Bug 238297

Summary: REGRESSION (GPUP): [iOS] ASSERTION FAILED: inputData.size() == outputData.size() in WebKit::RemoteRenderingBackendProxy::prepareBuffersForDisplay()
Product: WebKit Reporter: Ryan Haddad <ryanhaddad>
Component: WebKit Process ModelAssignee: Simon Fraser (smfr) <simon.fraser>
Status: RESOLVED DUPLICATE    
Severity: Normal CC: jonlee, simon.fraser, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: Safari 13   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
crash log
none
Crash log none

Description Ryan Haddad 2022-03-23 16:15:31 PDT 
The following assertion failure is seen on iOS debug bots:

ASSERTION FAILED: inputData.size() == outputData.size()
/Volumes/Data/worker/ios-simulator-15-debug/build/Source/WebKit/WebProcess/GPU/graphics/RemoteRenderingBackendProxy.cpp(312) : Vector<WebKit::RemoteRenderingBackendProxy::SwapBuffersResult> WebKit::RemoteRenderingBackendProxy::prepareBuffersForDisplay(const Vector<WebKit::RemoteRenderingBackendProxy::LayerPrepareBuffersData> &)
1   0x17a9d4b09 WTFCrash
2   0x15cedfb4b WTFCrashWithInfo(int, char const*, char const*, int)
3   0x15eea4427 WebKit::RemoteRenderingBackendProxy::prepareBuffersForDisplay(WTF::Vector<WebKit::RemoteRenderingBackendProxy::LayerPrepareBuffersData, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&)
4   0x15dc28c97 WebKit::RemoteLayerWithRemoteRenderingBackingStoreCollection::prepareBackingStoresForDisplay(WebKit::RemoteLayerTreeTransaction&)
5   0x15e8317ec WebKit::RemoteLayerTreeContext::buildTransaction(WebKit::RemoteLayerTreeTransaction&, WebCore::PlatformCALayer&)
6   0x15d488369 WebKit::RemoteLayerTreeDrawingArea::updateRendering()
7   0x15d4918fe decltype(*(std::__1::forward<WebKit::RemoteLayerTreeDrawingArea*&>(fp0)).*fp()) std::__1::__invoke<void (WebKit::RemoteLayerTreeDrawingArea::*&)(), WebKit::RemoteLayerTreeDrawingArea*&, void>(void (WebKit::RemoteLayerTreeDrawingArea::*&)(), WebKit::RemoteLayerTreeDrawingArea*&)
8   0x15d49187d std::__1::__bind_return<void (WebKit::RemoteLayerTreeDrawingArea::*)(), std::__1::tuple<WebKit::RemoteLayerTreeDrawingArea*>, std::__1::tuple<>, __is_valid_bind_return<void (WebKit::RemoteLayerTreeDrawingArea::*)(), std::__1::tuple<WebKit::RemoteLayerTreeDrawingArea*>, std::__1::tuple<> >::value>::type std::__1::__apply_functor<void (WebKit::RemoteLayerTreeDrawingArea::*)(), std::__1::tuple<WebKit::RemoteLayerTreeDrawingArea*>, 0ul, std::__1::tuple<> >(void (WebKit::RemoteLayerTreeDrawingArea::*&)(), std::__1::tuple<WebKit::RemoteLayerTreeDrawingArea*>&, std::__1::__tuple_indices<0ul>, std::__1::tuple<>&&)
9   0x15d491830 std::__1::__bind_return<void (WebKit::RemoteLayerTreeDrawingArea::*)(), std::__1::tuple<WebKit::RemoteLayerTreeDrawingArea*>, std::__1::tuple<>, __is_valid_bind_return<void (WebKit::RemoteLayerTreeDrawingArea::*)(), std::__1::tuple<WebKit::RemoteLayerTreeDrawingArea*>, std::__1::tuple<> >::value>::type std::__1::__bind<void (WebKit::RemoteLayerTreeDrawingArea::*&)(), WebKit::RemoteLayerTreeDrawingArea*>::operator()<>()
10  0x15d4917c9 WTF::Detail::CallableWrapper<std::__1::__bind<void (WebKit::RemoteLayerTreeDrawingArea::*&)(), WebKit::RemoteLayerTreeDrawingArea*>, void>::call()
11  0x15cf3e7f2 WTF::Function<void ()>::operator()() const
12  0x15d48d149 WebCore::Timer::fired()
13  0x1a719cb46 WebCore::ThreadTimers::sharedTimerFiredInternal()
14  0x1a71a6f81 WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0::operator()() const
15  0x1a71a6f19 WTF::Detail::CallableWrapper<WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0, void>::call()
16  0x1a2a4b952 WTF::Function<void ()>::operator()() const
17  0x1a7134a01 WebCore::MainThreadSharedTimer::fired()
18  0x1a7230866 WebCore::timerFired(__CFRunLoopTimer*, void*)

https://build.webkit.org/results/Apple-iOS-15-Simulator-Debug-WK2-Tests/r291751%20(2042)/results.html
Comment 1 Radar WebKit Bug Importer 2022-03-23 16:19:29 PDT 
<rdar://problem/90731320>
Comment 2 Ryan Haddad 2022-03-23 16:20:27 PDT 
compositing/ancestor-compositing-layer-is-on-subpixel-position.html
Comment 3 Ryan Haddad 2022-03-23 16:21:40 PDT 
Created attachment 455578 [details]
crash log
Comment 4 Ryan Haddad 2022-03-23 16:24:54 PDT 
css3/color-filters/color-filter-color-property.html
css3/color-filters/color-filter-text-decoration-shadow.html
Comment 5 Simon Fraser (smfr) 2022-03-25 15:25:09 PDT 
The attached crash log does not match this assertion.
Comment 6 Simon Fraser (smfr) 2022-03-25 15:31:52 PDT 
Created attachment 455803 [details]
Crash log
Comment 7 Simon Fraser (smfr) 2022-03-25 15:32:19 PDT 
Crash log says CRASHING TEST: fast/events/ios/submit-form-target-blank-using-return-key.html
Comment 8 Simon Fraser (smfr) 2022-03-25 15:34:14 PDT 
I don't see how this can happen without memory corruption or some kind of IPC confusion.
Comment 9 Simon Fraser (smfr) 2022-03-25 15:35:23 PDT 
Oh, this might just be a side effect of a GPU Process crash.
Comment 10 Simon Fraser (smfr) 2022-03-25 15:53:08 PDT 
Dup to the GPU Process crash bug.

*** This bug has been marked as a duplicate of bug 237674 ***