WebCore::GraphicsContext&, WebCore::RenderLayer::LayerPaintingInfo const&, WTF::OptionSet<WebCore::RenderLayer::PaintLayerFlag>)
29  0x305ae0c3b WebCore::RenderLayer::paintLayerWithEffects(WebCore::GraphicsContext&, WebCore::RenderLayer::LayerPaintingInfo const&, WTF::OptionSet<WebCore::RenderLayer::PaintLayerFlag>)
30  0x305adfecb WebCore::RenderLayer::paintLayer(WebCore::GraphicsContext&, WebCore::RenderLayer::LayerPaintingInfo const&, WTF::OptionSet<WebCore::RenderLayer::PaintLayerFlag>)
31  0x305ae6054 WebCore::RenderLayer::paintList(WebCore::RenderLayer::LayerList, WebCore::GraphicsContext&, WebCore::RenderLayer::LayerPaintingInfo const&, WTF::OptionSet<WebCore::RenderLayer::PaintLayerFlag>)


Seen with the following tests on iOS Debug bots:

  editing/pasteboard/copy-backslash-with-euc.html [ Crash ]
  editing/pasteboard/data-transfer-set-data-ignore-copied-malformed-url-in-null-origin.html [ Crash ]
  editing/pasteboard/data-transfer-set-data-sanitize-url-when-copying-in-null-origin.html [ Crash ]
  editing/pasteboard/data-transfer-set-data-sanitizes-html-when-copying.html [ Crash ]
  editing/pasteboard/dataTransfer-types-pasting-plaintext.html [ Crash ]
  editing/pasteboard/paste-global-selection.html [ Crash ]
  editing/selection/navigation-clears-editor-state.html [ Crash ]
  fast/dom/tabindex-defaults.html [ Crash ]
  fast/events/frame-tab-focus.html [ Crash ]
  fast/events/tabindex-focus-blur-all.html [ Crash ]
  fast/frames/iframe-js-url-clientWidth.html [ Crash ]
  fast/frames/take-focus-from-iframe.html [ Crash ]
  fast/loader/form-state-restore-with-frames.html [ Crash ]
  fast/shadow-dom/shadow-root-active-element-crash.html [ Crash ]
  http/tests/security/clipboard/copy-paste-html-across-origin-sanitizes-html.html [ Crash ]
  http/tests/security/clipboard/copy-paste-html-across-origin-strips-mso-list.html [ Crash ]
  http/tests/security/clipboard/copy-paste-url-across-origin-sanitizes-url.html [ Crash ]
  imported/blink/editing/undo/crash-redo-with-iframes.html [ Crash ]
  imported/w3c/web-platform-tests/html/interaction/focus/document-level-focus-apis/document-level-apis.html [ Crash ]
  imported/w3c/web-platform-tests/html/interaction/focus/the-autofocus-attribute/focusable-area-in-top-document.html [ Crash ]
  imported/w3c/web-platform-tests/html/semantics/forms/autofocus/focusable-area-in-top-document.html [ Crash ]
  jquery/css.html [ Crash ]
  jquery/data.html [ Crash ]
  jquery/deferred.html [ Crash ]
  jquery/dimensions.html [ Crash ]
  jquery/event.html [ Crash ]
  jquery/offset.html [ Crash ]
  jquery/traversing.html [ Crash ]
  svg/custom/bug78838.html [ Crash ]
  svg/custom/bug79798.html [ Crash ]

Comment 1 Radar WebKit Bug Importer 2020-04-08 20:54:20 PDT

<rdar://problem/61494653>

Comment 2 Ryan Haddad 2020-04-08 20:54:35 PDT

https://build.webkit.org/results/Apple%20iOS%2013%20Simulator%20Debug%20WK2%20(Tests)/r259771%20(3040)/results.html

Comment 3 Ryan Haddad 2020-04-08 21:00:55 PDT

Probably one of these two:

Should find touch-action elements inside non-composited iframes
https://trac.webkit.org/changeset/259761/webkit

Track editable elements on screen
https://trac.webkit.org/changeset/259762/webkit

Comment 4 Ryan Haddad 2020-04-09 12:23:44 PDT


*** This bug has been marked as a duplicate of bug 210278 ***