WebKit Bugzilla
New
Browse
Log In
×
Sign in with GitHub
or
Remember my login
Create Account
·
Forgot Password
Forgotten password account recovery
NEW
258135
REGRESSION(
264701@main
): wpt/css/CSS2/normal-flow/crashtests/block-in-inline-ax-crash.html
https://bugs.webkit.org/show_bug.cgi?id=258135
Summary
REGRESSION(264701@main): wpt/css/CSS2/normal-flow/crashtests/block-in-inline-...
Sam Sneddon [:gsnedders]
Reported
2023-06-15 07:53:09 PDT
c.f.
https://wpt.fyi/results/css/CSS2/normal-flow/crashtests/block-in-inline-ax-crash.html?run_id=5081514008641536&run_id=5202434048131072&run_id=5082008735186944&run_id=5125781984903168&run_id=5071490779709440
Attachments
Add attachment
proposed patch, testcase, etc.
Radar WebKit Bug Importer
Comment 1
2023-06-15 07:53:20 PDT
<
rdar://problem/110839883
>
Chris Dumez
Comment 2
2023-06-15 09:04:01 PDT
This is a crash test, not a correctness test.
264701@main
aligned our behavior with Firefox when it comes to timer ordering (Chrome still has the bug). As a result, it is a little surprising Firefox is passing this crash test and we're not. I looked into it and Chrome & Firefox's output is very different. Chrome runs the whole test without JS exception and produces a large output. Firefox produces a much smaller output because they throw exceptions. We have Firefox's timer ordering but don't end up throwing exception. As a result, the test ends up in an infinite loop and the WebProcess hangs. I wouldn't say this is a true regression given that this isn't a correctness and given that our new timer ordering is correct.
Chris Dumez
Comment 3
2023-06-15 09:04:33 PDT
Exceptions thrown by Firefox: ``` Uncaught TypeError: oRange is null event_handler_ECA_DOMCharacterDataModified
http://wpt.live/css/CSS2/normal-flow/crashtests/block-in-inline-ax-crash.html:50
event_handler_EC9_load
http://wpt.live/css/CSS2/normal-flow/crashtests/block-in-inline-ax-crash.html:20
block-in-inline-ax-crash.html:50:25 Uncaught TypeError: oRange is null event_handler_EC9_load
http://wpt.live/css/CSS2/normal-flow/crashtests/block-in-inline-ax-crash.html:31
block-in-inline-ax-crash.html:31:1 Uncaught DOMException: Node.insertBefore: The new child is an ancestor of the parent <anonymous>
http://wpt.live/css/CSS2/normal-flow/crashtests/block-in-inline-ax-crash.html:127
block-in-inline-ax-crash.html:127 ```
Note
You need to
log in
before you can comment on or make changes to this bug.
Top of Page
Format For Printing
XML
Clone This Bug