Bug 249571

Summary: ASSERTION FAILED: rangesIntersect(m_renderer->logicalTopForFloat(floatingObject), m_renderer->logicalBottomForFloat(floatingObject), m_lineTop, m_lineBottom)
Product: WebKit Reporter: Fujii Hironori <Hironori.Fujii>
Component: Layout and RenderingAssignee: Fujii Hironori <Hironori.Fujii>
Status: RESOLVED FIXED    
Severity: Normal CC: bfulgham, changseok, darin, esprehn+autocc, ews-watchlist, glenn, hodovan, kondapallykalyan, pdr, simon.fraser, webkit-bug-importer, zalan, zzzssspro0202
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
See Also: https://bugs.webkit.org/show_bug.cgi?id=244594
https://bugs.webkit.org/show_bug.cgi?id=244591
https://bugs.webkit.org/show_bug.cgi?id=125831
Attachments:
Description Flags
Patch none

Description Fujii Hironori 2022-12-18 23:13:56 PST 
ASSERTION FAILED: rangesIntersect(m_renderer->logicalTopForFloat(floatingObject), m_renderer->logicalBottomForFloat(floatingObject), m_lineTop, m_lineBottom)

WinCairo WK2 Debug reports an assertion failure for fast/css/intruding-floats-crash.html.

> python.exe ./Tools/Scripts/run-webkit-tests --wincairo --debug --no-retry-failures fast/css/intruding-floats-crash.html --iterations=100 -f

C:\home\webkit\gc\Source\WebKit\NetworkProcess/Classifier/ResourceLoadStatisticsDatabaseStore.cpp(318) : WebKit::ResourceLoadStatisticsDatabaseStore::ResourceLoadStatisticsDatabaseStore
ASSERTION FAILED: rangesIntersect(m_renderer->logicalTopForFloat(floatingObject), m_renderer->logicalBottomForFloat(floatingObject), m_lineTop, m_lineBottom)
C:\home\webkit\gc\Source\WebCore\rendering/FloatingObjects.cpp(484) : WebCore::ComputeFloatOffsetAdapter<2>::collectIfNeeded
1   00007FFB56DA248B WTFCrash
2   00007FFAFADDDA5E WTFCrashWithInfo
3   00007FFAFEBAD9DA WebCore::ComputeFloatOffsetAdapter<2>::collectIfNeeded
4   00007FFAFEBA6D44 WebCore::PODIntervalTree<WebCore::LayoutUnit,WebCore::FloatingObject *>::searchForOverlapsFrom<WebCore::ComputeFloatOffsetForLineLayoutAdapter<2> >
5   00007FFAFEB9FE4B WebCore::PODIntervalTree<WebCore::LayoutUnit,WebCore::FloatingObject *>::allOverlapsWithAdapter<WebCore::ComputeFloatOffsetForLineLayoutAdapter<2> >
6   00007FFAFEB7EAAC WebCore::FloatingObjects::logicalRightOffset
7   00007FFAFEC6188E WebCore::RenderBlockFlow::logicalRightFloatOffsetForLine
8   00007FFAFECCFEED WebCore::RenderBlock::logicalRightOffsetForLine
9   00007FFAFECCFF80 WebCore::RenderBlock::logicalRightOffsetForLine
10  00007FFAFEC430B6 WebCore::RenderBlock::logicalRightSelectionOffset
11  00007FFAFEC4031B WebCore::RenderBlock::logicalLeftSelectionGap
12  00007FFAFEC751CA `WebCore::RenderBlockFlow::inlineSelectionGaps'::`2'::<lambda_2>::operator()
13  00007FFAFEC646CB WebCore::RenderBlockFlow::inlineSelectionGaps
14  00007FFAFEC4F2CD WebCore::RenderBlock::selectionGaps
15  00007FFAFEC4016E WebCore::RenderBlock::selectionGapRectsForRepaint
16  00007FFAFEEAB12A WebCore::RenderBlockSelectionInfo::RenderBlockSelectionInfo
17  00007FFAFEF2CA84 std::make_unique<WebCore::RenderBlockSelectionInfo,WebCore::RenderBlock &,0>
18  00007FFAFEF2C2E6 WTF::makeUnique<WebCore::RenderBlockSelectionInfo,WebCore::RenderBlock &>
19  00007FFAFEEF58A6 WebCore::SelectionRangeData::apply
20  00007FFAFEEF437F WebCore::SelectionRangeData::set
21  00007FFAFDAE8BF7 WebCore::FrameSelection::updateAppearance
22  00007FFAFDAEA9D4 WebCore::FrameSelection::updateAndRevealSelection
23  00007FFAFDAF0748 WebCore::FrameSelection::updateAppearanceAfterLayoutOrStyleChange
24  00007FFAFDAE4107 WebCore::FrameSelection::updateAppearanceAfterLayout
25  00007FFAFE56DBC7 WebCore::FrameView::performPostLayoutTasks
26  00007FFAFE5F15F1 WebCore::FrameViewLayoutContext::runAsynchronousTasks
27  00007FFAFE5F16E4 WebCore::FrameViewLayoutContext::runOrScheduleAsynchronousTasks
28  00007FFAFE5F11E4 WebCore::FrameViewLayoutContext::performLayout
29  00007FFAFE5EF6BF WebCore::FrameViewLayoutContext::layout
30  00007FFAFE559E66 WebCore::FrameView::updateContentsSize
31  00007FFAFE7D5D8A WebCore::ScrollView::updateScrollbars
Comment 1 Fujii Hironori 2022-12-18 23:23:21 PST 
Similar problems has been reported. But, they are not reproduced for me.

Bug 132725 – ASSERTION FAILED: rangesIntersect(m_renderer.logicalTopForFloat(floatingObject), m_renderer.logicalBottomForFloat(floatingObject), m_lineTop, m_lineBottom)
Bug 164082 – ASSERTION FAILED: rangesIntersect(m_renderer.logicalTopForFloat(floatingObject), m_renderer.logicalBottomForFloat(floatingObject), m_belowLogicalHeight, m_aboveLogicalHeight) in WebCore::FindNextFloatLogicalBottomAdapter::collectIfNeeded
Bug 164082 – ASSERTION FAILED: rangesIntersect(m_renderer.logicalTopForFloat(floatingObject), m_renderer.logicalBottomForFloat(floatingObject), m_belowLogicalHeight, m_aboveLogicalHeight) in WebCore::FindNextFloatLogicalBottomAdapter::collectIfNeeded
Bug 212267 – [css-grid] imported/w3c/web-platform-tests/css/css-grid/alignment/grid-item-self-baseline-001.html asserts on Debug
Bug 244591 – ASSERTION FAILED: rangesIntersect(m_renderer->logicalTopForFloat(floatingObject), m_renderer->logicalBottomForFloat(floatingObject), m_lineTop, m_lineBottom)
Bug 244594 – ASSERTION FAILED: rangesIntersect(m_renderer->logicalTopForFloat(floatingObject), m_renderer->logicalBottomForFloat(floatingObject), m_belowLogicalHeight, LayoutUnit::max())
Comment 2 Fujii Hironori 2022-12-18 23:28:03 PST 
Mac WK1 Debug is also reporting the assertion failures. For example,

Buildbot: builder Apple-Ventura-Debug-AppleSilicon-WK1-Tests build 572
https://build.webkit.org/#/builders/705/builds/572

ASSERTION FAILED: rangesIntersect(m_renderer->logicalTopForFloat(floatingObject), m_renderer->logicalBottomForFloat(floatingObject), m_lineTop, m_lineBottom)
rendering/FloatingObjects.cpp(484) : void WebCore::ComputeFloatOffsetAdapter<WebCore::FloatingObject::FloatRight>::collectIfNeeded(const WebCore::ComputeFloatOffsetAdapter::IntervalType &) [FloatTypeValue = WebCore::FloatingObject::FloatRight]
Comment 3 Fujii Hironori 2022-12-21 21:56:37 PST 
Created attachment 464159 [details]
Patch
Comment 4 EWS 2022-12-22 06:31:15 PST 
Committed 258241@main (c982868aec77): <https://commits.webkit.org/258241@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 464159 [details].
Comment 5 Radar WebKit Bug Importer 2022-12-22 06:32:16 PST 
<rdar://problem/103636568>
Comment 6 Fujii Hironori 2022-12-22 13:28:15 PST 
*** Bug 132725 has been marked as a duplicate of this bug. ***
Comment 7 Fujii Hironori 2022-12-22 13:28:49 PST 
*** Bug 164082 has been marked as a duplicate of this bug. ***
Comment 8 Fujii Hironori 2022-12-22 13:29:48 PST 
*** Bug 244591 has been marked as a duplicate of this bug. ***
Comment 9 Fujii Hironori 2022-12-22 13:30:04 PST 
*** Bug 244594 has been marked as a duplicate of this bug. ***