[Webkit-unassigned] [Bug 260827] New: REGRESSION(267321 at main): imported/w3c/web-platform-tests/css/geometry/DOMMatrix-001.html crashes constantly.

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=260827

            Bug ID: 260827
           Summary: REGRESSION(267321 at main):
                    imported/w3c/web-platform-tests/css/geometry/DOMMatrix
                    -001.html crashes constantly.
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: DOM
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: ben_schwartz at apple.com
                CC: ntim at apple.com,
                    webkit-bot-watchers-bugzilla at group.apple.com,
                    webkit-bug-importer at group.apple.com

imported/w3c/web-platform-tests/css/geometry/DOMMatrix-001.html

This test is a constant crash on all platforms.

HISTORY:

https://results.webkit.org/?suite=layout-tests&test=imported%2Fw3c%2Fweb-platform-tests%2Fcss%2Fgeometry%2FDOMMatrix-001.html

CRASH LOG (sample):

ASSERTION FAILED: style()
css/CSSToLengthConversionData.cpp(68) : const WebCore::FontCascade &WebCore::CSSToLengthConversionData::fontCascadeForFontUnits() const
1   0x3435f41a9 WTFCrash
2   0x3e25f591b WTFCrashWithInfo(int, char const*, char const*, int)
3   0x3e6036901 WebCore::CSSToLengthConversionData::fontCascadeForFontUnits() const
4   0x3e5fe9697 WebCore::CSSPrimitiveValue::computeNonCalcLengthDouble(WebCore::CSSToLengthConversionData const&, WebCore::CSSUnitType, double)
5   0x3e5fe91eb WebCore::CSSPrimitiveValue::computeLengthDouble(WebCore::CSSToLengthConversionData const&) const
6   0x3e5fe953d double WebCore::CSSPrimitiveValue::computeLength<double>(WebCore::CSSToLengthConversionData const&) const
...

CRASH LOG (full) LINK:

https://build.webkit.org/results/Apple-Monterey-Debug-WK2-Tests/267321@main%20(8526)/imported/w3c/web-platform-tests/css/geometry/DOMMatrix-001-crash-log.txt

REPRODUCIBILITY:

I was able to reproduce this bug on macOS Ventura 13.5 (22G74/arm64) using the following command:

run-webkit-tests --verbose imported/w3c/web-platform-tests/css/geometry/DOMMatrix-001.html

REGRESSION:

I was able to bisect a regression point. This test reproduced at 267321 at main, but it did not reproduce at 267320 at main. Changes at 267321 at main appear to be directly related to this error, and are likely what caused the failure.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20230828/3b026b85/attachment.htm>