Bug 262265 - ASSERTION FAILED: foundAncestor /app/webkit/Source/WebCore/rendering/RenderLayer.cpp(2440)
Summary: ASSERTION FAILED: foundAncestor /app/webkit/Source/WebCore/rendering/RenderLa...
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: Layout and Rendering (show other bugs)
Version: WebKit Nightly Build
Hardware: PC Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords: BrowserCompat, InRadar
Depends on:
Blocks:
 
Reported: 2023-09-27 22:17 PDT by djinn
Modified: 2024-07-09 18:24 PDT (History)
6 users (show)

See Also:

Attachments
testcase to trigger the crash (8.37 MB, text/html)
2023-09-27 22:17 PDT, djinn 		no flags Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description djinn 2023-09-27 22:17:34 PDT 
Created attachment 467939 [details]
testcase to trigger the crash

ASSERTION FAILED: foundAncestor
/app/webkit/Source/WebCore/rendering/RenderLayer.cpp(2440) : const WebCore::RenderLayer* WebCore::accumulateOffsetTowardsAncestor(const RenderLayer*, const RenderLayer*, LayoutPoint&, RenderLayer::ColumnOffsetAdjustment)

The minimized testcase will be upload as soon as possible.
Comment 1 Ahmad Saleem 2023-09-28 03:47:20 PDT 
Fixed similar assertion in Blink here: https://src.chromium.org/viewvc/blink?view=revision&revision=199725
Comment 2 Karl Dubost 2023-09-28 18:44:55 PDT 
Ahmad, 

And the companion test seems to be there, but it is passing on all browsers (once normalized for property names.)
https://searchfox.org/wubkat/search?q=transform-with-fixedpos&path=&case=false&regexp=false

So Maybe there's more to it.
Comment 3 Radar WebKit Bug Importer 2023-10-04 22:18:32 PDT 
<rdar://problem/116503953>
Comment 4 djinn 2023-11-03 23:03:14 PDT 
Hello, I would like to ask if a previously submitted bug is still not processed or unconfirmed, was it submitted in the wrong way? Or is it something else? Should I offer more info?
Comment 5 Karl Dubost 2023-11-05 17:44:34 PST 
djinn,

I haven't reproduced the crash with the attached test case on Safari Release 181 (Safari 17.4, WebKit 19618.1.3.1)

The testcase seems to be just the webpage of Outlook.
Often it's easier to get a reduced test case which exactly triggers the issue. 


Some of the past commits on chromium
https://github.com/search?q=repo%3Achromium%2Fchromium+accumulateOffsetTowardsAncestor&type=commits

The current code on WebKit
https://searchfox.org/wubkat/rev/023c54054092dc68c5df3b230ed3137cbd753b16/Source/WebCore/rendering/RenderLayer.cpp#2435
Comment 6 Ahmad Saleem 2024-07-09 18:23:43 PDT 
SVN mirror is gone, so putting chromium git link - https://chromium.googlesource.com/chromium/blink/+/973d374bd2935f90e9513377bc6e3c85045207df