1345579 - Crash near null [@ PLDHashTable::Iterator::Iterator | mozilla::CSSVariableDeclarations::AddVariablesToResolver]

Status: RESOLVED DUPLICATE of bug 1356601

(Core :: DOM: Animation, defect)

Description

[Jesse Schwartzentruber (:truber)]

Attachment: testcase.xhtml

The attached testcase crashes near null in mozilla-central rev 58753259bfeb.

==24539==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000018 (pc 0x7fc299e6050f bp 0x7ffd5b4d8a90 sp 0x7ffd5b4d8a30 T0)
    #0 PLDHashTable::Iterator::Iterator(PLDHashTable*) src/xpcom/ds/PLDHashTable.cpp:717:5
    #1 Iterator src/obj-firefox/dist/include/nsBaseHashtable.h:182:50
    #2 ConstIter src/obj-firefox/dist/include/nsBaseHashtable.h:204
    #3 mozilla::CSSVariableDeclarations::AddVariablesToResolver(mozilla::CSSVariableResolver*) const src/layout/style/CSSVariableDeclarations.cpp:153

Comment 1

[Jesse Schwartzentruber (:truber)]

Attachment: log.txt

ASan log from mozilla-central rev 58753259bfeb

Comment 2

[Jesse Schwartzentruber (:truber)]

Attachment: debug.txt

Debug log from mozilla-central rev 575e82f15c29.

Assertion failure: aRuleData->mVariables (shouldn't be in ComputeVariablesData if there were no variable declarations specified), at /home/worker/workspace/build/src/layout/style/nsRuleNode.cpp:10198

Comment 3

[Hiroyuki Ikezoe (:hiro)]

I guess this is caused by bug 1339332.

Comment 4

[Daisuke Akatsuka (:daisuke)]

Thanks, Hiro.

But I could reproduce this crash using attached testcase in Firefox 51 (release) on OSX.
https://crash-stats.mozilla.com/report/index/9f524950-882d-4095-b1b3-9b0862170308

Comment 5

[Hiroyuki Ikezoe (:hiro)]

Gah. Thanks. Then this has been there since bug 1166500? I will check this later.

Comment 6

[Hiroyuki Ikezoe (:hiro)]

I can't reproduce this crash locally.  Tried reivision is 193989276571a5bd19bc669c6ca42828abe7b4f1.

Comment 7

[Hiroyuki Ikezoe (:hiro)]

Jesse, does the test case still cause the crash on the latest nightly?

Comment 8

[Jesse Schwartzentruber (:truber)]

(In reply to Hiroyuki Ikezoe (:hiro) from comment #7)
> Jesse, does the test case still cause the crash on the latest nightly?

No. I bisected this and it doesn't crash after bug 1339332.

Comment 9

[Hiroyuki Ikezoe (:hiro)]

Thank you Jesse for tracking it down.  I will check whether we can provide a smaller fix for aurora or other release channels.