Bug 254030

Summary:	REGRESSION (261623@main?): [ iOS, macOS Debug ] ASSERTION FAILED: !isCalculated() in WebCore::Length::value()
Product:	WebKit	Reporter:	Bri Harris <bharris9>
Component:	New Bugs	Assignee:	Nobody <webkit-unassigned>
Status:	RESOLVED DUPLICATE
Severity:	Normal	CC:	ahmad.saleem792, webkit-bot-watchers-bugzilla, webkit-bug-importer, zalan
Priority:	P2	Keywords:	InRadar
Version:	Other
Hardware:	Unspecified
OS:	Unspecified

Description Bri Harris 2023-03-16 10:09:49 PDT

fast/table/calculated-width-on-col-within-colgroup.html

is a constant crash on iOS and macOS Debug only. 

HISTORY:

https://results.webkit.org/?suite=layout-tests&test=fast%2Ftable%2Fcalculated-width-on-col-within-colgroup.html


Crash Log Text:

ASSERTION FAILED: !isCalculated()
/Volumes/Data/worker/macOS-AppleSilicon-Ventura-Debug-Build-EWS/build/Source/WebCore/platform/Length.h(341) : float WebCore::Length::value() const
1   0x13a89f2b0 WTFCrash
2   0x28065d6a0 WebCore::JSANGLEInstancedArrays::createPrototype(JSC::VM&, WebCore::JSDOMGlobalObject&)
3   0x28218076c WebCore::Length::value() const
4   0x2857fc288 WebCore::AutoTableLayout::recalcColumn(unsigned int)
5   0x2857fd304 WebCore::AutoTableLayout::fullRecalc()
6   0x2857fd528 WebCore::AutoTableLayout::computeIntrinsicLogicalWidths(WebCore::LayoutUnit&, WebCore::LayoutUnit&, WebCore::TableIntrinsics)
7   0x285b72314 WebCore::RenderTable::computeIntrinsicLogicalWidths(WebCore::LayoutUnit&, WebCore::LayoutUnit&, WebCore::TableIntrinsics) const
8   0x285b7234c WebCore::RenderTable::computeIntrinsicLogicalWidths(WebCore::LayoutUnit&, WebCore::LayoutUnit&) const
9   0x285b72418 WebCore::RenderTable::computePreferredLogicalWidths()
10  0x2859834b8 WebCore::RenderBox::maxPreferredLogicalWidth() const
11  0x285b6dd2c WebCore::RenderTable::updateLogicalWidth()
12  0x285b6f3cc WebCore::RenderTable::layout()
13  0x285920518 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&)
14  0x28591f9f8 WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&)
15  0x28591e3c8 WebCore::RenderBlockFlow::layoutInFlowChildren(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&, WebCore::LayoutUnit&)
16  0x28591d774 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit)
17  0x285906578 WebCore::RenderBlock::layout()
18  0x285920518 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&)
19  0x28591f9f8 WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&)
20  0x28591e3c8 WebCore::RenderBlockFlow::layoutInFlowChildren(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&, WebCore::LayoutUnit&)
21  0x28591d774 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit)
22  0x285906578 WebCore::RenderBlock::layout()
23  0x285920518 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&)
24  0x28591f9f8 WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&)
25  0x28591e3c8 WebCore::RenderBlockFlow::layoutInFlowChildren(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&, WebCore::LayoutUnit&)
26  0x28591d774 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit)
27  0x285906578 WebCore::RenderBlock::layout()
28  0x285be8d40 WebCore::RenderView::layout()
29  0x284c7f140 WebCore::FrameViewLayoutContext::performLayout()
30  0x284c7ea54 WebCore::FrameViewLayoutContext::layout()
31  0x283bbd624 WebCore::Document::updateLayout()
com.apple.WebKit.WebContent.Development terminated (pid 2071) for reason: crash
LEAK: 1 WebPageProxy

Comment 1 Bri Harris 2023-03-16 10:10:59 PDT

I was able to replicate this crash on Ventura ToT and iOS 16 ToT as follows:

run-webkit-tests --root fast/table/calculated-width-on-col-within-colgroup.html --force

Comment 2 Radar WebKit Bug Importer 2023-03-16 10:11:18 PDT

<rdar://problem/106813623>

Comment 3 EWS 2023-03-16 11:03:52 PDT

Test gardening commit 261754@main (b56022040d48): <https://commits.webkit.org/261754@main>

Reviewed commits have been landed. Closing PR #11615 and removing active labels.

Comment 4 Ryan Haddad 2023-03-17 10:01:36 PDT

This test was added with https://commits.webkit.org/261623@main, the test has been asserting from the start.

Comment 5 Ryan Haddad 2023-03-17 10:01:45 PDT

*** Bug 254034 has been marked as a duplicate of this bug. ***

Comment 6 Ryan Haddad 2023-03-17 10:03:36 PDT

Duping the other way.

*** This bug has been marked as a duplicate of bug 254034 ***