(In reply to Donal Meehan [:dmeehan] from comment #5) > Bug 1874826 from the pushlog in comment 3 looks like a possible regressor, please correct if needed. The regressor is probably bug 1875137, actually -- that's about `:has` which is used in the testcase here, and [its patch](https://hg.mozilla.org/mozilla-central/rev/68ff26df33468fe750b39f175b43b8507718ece4) was in `RestyleManager::ElementStateChanged` which is near the bottom of the backtrace in comment 0. [Triaging as S3 given extremely-low crash volume and given that this looks like a null-deref.]
Bug 1941825 Comment 6 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
(In reply to Donal Meehan [:dmeehan] from comment #5) > Bug 1874826 from the pushlog in comment 3 looks like a possible regressor, please correct if needed. The regressor is probably bug 1875137, actually -- that's about `:has` which is used in the testcase here, and [its patch](https://hg.mozilla.org/mozilla-central/rev/68ff26df33468fe750b39f175b43b8507718ece4) was in `RestyleManager::ElementStateChanged` which is near the bottom of the backtrace in comment 0. [Triaging as S3 given extremely-low crash volume and given that this looks like a null-deref and hence is unlikely to be exploitable]