1379888 - stylo: Crash in geckoservo::glue::Servo_ComputedValues_GetForAnonymousBox

Status: RESOLVED FIXED

(Core :: CSS Parsing and Computation, defect, P1)

Description

[Chris Peterson [:cpeterson]]

This bug was filed from the Socorro interface and is 
report bp-008291d6-4773-4771-96ad-061900170711.
=============================================================

1 crash in Nightly 56.

Comment 1

[Hiroyuki Ikezoe (:hiro)]

This is another crash triggered by Element.animate().

Comment 2

[Brian Birtles (:birtles)]

Attachment: Possibly similar test content

I had a bit of a look into this but I've yet to work out what is going on. Looking at the line numbers and offending memory offset in the crash report I wondered if the |raw_data| being passed to Servo_ComputedValues_GetForAnonymousBox was null but looking up the stack I'm not sure yet how that could be the case.

This test content gives me a similar stack but when I break inside Servo_ComputedValues_GetForAnonymousBox nothing seems amiss. I get a few warnings like "WARNING: stylo: HasStateDependentStyle always returns zero!: file c:/moz/src2/layout/style/ServoStyleSet.cpp, line 869" but I seem them pretty regularly anyway.

Given that there has only been 1~2 crash reports I'm inclined to just sit on this for a while and see if it crops up again. Both crash reports have the same install time from a few days ago so it's possible this no longer occurs or is just rare.

Comment 3

[Hiroyuki Ikezoe (:hiro)]

Yeah, given that this crash does not happen anymore, I think bug 1379505 also fixed this crash.