Bug 221275

<rdar://problem/73888807>

Was not able to reproduce the test crash, likely due to the test being incredibly flakey.However, the history does indicate a potential regression point. History chart indicates crashes started at r272128

Created attachment 419098 [details] crash log ASSERTION FAILED: run.inlineItem.isText() || run.inlineItem.isInlineBoxStart() || run.inlineItem.isInlineBoxEnd() ./layout/inlineformatting/InlineContentBreaker.cpp(286) : auto WebCore::Layout::InlineContentBreaker::processOverflowingTextContent(const WebCore::Layout::InlineContentBreaker::ContinuousContent &, const WebCore::Layout::InlineContentBreaker::LineStatus &)::(anonymous class)::operator()(auto &) const 1 0x6f2b0c649 WTFCrash 2 0x6cfaf392b WTFCrashWithInfo(int, char const*, char const*, int) 3 0x6d362aac2 auto WebCore::Layout::InlineContentBreaker::processOverflowingTextContent(WebCore::Layout::InlineContentBreaker::ContinuousContent const&, WebCore::Layout::InlineContentBreaker::LineStatus const&) const::$_15::operator()<WebCore::Layout::InlineContentBreaker::ContinuousContent::Run const>(WebCore::Layout::InlineContentBreaker::ContinuousContent::Run const&) const 4 0x6d36237ed WebCore::Layout::InlineContentBreaker::processOverflowingTextContent(WebCore::Layout::InlineContentBreaker::ContinuousContent const&, WebCore::Layout::InlineContentBreaker::LineStatus const&) const::$_22::operator()() const 5 0x6d36230bf WebCore::Layout::InlineContentBreaker::processOverflowingTextContent(WebCore::Layout::InlineContentBreaker::ContinuousContent const&, WebCore::Layout::InlineContentBreaker::LineStatus const&) const 6 0x6d3622655 WebCore::Layout::InlineContentBreaker::processOverflowingContent(WebCore::Layout::InlineContentBreaker::ContinuousContent const&, WebCore::Layout::InlineContentBreaker::LineStatus const&) const::$_18::operator()() const 7 0x6d3622129 WebCore::Layout::InlineContentBreaker::processOverflowingContent(WebCore::Layout::InlineContentBreaker::ContinuousContent const&, WebCore::Layout::InlineContentBreaker::LineStatus const&) const 8 0x6d3621ab1 WebCore::Layout::InlineContentBreaker::processInlineContent(WebCore::Layout::InlineContentBreaker::ContinuousContent const&, WebCore::Layout::InlineContentBreaker::LineStatus const&)::$_17::operator()() const 9 0x6d3621810 WebCore::Layout::InlineContentBreaker::processInlineContent(WebCore::Layout::InlineContentBreaker::ContinuousContent const&, WebCore::Layout::InlineContentBreaker::LineStatus const&) 10 0x6d3641b48 WebCore::Layout::LineBuilder::handleInlineContent(WebCore::Layout::InlineContentBreaker&, WebCore::Layout::LineBuilder::InlineItemRange const&, WebCore::Layout::LineCandidate const&) 11 0x6d36406e7 WebCore::Layout::LineBuilder::placeInlineContent(WebCore::Layout::LineBuilder::InlineItemRange const&, unsigned long) 12 0x6d363510a WebCore::Layout::LineBuilder::computedIntrinsicWidth(WebCore::Layout::LineBuilder::InlineItemRange const&, float) 13 0x6d3634ec6 WebCore::Layout::InlineFormattingContext::computedIntrinsicWidthForConstraint(float) const 14 0x6d3634cac auto WebCore::Layout::InlineFormattingContext::computedIntrinsicWidthConstraints()::$_0::operator()<int>(int) const 15 0x6d363483c WebCore::Layout::InlineFormattingContext::computedIntrinsicWidthConstraints() 16 0x6d36c4c6c WebCore::Layout::TableFormattingContext::Geometry::intrinsicWidthConstraintsForCell(WebCore::Layout::TableGrid::Cell const&)::$_8::operator()() const 17 0x6d36c3e01 WebCore::Layout::TableFormattingContext::Geometry::intrinsicWidthConstraintsForCell(WebCore::Layout::TableGrid::Cell const&) 18 0x6d36c2d37 WebCore::Layout::TableFormattingContext::computedPreferredWidthForColumns() 19 0x6d36c2ae9 WebCore::Layout::TableFormattingContext::computedIntrinsicWidthConstraints() 20 0x6d36022fb WebCore::Layout::TableWrapperBlockFormattingContext::computeWidthAndMarginForTableBox(WebCore::Layout::ContainerBox const&, WebCore::Layout::HorizontalConstraints const&) 21 0x6d360167a WebCore::Layout::TableWrapperBlockFormattingContext::layoutTableBox(WebCore::Layout::ContainerBox const&, WebCore::Layout::FormattingContext::ConstraintsForInFlowContent const&) 22 0x6d3601407 WebCore::Layout::TableWrapperBlockFormattingContext::layoutInFlowContent(WebCore::Layout::InvalidationState&, WebCore::Layout::FormattingContext::ConstraintsForInFlowContent const&) 23 0x6d35f69b8 WebCore::Layout::BlockFormattingContext::layoutInFlowContent(WebCore::Layout::InvalidationState&, WebCore::Layout::FormattingContext::ConstraintsForInFlowContent const&) 24 0x6d35d8097 WebCore::Layout::LayoutContext::layoutFormattingContextSubtree(WebCore::Layout::ContainerBox const&, WebCore::Layout::InvalidationState&) 25 0x6d35d7d67 WebCore::Layout::LayoutContext::layoutWithPreparedRootGeometry(WebCore::Layout::InvalidationState&) 26 0x6d35d7c0b WebCore::Layout::LayoutContext::layout(WebCore::LayoutSize const&, WebCore::Layout::InvalidationState&) 27 0x6d39c952d WebCore::FrameViewLayoutContext::layoutUsingFormattingContext() 28 0x6d39aa69d WebCore::FrameViewLayoutContext::layout() 29 0x6d39c9caf WebCore::FrameViewLayoutContext::layoutTimerFired()

This also affects fast/layoutformattingcontext/table-basic-row-vertical-align-baseline.html https://results.webkit.org/?suite=layout-tests&suite=layout-tests&test=fast%2Flayoutformattingcontext%2Ftable-basic-row-baseline-align.html&test=fast%2Flayoutformattingcontext%2Ftable-basic-row-vertical-align-baseline.html

Created attachment 419208 [details] Patch

Comment on attachment 419208 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=419208&action=review > Source/WebCore/layout/inlineformatting/InlineContentBreaker.cpp:69 > + // Based on standards commit boundary ruless it would be enough to check the first inline item, but due to the table quirk, we can have standard commit boundary rules

Created attachment 419224 [details] Patch

Committed r272356: <https://trac.webkit.org/changeset/272356> All reviewed patches have been landed. Closing bug and clearing flags on attachment 419224 [details].