Closed Bug 1401016 Opened 7 years ago Closed 7 years ago

stylo: panicked at 'called `Result::unwrap()` on an `Err` value: ParseIntError { kind: Underflow }', /checkout/src/libcore/result.rs:860

Categories

(Core :: CSS Parsing and Computation, defect, P2)

Product:
Core
Component:
CSS Parsing and Computation
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla57
Tracking Flags:
Tracking Status
firefox-esr52 --- unaffected
firefox55 --- unaffected
firefox56 --- disabled
firefox57 + fixed

People

(Reporter: rs, Assigned: manishearth)

Details

(Keywords: crash, regression)

Attachments

(1 file)

test-crash.html
3.68 KB, text/html
Details
Attached file test-crash.html — 
User Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3198.0 Safari/537.36



Actual results:

###!!! [Parent][RunMessage] Error: Channel closing: too late to send/recv, messages will be lost

thread '<unnamed>' panicked at 'called `Result::unwrap()` on an `Err` value: ParseIntError { kind: Underflow }', /checkout/src/libcore/result.rs:860
stack backtrace:
   0: std::sys::imp::backtrace::tracing::imp::unwind_backtrace
             at /checkout/src/libstd/sys/unix/backtrace/tracing/gcc_s.rs:49
   1: std::panicking::default_hook::{{closure}}
             at /checkout/src/libstd/sys_common/backtrace.rs:71
             at /checkout/src/libstd/sys_common/backtrace.rs:60
             at /checkout/src/libstd/panicking.rs:355
   2: std::panicking::default_hook
             at /checkout/src/libstd/panicking.rs:371
   3: std::panicking::rust_panic_with_hook
             at /checkout/src/libstd/panicking.rs:549
   4: std::panicking::begin_panic
             at /checkout/src/libstd/panicking.rs:511
   5: std::panicking::begin_panic_fmt
             at /checkout/src/libstd/panicking.rs:495
   6: core::panicking::panic_fmt
             at /checkout/src/libstd/panicking.rs:471
   7: core::result::unwrap_failed
             at /checkout/src/libcore/macros.rs:29
   8: cssparser::nth::parse_n_dash_digits
             at /checkout/src/libcore/result.rs:738
             at /builds/worker/workspace/build/src/third_party/rust/cssparser/src/nth.rs:96
   9: cssparser::nth::parse_nth
             at /builds/worker/workspace/build/src/third_party/rust/cssparser/src/nth.rs:45
  10: selectors::parser::parse_functional_pseudo_class
             at /builds/worker/workspace/build/src/servo/components/selectors/parser.rs:1604
             at /builds/worker/workspace/build/src/servo/components/selectors/parser.rs:1586
  11: selectors::parser::parse_one_simple_selector
             at /builds/worker/workspace/build/src/servo/components/selectors/parser.rs:1676
             at /builds/worker/workspace/build/src/third_party/rust/cssparser/src/parser.rs:472
             at /builds/worker/workspace/build/src/third_party/rust/cssparser/src/parser.rs:857
             at /builds/worker/workspace/build/src/third_party/rust/cssparser/src/parser.rs:520
             at /builds/worker/workspace/build/src/servo/components/selectors/parser.rs:1675
  12: <selectors::parser::SelectorList<Impl>>::parse
             at /builds/worker/workspace/build/src/servo/components/selectors/parser.rs:0
             at /builds/worker/workspace/build/src/servo/components/selectors/parser.rs:1064
             at /builds/worker/workspace/build/src/servo/components/selectors/parser.rs:191
             at /builds/worker/workspace/build/src/third_party/rust/cssparser/src/parser.rs:472
             at /builds/worker/workspace/build/src/third_party/rust/cssparser/src/parser.rs:797
             at /builds/worker/workspace/build/src/third_party/rust/cssparser/src/parser.rs:535
             at /builds/worker/workspace/build/src/servo/components/selectors/parser.rs:191
  13: Servo_StyleSheet_FromUTF8Bytes
             at /builds/worker/workspace/build/src/servo/components/style/stylesheets/rule_parser.rs:564
             at /builds/worker/workspace/build/src/servo/components/style/stylesheets/rule_parser.rs:289
             at /builds/worker/workspace/build/src/third_party/rust/cssparser/src/rules_and_declarations.rs:518
             at /builds/worker/workspace/build/src/third_party/rust/cssparser/src/parser.rs:472
             at /builds/worker/workspace/build/src/third_party/rust/cssparser/src/parser.rs:797
             at /builds/worker/workspace/build/src/third_party/rust/cssparser/src/rules_and_declarations.rs:517
             at /builds/worker/workspace/build/src/third_party/rust/cssparser/src/rules_and_declarations.rs:378
             at /builds/worker/workspace/build/src/servo/components/style/stylesheets/stylesheet.rs:387
             at /builds/worker/workspace/build/src/servo/components/style/stylesheets/stylesheet.rs:83
             at /builds/worker/workspace/build/src/servo/ports/geckolib/glue.rs:907
  14: _ZN7mozilla15ServoStyleSheet10ParseSheetEPNS_3css6LoaderENS_4SpanIKhLm18446744073709551615EEEP6nsIURIS8_P12nsIPrincipalj15nsCompatibilityPNS1_25LoaderReusableStyleSheetsE
             at /builds/worker/workspace/build/src/layout/style/ServoStyleSheet.cpp:213
  15: _ZN7mozilla3css6Loader10ParseSheetERK12nsTSubstringIDsENS_4SpanIKhLm18446744073709551615EEEPNS0_13SheetLoadDataERb
             at /builds/worker/workspace/build/src/layout/style/Loader.cpp:1646
  16: _ZN7mozilla3css6Loader15LoadInlineStyleEP10nsIContentRK12nsTSubstringIDsEjS7_S7_NS_3net14ReferrerPolicyEPNS_3dom7ElementEP20nsICSSLoaderObserverPbSF_
             at /builds/worker/workspace/build/src/layout/style/Loader.cpp:1912
  17: _ZN18nsStyleLinkElement18DoUpdateStyleSheetEP11nsIDocumentPN7mozilla3dom10ShadowRootEP20nsICSSLoaderObserverPbS8_b
             at /builds/worker/workspace/build/src/dom/base/nsStyleLinkElement.cpp:551
  18: _ZN18nsStyleLinkElement16UpdateStyleSheetEP20nsICSSLoaderObserverPbS2_b
             at /builds/worker/workspace/build/src/dom/base/nsStyleLinkElement.cpp:335
  19: _ZN22nsHtml5DocumentBuilder16UpdateStyleSheetEP10nsIContent
             at /builds/worker/workspace/build/src/parser/html/nsHtml5DocumentBuilder.cpp:83
  20: _ZN20nsHtml5TreeOperation7PerformEP21nsHtml5TreeOpExecutorPP10nsIContentPb
             at /builds/worker/workspace/build/src/parser/html/nsHtml5TreeOperation.cpp:959
  21: _ZN21nsHtml5TreeOpExecutor12RunFlushLoopEv
             at /builds/worker/workspace/build/src/parser/html/nsHtml5TreeOpExecutor.cpp:461
  22: _ZN22nsHtml5ExecutorFlusher3RunEv
             at /builds/worker/workspace/build/src/parser/html/nsHtml5StreamParser.cpp:130
  23: _ZN7mozilla14SchedulerGroup8Runnable3RunEv
             at /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396
  24: _ZN8nsThread16ProcessNextEventEbPb
             at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1039
  25: _Z19NS_ProcessNextEventP9nsIThreadb
             at /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:521
  26: _ZN7mozilla3ipc11MessagePump3RunEPN4base11MessagePump8DelegateE
             at /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:97
  27: _ZN11MessageLoop3RunEv
             at /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:326
             at /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:319
             at /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:299
  28: _ZN14nsBaseAppShell3RunEv
             at /builds/worker/workspace/build/src/widget/nsBaseAppShell.cpp:158
  29: _Z15XRE_RunAppShellv
             at /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:880
  30: _ZN11MessageLoop3RunEv
             at /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:326
             at /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:319
             at /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:299
  31: _Z20XRE_InitChildProcessiPPcPK12XREChildData
             at /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:705
  32: main
             at /builds/worker/workspace/build/src/browser/app/../../ipc/contentproc/plugin-container.cpp:63
             at /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:285
  33: __libc_start_main
  34: <unknown>

###!!! [Parent][MessageChannel] Error: (msgtype=0x150081,name=PBrowser::Msg_Destroy) Channel error: cannot send/recv
Requires Stylo to be enabled to reproduce. Bisection on mozilla-central just goes back to when we first started building Stylo by default.
Group: firefox-core-security → layout-core-security
Status: UNCONFIRMED → NEW
status-firefox55: --- → unaffected
status-firefox56: --- → disabled
status-firefox57: --- → affected
status-firefox-esr52: --- → unaffected
tracking-firefox57: --- → ?
Component: Untriaged → CSS Parsing and Computation
Ever confirmed: true
Flags: needinfo?(cam)
Keywords: crash, regression
Product: Firefox → Core
Rust panics generally aren't security-sensitive.
Priority: -- → P2
Summary: Nightly weird crash, panicked at 'called `Result::unwrap()` on an `Err` value: ParseIntError { kind: Underflow }', /checkout/src/libcore/result.rs:860 → stylo: panicked at 'called `Result::unwrap()` on an `Err` value: ParseIntError { kind: Underflow }', /checkout/src/libcore/result.rs:860
Group: layout-core-security
This unwrap() should be a try or a saturating parse.

https://doc.servo.org/src/cssparser/nth.rs.html#96
Assignee: nobody → manishearth
Flags: needinfo?(cam)
Pushed by manishearth@gmail.com:
https://hg.mozilla.org/integration/autoland/rev/f225956e4d48
Bump cssparser to 0.21.2; r=SimonSapin
https://hg.mozilla.org/mozilla-central/rev/f225956e4d48
Status: NEW → RESOLVED
Closed: 7 years ago
status-firefox57: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla57
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: