Bug 186752

Summary: [WPE] Three CSS Grid Layout tests crash due to valueless std::optional access
Product: WebKit Reporter: Zan Dobersek <zan>
Component: New BugsAssignee: Manuel Rego Casasnovas <rego>
Status: RESOLVED FIXED    
Severity: Normal CC: commit-queue, ews-watchlist, fred.wang, jfernandez, mcatanzaro, rego, svillar, webkit-bug-importer
Priority: P2 Keywords: InRadar, LayoutTestFailure
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
See Also: https://bugs.webkit.org/show_bug.cgi?id=186536
Attachments:
Description Flags
Patch
none
Patch for landing
none
Archive of layout-test-results from ews202 for win-future none

Description Zan Dobersek 2018-06-17 22:56:34 PDT 
Following three CSS Grid Layout tests crash due to valueless std::optional<> access:

  fast/css-grid-layout/flex-sizing-rows-min-max-height.html [ Crash ]
  fast/css-grid-layout/grid-indefinite-size-auto-repeat-crash.html [ Crash ]
  fast/css-grid-layout/maximize-tracks-definite-indefinite-height.html [ Crash ]

Backtrace:

#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
#1  0x00007f68835f4231 in __GI_abort () at abort.c:79
#2  0x00007f688f060854 in WebCore::IndefiniteSizeStrategy::freeSpaceForStretchAutoTracksStep() const () from /home/zan/Work/webkit/git/WebKitBuild/Release/lib/libWPEWebKit-0.1.so.2
#3  0x00007f688f06270e in WebCore::GridTrackSizingAlgorithm::stretchAutoTracks() () from /home/zan/Work/webkit/git/WebKitBuild/Release/lib/libWPEWebKit-0.1.so.2
#4  0x00007f688f06b25e in WebCore::GridTrackSizingAlgorithm::run() () from /home/zan/Work/webkit/git/WebKitBuild/Release/lib/libWPEWebKit-0.1.so.2
#5  0x00007f688f13986e in WebCore::RenderGrid::computeTrackSizesForIndefiniteSize(WebCore::GridTrackSizingAlgorithm&, WebCore::GridTrackSizingDirection, WebCore::Grid&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) const () from /home/zan/Work/webkit/git/WebKitBuild/Release/lib/libWPEWebKit-0.1.so.2
#6  0x00007f688f13ffae in WebCore::RenderGrid::layoutBlock(bool, WebCore::LayoutUnit) () from /home/zan/Work/webkit/git/WebKitBuild/Release/lib/libWPEWebKit-0.1.so.2
#7  0x00007f688f09197c in WebCore::RenderBlock::layout() () from /home/zan/Work/webkit/git/WebKitBuild/Release/lib/libWPEWebKit-0.1.so.2
#8  0x00007f688f09df58 in WebCore::RenderBlockFlow::insertFloatingObject(WebCore::RenderBox&) () from /home/zan/Work/webkit/git/WebKitBuild/Release/lib/libWPEWebKit-0.1.so.2
#9  0x00007f688f24b25f in WebCore::LineBreaker::skipLeadingWhitespace(WebCore::BidiResolverWithIsolate<WebCore::InlineIterator, WebCore::BidiRun, WebCore::BidiIsolatedRun>&, WebCore::LineInfo&, WebCore::FloatingObject*, WebCore::LineWidth&) () from /home/zan/Work/webkit/git/WebKitBuild/Release/lib/libWPEWebKit-0.1.so.2
#10 0x00007f688f24c0f9 in WebCore::LineBreaker::nextLineBreak(WebCore::BidiResolverWithIsolate<WebCore::InlineIterator, WebCore::BidiRun, WebCore::BidiIsolatedRun>&, WebCore::LineInfo&, WebCore::RenderTextInfo&, WebCore::FloatingObject*, unsigned int, WTF::Vector<WebCore::WordMeasurement, 64ul, WTF::CrashOnOverflow, 16ul>&) () from /home/zan/Work/webkit/git/WebKitBuild/Release/lib/libWPEWebKit-0.1.so.2
#11 0x00007f688f0ed6b3 in WebCore::RenderBlockFlow::layoutRunsAndFloatsInRange(WebCore::LineLayoutState&, WebCore::BidiResolverWithIsolate<WebCore::InlineIterator, WebCore::BidiRun, WebCore::BidiIsolatedRun>&, WebCore::InlineIterator const&, WebCore::BidiStatus const&, unsigned int) () from /home/zan/Work/webkit/git/WebKitBuild/Release/lib/libWPEWebKit-0.1.so.2
(More stack frames follow...)

IndefiniteSizeStrategy::freeSpaceForStretchAutoTracksStep() doesn't properly handle potentially-valueless std::optional<> returned from RenderBox::computeLogicalHeightUsing().

CC-ing Rego since git blame marks him as the last one changing IndefiniteSizeStrategy method.
Comment 1 Manuel Rego Casasnovas 2018-06-29 03:02:19 PDT 
Created attachment 343900 [details]
Patch
Comment 2 Frédéric Wang (:fredw) 2018-06-29 03:07:52 PDT 
Comment on attachment 343900 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=343900&action=review

> Source/WebCore/ChangeLog:8
> +        This is a simple fix for the crash we're getting on WPT

nit: WPE
Comment 3 Manuel Rego Casasnovas 2018-06-29 03:11:18 PDT 
Comment on attachment 343900 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=343900&action=review

Thanks for the review.

>> Source/WebCore/ChangeLog:8
>> +        This is a simple fix for the crash we're getting on WPT
> 
> nit: WPE

Fixed.
Comment 4 Manuel Rego Casasnovas 2018-06-29 03:12:27 PDT 
Created attachment 343901 [details]
Patch for landing
Comment 5 EWS Watchlist 2018-06-29 04:53:32 PDT 
Comment on attachment 343901 [details]
Patch for landing

Attachment 343901 [details] did not pass win-ews (win):
Output: https://webkit-queues.webkit.org/results/8380990

New failing tests:
http/tests/preload/onload_event.html
http/tests/security/canvas-remote-read-remote-video-localhost.html
Comment 6 EWS Watchlist 2018-06-29 04:53:43 PDT 
Created attachment 343905 [details]
Archive of layout-test-results from ews202 for win-future

The attached test failures were seen while running run-webkit-tests on the win-ews.
Bot: ews202  Port: win-future  Platform: CYGWIN_NT-6.1-2.9.0-0.318-5-3-x86_64-64bit
Comment 7 WebKit Commit Bot 2018-06-29 06:30:36 PDT 
Comment on attachment 343901 [details]
Patch for landing

Rejecting attachment 343901 [details] from commit-queue.

Failed to run "['/Volumes/Data/EWS/WebKit/Tools/Scripts/webkit-patch', '--status-host=webkit-queues.webkit.org', '--bot-id=webkit-cq-02', 'land-attachment', '--force-clean', '--non-interactive', '--parent-command=commit-queue', 343901, '--port=mac']" exit_code: 2 cwd: /Volumes/Data/EWS/WebKit

Logging in as commit-queue@webkit.org...
Fetching: https://bugs.webkit.org/attachment.cgi?id=343901&action=edit
Fetching: https://bugs.webkit.org/show_bug.cgi?id=186752&ctype=xml&excludefield=attachmentdata
Processing 1 patch from 1 bug.
Updating working directory
Processing patch 343901 from bug 186752.
Fetching: https://bugs.webkit.org/attachment.cgi?id=343901
Failed to run "['git', 'svn', 'dcommit', '--rmdir']" exit_code: 1 cwd: /Volumes/Data/EWS/WebKit

Committing to http://svn.webkit.org/repository/webkit/trunk ...
	M	LayoutTests/ChangeLog

ERROR from SVN:
Item is out of date: File '/trunk/LayoutTests/ChangeLog' is out of date
W: 520afb937fb21dcb50d9e6b3b471a26c9ea61e30 and refs/remotes/origin/master differ, using rebase:
:040000 040000 d36f35df001b17dbdcd7b744e6fb42e6965237f1 172c046ea96f81760a759929020c90bbad315a31 M	LayoutTests
:040000 040000 2da7d842bface5c865cc98cbfaf45c13277ac5e3 f48cf1eb8ebb2bda1cb41b129bb7f0a133eba963 M	Source
Current branch master is up to date.
ERROR: Not all changes have been committed into SVN, however the committed
ones (if any) seem to be successfully integrated into the working tree.
Please see the above messages for details.


Failed to run "['git', 'svn', 'dcommit', '--rmdir']" exit_code: 1 cwd: /Volumes/Data/EWS/WebKit

Committing to http://svn.webkit.org/repository/webkit/trunk ...
	M	LayoutTests/ChangeLog

ERROR from SVN:
Item is out of date: File '/trunk/LayoutTests/ChangeLog' is out of date
W: 520afb937fb21dcb50d9e6b3b471a26c9ea61e30 and refs/remotes/origin/master differ, using rebase:
:040000 040000 d36f35df001b17dbdcd7b744e6fb42e6965237f1 172c046ea96f81760a759929020c90bbad315a31 M	LayoutTests
:040000 040000 2da7d842bface5c865cc98cbfaf45c13277ac5e3 f48cf1eb8ebb2bda1cb41b129bb7f0a133eba963 M	Source
Current branch master is up to date.
ERROR: Not all changes have been committed into SVN, however the committed
ones (if any) seem to be successfully integrated into the working tree.
Please see the above messages for details.


Failed to run "['git', 'svn', 'dcommit', '--rmdir']" exit_code: 1 cwd: /Volumes/Data/EWS/WebKit
Updating OpenSource
Current branch master is up to date.
Total errors found: 0 in 0 files

Full output: https://webkit-queues.webkit.org/results/8382749
Comment 8 Frédéric Wang (:fredw) 2018-06-29 07:57:56 PDT 
@Rego: It looks like the commit queue is broken, maybe you want to land it manually...
Comment 9 Michael Catanzaro 2018-06-29 11:34:47 PDT 
Comment on attachment 343901 [details]
Patch for landing

View in context: https://bugs.webkit.org/attachment.cgi?id=343901&action=review

> Source/WebCore/ChangeLog:11
> +        Covered by existent tests, just remove them from TestExpectations file.

BTW, for future reference: existent -> existing
Comment 10 WebKit Commit Bot 2018-06-29 11:54:48 PDT 
Comment on attachment 343901 [details]
Patch for landing

Clearing flags on attachment: 343901

Committed r233365: <https://trac.webkit.org/changeset/233365>
Comment 11 WebKit Commit Bot 2018-06-29 11:54:50 PDT 
All reviewed patches have been landed.  Closing bug.
Comment 12 Radar WebKit Bug Importer 2018-06-29 11:56:16 PDT 
<rdar://problem/41646062>