| Summary: | REGRESSION(257434@main): Crash in RenderReplaced::computeIntrinsicSizesConstrainedByTransferredMinMaxSizes on https://gitlab.com/gnutls/gnutls/ | ||||||
|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Michael Catanzaro <mcatanzaro> | ||||
| Component: | Layout and Rendering | Assignee: | Nobody <webkit-unassigned> | ||||
| Status: | RESOLVED FIXED | ||||||
| Severity: | Normal | CC: | bfulgham, bugs-noreply, mcatanzaro, sgill26, simon.fraser, webkit-bug-importer, zalan | ||||
| Priority: | P2 | Keywords: | InRadar | ||||
| Version: | WebKit Nightly Build | ||||||
| Hardware: | PC | ||||||
| OS: | Linux | ||||||
| See Also: |
https://github.com/web-platform-tests/wpt/pull/37617 https://bugs.webkit.org/show_bug.cgi?id=249795 |
||||||
| Attachments: |
|
||||||
|
Description
Michael Catanzaro
2022-12-19 16:17:36 PST
Hi Sammy, can you please reorder your emails in metadata/contributors.json? The first email listed there is the one that Bugzilla's CC list will autocomplete so your Bugzilla email should be listed first. Currently, trying to CC you results in an error. (You can try it yourself on a different bug and see.) Just swapping the lines should fix that. Created attachment 464109 [details]
gdb.txt
Hi Michael, Yes I will fix that issue with the contributors.json file! For the regression, could you help me get a reduced test case on that page? I tried navigating to that page (https://gitlab.com/gnutls/gnutls/) on a build that is fairly close to trunk, but it did not seem to reproduce for me. I am assuming that you are just navigating to the page and it crashes? I'll continue try to to reproduce the issue and look into the logic, but a test file or archive would definitely help! Well sadly I just loaded https://gitlab.com/gnutls/gnutls and this time it didn't crash. I swear it was 100% reproducible a couple hours ago: Mon 2022-12-19 17:40:00 CST 129533 1000 1000 SIGABRT present /usr/libexec/webkitgtk-6.0/WebKitWebProcess > Mon 2022-12-19 17:40:17 CST 129687 1000 1000 SIGABRT present /usr/libexec/webkitgtk-6.0/WebKitWebProcess > Mon 2022-12-19 17:40:39 CST 130002 1000 1000 SIGABRT present /usr/libexec/webkitgtk-6.0/WebKitWebProcess > Mon 2022-12-19 17:41:10 CST 130388 1000 1000 SIGABRT present /usr/libexec/webkitgtk-6.0/WebKitWebProcess > Mon 2022-12-19 17:58:59 CST 133877 1000 1000 SIGABRT present /usr/libexec/webkitgtk-6.0/WebKitWebProcess So it crashed five times in a row over the span of 20 minutes. Who knows what changed.... Eh, now it crashed twice more when I refreshed the page. So I guess it *usually* crashes, but not quite 100%. I think style().logicalMinHeight() and style().logicalMaxHeight() may be useful inside of the RenderReplaced::computeIntrinsicSizesConstrainedByTransferredMinMaxSizes call. I would also be curious what blockMinSize and blockMaxSize are being computed to inside RenderBox::computeMinMaxLogicalWidthFromAspectRatio which gets called from that same RenderReplaced::computeIntrinsicSizesConstrainedByTransferredMinMaxSizes method I added a WebKit assertion, and I see it now: Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 WebCore 0x144cc2244 WTFCrashWithInfo(int, char const*, char const*, int) + 36 (Assertions.h:754) 1 WebCore 0x14a6fb248 WebCore::RenderReplaced::computeIntrinsicSizesConstrainedByTransferredMinMaxSizes(WebCore::RenderBox*, WebCore::FloatSize&, WebCore::FloatSize&) const + 1140 (RenderReplaced.cpp:460) 2 WebCore 0x14a6fca04 WebCore::RenderReplaced::computeReplacedLogicalWidth(WebCore::ShouldComputePreferred) const + 688 (RenderReplaced.cpp:590) 3 WebCore 0x14a5c2080 WebCore::RenderImage::computeReplacedLogicalWidth(WebCore::ShouldComputePreferred) const + 216 (RenderImage.cpp:274) Our C++ library apparently doesn't include this assertion (or perhaps our build rules don't use the asserting version of the library). Pull request: https://github.com/WebKit/WebKit/pull/7946 Submitted web-platform-tests pull request: https://github.com/web-platform-tests/wpt/pull/37617 Committed 258210@main (28c5d0e82b0f): <https://commits.webkit.org/258210@main> Reviewed commits have been landed. Closing PR #7946 and removing active labels. |