1379380 - stylo: Crash while parsing a media query expression in core::str::slice_error_fail

Status: VERIFIED FIXED

(Core :: CSS Parsing and Computation, defect, P1)

Description

[Panos Astithas (he/him) [:past] (please ni?)]

This bug was filed from the Socorro interface and is 
report bp-2abff06f-d969-4ba5-845b-a98410170708.
=============================================================

I get this crash consistently when visiting the Paypal checkout page from my local supermarket website (http://e-fresh.gr/). The page loads fine without stylo enabled.

Comment 1

[Cameron McCormack (:heycam)]

Panos, are you able to get the style sheet URL that we crash on?  In a debug build, when we crash, up on the mozilla::ServoStyleSheet::ParseSheet stack frame, aSheetURI is the sheet URL.  If the sheet can't be downloaded outside of the checkout process for some reason, could you dump out the contents of aInput (which is the style sheet text)?  Thanks!

Comment 2

[Emilio Cobos Álvarez (:emilio)]

I can repro with https://demo.paypal.com. will investigate.

Comment 3

[Emilio Cobos Álvarez (:emilio)]

so the media query string we're testing looks like:

"screen�\345\345\345\345\345\345\345self-hosted\000"

so in starts_with_ignore_ascii_case(feature_name, "-webkit-"), we index that from 0 to 8 bytes, and that happens to be in the middle of a unicode code-point, so rust panics because the resulting string is not utf-8.

Comment 4

[Emilio Cobos Álvarez (:emilio)]

Minimal test-case:

<style>
@media (aaaaa

Comment 5

[Emilio Cobos Álvarez (:emilio)]

Oh, bugzilla... Anyway, will add a crashtest along the patch.

Comment 6

[Emilio Cobos Álvarez (:emilio)]

I ended up just adding an unit test: https://github.com/servo/servo/pull/17640

Comment 7

[Xidorn Quan [:xidorn] UTC+11]

(In reply to Emilio Cobos Álvarez [:emilio] from comment #5)
> Oh, bugzilla... Anyway, will add a crashtest along the patch.

Sounds like bugzilla have some issue with your example :)

Consider filing a bug to bugzilla?

Comment 8

[Emilio Cobos Álvarez (:emilio)]

I can do the whole checkout process in a build with https://hg.mozilla.org/integration/autoland/rev/2ed937c5e72c, so marking this as fixed. Please verify it in the next nightly if possible, thanks!

(In reply to Xidorn Quan [:xidorn] UTC+10 from comment #7)
> (In reply to Emilio Cobos Álvarez [:emilio] from comment #5)
> > Oh, bugzilla... Anyway, will add a crashtest along the patch.
> 
> Sounds like bugzilla have some issue with your example :)
> 
> Consider filing a bug to bugzilla?

Filed, bug 1379423.

Comment 9

[Panos Astithas (he/him) [:past] (please ni?)]

Confirmed on the same website that the crash no longer occurs.