Closed Bug 1293034 Opened 10 years ago Closed 8 years ago

Crash in nsCSSSelector::IsPseudoElement

Categories

(Core :: CSS Parsing and Computation, defect)

Product:
Core
Component:
CSS Parsing and Computation
Platform:
x86
Windows 10
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME
Tracking Flags:
Tracking Status
firefox48 --- affected
firefox49 --- affected
firefox51 --- affected

People

(Reporter: baffclan, Unassigned)

Details

(Keywords: crash)

Crash Data

This bug was filed from the Socorro interface and is report bp-e78051aa-8e9b-4bce-a1ff-aa34f2160807. ============================================================= Crashing Thread (0) Frame Module Signature Source 0 xul.dll nsCSSSelector::IsPseudoElement() obj-firefox/dist/include/mozilla/css/StyleRule.h:175 1 xul.dll RuleHash::EnumerateAllRules(mozilla::dom::Element*, ElementDependentRuleProcessorData*, NodeMatchContext&) layout/style/nsCSSRuleProcessor.cpp:710 2 xul.dll nsCSSRuleProcessor::RulesMatching(ElementRuleProcessorData*) layout/style/nsCSSRuleProcessor.cpp:2582 3 xul.dll EnumRulesMatching<ElementRuleProcessorData> layout/style/nsStyleSet.cpp:780 4 xul.dll nsStyleSet::FileRules(bool (*)(nsIStyleRuleProcessor*, void*), RuleProcessorData*, mozilla::dom::Element*, nsRuleWalker*) layout/style/nsStyleSet.cpp:1112 5 xul.dll nsStyleSet::ResolveStyleFor(mozilla::dom::Element*, nsStyleContext*, TreeMatchContext&) layout/style/nsStyleSet.cpp:1342 6 xul.dll mozilla::ElementRestyler::RestyleSelf(nsIFrame*, nsRestyleHint, unsigned int*, nsTArray<mozilla::ElementRestyler::SwapInstruction>&) layout/base/RestyleManager.cpp:2877 7 xul.dll mozilla::ElementRestyler::Restyle(nsRestyleHint) layout/base/RestyleManager.cpp:2141 8 xul.dll mozilla::ElementRestyler::RestyleContentChildren(nsIFrame*, nsRestyleHint) layout/base/RestyleManager.cpp:3729 9 xul.dll mozilla::ElementRestyler::RestyleChildren(nsRestyleHint) layout/base/RestyleManager.cpp:3251 10 xul.dll mozilla::ElementRestyler::Restyle(nsRestyleHint) layout/base/RestyleManager.cpp:2296 11 xul.dll mozilla::ElementRestyler::RestyleContentChildren(nsIFrame*, nsRestyleHint) layout/base/RestyleManager.cpp:3729 12 xul.dll mozilla::ElementRestyler::RestyleChildren(nsRestyleHint) layout/base/RestyleManager.cpp:3251 13 xul.dll mozilla::ElementRestyler::Restyle(nsRestyleHint) layout/base/RestyleManager.cpp:2296 14 xul.dll mozilla::ElementRestyler::RestyleContentChildren(nsIFrame*, nsRestyleHint) layout/base/RestyleManager.cpp:3718 15 xul.dll mozilla::ElementRestyler::RestyleChildren(nsRestyleHint) layout/base/RestyleManager.cpp:3251 16 xul.dll mozilla::ElementRestyler::Restyle(nsRestyleHint) layout/base/RestyleManager.cpp:2296 17 xul.dll mozilla::ElementRestyler::RestyleContentChildren(nsIFrame*, nsRestyleHint) layout/base/RestyleManager.cpp:3718 18 xul.dll mozilla::ElementRestyler::RestyleChildren(nsRestyleHint) layout/base/RestyleManager.cpp:3251 19 xul.dll mozilla::ElementRestyler::Restyle(nsRestyleHint) layout/base/RestyleManager.cpp:2296 20 xul.dll mozilla::ElementRestyler::RestyleContentChildren(nsIFrame*, nsRestyleHint) layout/base/RestyleManager.cpp:3729 21 xul.dll mozilla::ElementRestyler::RestyleChildren(nsRestyleHint) layout/base/RestyleManager.cpp:3251 22 xul.dll mozilla::ElementRestyler::Restyle(nsRestyleHint) layout/base/RestyleManager.cpp:2296 23 xul.dll mozilla::ElementRestyler::RestyleContentChildren(nsIFrame*, nsRestyleHint) layout/base/RestyleManager.cpp:3718 24 xul.dll mozilla::ElementRestyler::RestyleChildren(nsRestyleHint) layout/base/RestyleManager.cpp:3251 25 xul.dll mozilla::ElementRestyler::Restyle(nsRestyleHint) layout/base/RestyleManager.cpp:2296 26 xul.dll mozilla::ElementRestyler::RestyleContentChildren(nsIFrame*, nsRestyleHint) layout/base/RestyleManager.cpp:3729 27 xul.dll mozilla::ElementRestyler::RestyleChildren(nsRestyleHint) layout/base/RestyleManager.cpp:3251 28 xul.dll mozilla::ElementRestyler::Restyle(nsRestyleHint) layout/base/RestyleManager.cpp:2296 29 xul.dll mozilla::ElementRestyler::RestyleContentChildren(nsIFrame*, nsRestyleHint) layout/base/RestyleManager.cpp:3729 30 xul.dll mozilla::ElementRestyler::RestyleChildren(nsRestyleHint) layout/base/RestyleManager.cpp:3251 31 xul.dll mozilla::ElementRestyler::Restyle(nsRestyleHint) layout/base/RestyleManager.cpp:2296 32 xul.dll mozilla::ElementRestyler::RestyleContentChildren(nsIFrame*, nsRestyleHint) layout/base/RestyleManager.cpp:3729 33 xul.dll mozilla::ElementRestyler::RestyleChildren(nsRestyleHint) layout/base/RestyleManager.cpp:3251 34 xul.dll mozilla::ElementRestyler::Restyle(nsRestyleHint) layout/base/RestyleManager.cpp:2296 35 xul.dll mozilla::ElementRestyler::RestyleContentChildren(nsIFrame*, nsRestyleHint) layout/base/RestyleManager.cpp:3718 36 xul.dll mozilla::ElementRestyler::RestyleChildren(nsRestyleHint) layout/base/RestyleManager.cpp:3251 37 xul.dll mozilla::ElementRestyler::Restyle(nsRestyleHint) layout/base/RestyleManager.cpp:2296 38 xul.dll mozilla::ElementRestyler::RestyleContentChildren(nsIFrame*, nsRestyleHint) layout/base/RestyleManager.cpp:3729 39 xul.dll mozilla::ElementRestyler::RestyleChildren(nsRestyleHint) layout/base/RestyleManager.cpp:3251 40 xul.dll mozilla::ElementRestyler::Restyle(nsRestyleHint) layout/base/RestyleManager.cpp:2296 41 xul.dll mozilla::ElementRestyler::RestyleContentChildren(nsIFrame*, nsRestyleHint) layout/base/RestyleManager.cpp:3729 42 xul.dll mozilla::ElementRestyler::RestyleChildren(nsRestyleHint) layout/base/RestyleManager.cpp:3251 43 xul.dll mozilla::ElementRestyler::Restyle(nsRestyleHint) layout/base/RestyleManager.cpp:2296 44 xul.dll mozilla::ElementRestyler::RestyleContentChildren(nsIFrame*, nsRestyleHint) layout/base/RestyleManager.cpp:3729 45 xul.dll mozilla::ElementRestyler::RestyleChildren(nsRestyleHint) layout/base/RestyleManager.cpp:3251 46 xul.dll mozilla::ElementRestyler::Restyle(nsRestyleHint) layout/base/RestyleManager.cpp:2296 47 xul.dll mozilla::ElementRestyler::ComputeStyleChangeFor(nsIFrame*, nsStyleChangeList*, nsChangeHint, mozilla::RestyleTracker&, nsRestyleHint, mozilla::RestyleHintData const&, nsTArray<mozilla::ElementRestyler::ContextToClear>&, nsTArray<RefPtr<nsStyleContext> >&) layout/base/RestyleManager.cpp:3393 48 xul.dll mozilla::RestyleManager::ComputeAndProcessStyleChange(nsIFrame*, nsChangeHint, mozilla::RestyleTracker&, nsRestyleHint, mozilla::RestyleHintData const&) layout/base/RestyleManager.cpp:3803 49 xul.dll mozilla::RestyleManager::RestyleElement(mozilla::dom::Element*, nsIFrame*, nsChangeHint, mozilla::RestyleTracker&, nsRestyleHint, mozilla::RestyleHintData const&) layout/base/RestyleManager.cpp:153 50 xul.dll mozilla::RestyleTracker::ProcessOneRestyle(mozilla::dom::Element*, nsRestyleHint, nsChangeHint, mozilla::RestyleHintData const&) layout/base/RestyleTracker.cpp:94 51 xul.dll mozilla::RestyleTracker::DoProcessRestyles() layout/base/RestyleTracker.cpp:265 52 xul.dll mozilla::RestyleManager::ProcessPendingRestyles() layout/base/RestyleManager.cpp:816 53 xul.dll PresShell::FlushPendingNotifications(mozilla::ChangesToFlush) layout/base/nsPresShell.cpp:4123 54 xul.dll nsDocument::FlushPendingNotifications(mozFlushType) dom/base/nsDocument.cpp:8302 55 xul.dll nsComputedDOMStyle::UpdateCurrentStyleSources(bool) layout/style/nsComputedDOMStyle.cpp:633 56 xul.dll nsComputedDOMStyle::GetPropertyCSSValue(nsAString_internal const&, mozilla::ErrorResult&) layout/style/nsComputedDOMStyle.cpp:796 57 xul.dll nsComputedDOMStyle::GetPropertyValue(nsAString_internal const&, nsAString_internal&) layout/style/nsComputedDOMStyle.cpp:379 58 xul.dll nsComputedDOMStyle::GetPropertyValue(nsCSSProperty, nsAString_internal&) layout/style/nsComputedDOMStyle.cpp:317 59 xul.dll mozilla::dom::CSS2PropertiesBinding::get_visibility obj-firefox/dom/bindings/CSS2PropertiesBinding.cpp:41983 60 xul.dll js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) js/src/vm/Interpreter.cpp:453 61 xul.dll js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) js/src/vm/Interpreter.cpp:517 62 xul.dll CallGetter js/src/vm/NativeObject.cpp:1737 63 xul.dll js::GetProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) js/src/vm/NativeObject.h:1478 64 xul.dll JS_ForwardGetPropertyTo(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) js/src/jsapi.cpp:2536 65 xul.dll mozilla::dom::GetPropertyOnPrototype(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<jsid>, bool*, JS::MutableHandle<JS::Value>) dom/bindings/BindingUtils.cpp:1959 66 xul.dll mozilla::dom::CSS2PropertiesBinding::DOMProxyHandler::get(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) obj-firefox/dom/bindings/CSS2PropertiesBinding.cpp:60480 67 xul.dll js::Proxy::get(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) js/src/proxy/Proxy.cpp:310 68 xul.dll GetPropertyOperation js/src/vm/Interpreter.cpp:189 69 xul.dll Interpret js/src/vm/Interpreter.cpp:2590 70 xul.dll js::RunScript(JSContext*, js::RunState&) js/src/vm/Interpreter.cpp:399 71 xul.dll js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) js/src/vm/Interpreter.cpp:471 72 xul.dll js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) js/src/vm/Interpreter.cpp:517 73 xul.dll js::PromiseReactionJob js/src/builtin/Promise.cpp:545 74 xul.dll js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) js/src/vm/Interpreter.cpp:453 75 xul.dll JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) js/src/jsapi.cpp:2849 76 xul.dll mozilla::dom::PromiseJobCallback::Call(JSContext*, JS::Handle<JS::Value>, mozilla::ErrorResult&) obj-firefox/dom/bindings/PromiseBinding.cpp:62 77 xul.dll mozilla::dom::PromiseJobCallback::Call(char const*) obj-firefox/dist/include/mozilla/dom/PromiseBinding.h:191 78 xul.dll PromiseJobRunnable::Run() xpcom/base/CycleCollectedJSRuntime.cpp:941 79 xul.dll mozilla::dom::Promise::PerformMicroTaskCheckpoint() dom/promise/Promise.cpp:1003 80 xul.dll XPCJSRuntime::AfterProcessTask(unsigned int) js/xpconnect/src/XPCJSRuntime.cpp:3745 81 xul.dll nsThread::ProcessNextEvent(bool, bool*) xpcom/threads/nsThread.cpp:1074 82 xul.dll NS_ProcessNextEvent(nsIThread*, bool) xpcom/glue/nsThreadUtils.cpp:290 83 xul.dll mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) ipc/glue/MessagePump.cpp:96 84 xul.dll mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) ipc/glue/MessagePump.cpp:301 85 xul.dll MessageLoop::RunHandler() ipc/chromium/src/base/message_loop.cc:225 86 xul.dll MessageLoop::Run() ipc/chromium/src/base/message_loop.cc:205 87 xul.dll nsBaseAppShell::Run() widget/nsBaseAppShell.cpp:156 88 xul.dll nsAppShell::Run() widget/windows/nsAppShell.cpp:262 89 xul.dll XRE_RunAppShell toolkit/xre/nsEmbedFunctions.cpp:846 90 xul.dll mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) ipc/glue/MessagePump.cpp:269 91 xul.dll MessageLoop::RunHandler() ipc/chromium/src/base/message_loop.cc:225 92 xul.dll MessageLoop::Run() ipc/chromium/src/base/message_loop.cc:205 93 xul.dll XRE_InitChildProcess toolkit/xre/nsEmbedFunctions.cpp:676 94 firefox.exe content_process_main(int, char** const) ipc/contentproc/plugin-container.cpp:197 95 firefox.exe wmain toolkit/xre/nsWindowsWMain.cpp:115 96 firefox.exe __scrt_common_main_seh f:/dd/vctools/crt/vcstartup/src/startup/exe_common.inl:255 97 kernel32.dll BaseThreadInitThunk 98 ntdll.dll RtlUserThreadStart Application Basics Name: Firefox Version: 51.0a1 Build ID: 20160806030806 User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:51.0) Gecko/20100101 Firefox/51.0 OS: Windows_NT 10.0
Looks like value->mSelector in [1] is a nullptr. [1] https://hg.mozilla.org/mozilla-unified/annotate/6b65dd49d4f0/layout/style/nsCSSRuleProcessor.cpp#l710
Component: Layout → CSS Parsing and Computation
Crash volume for signature 'nsCSSSelector::IsPseudoElement': - nightly (version 51): 5 crashes from 2016-08-01. - aurora (version 50): 0 crashes from 2016-08-01. - beta (version 49): 30 crashes from 2016-08-02. - release (version 48): 8 crashes from 2016-07-25. - esr (version 45): 0 crashes from 2016-05-02. Crash volume on the last weeks (Week N is from 08-22 to 08-28): W. N-1 W. N-2 W. N-3 - nightly 0 1 4 - aurora 0 0 0 - beta 10 15 3 - release 2 2 2 - esr 0 0 0 Affected platforms: Windows, Linux Crash rank on the last 7 days: Browser Content Plugin - nightly - aurora - beta #4263 #1246 - release #5518 - esr
status-firefox48: --- → affected
status-firefox49: --- → affected
nsCSSSelector is gone.
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.