1418856 - stylo: Crash in style::style_resolver::StyleResolverForElement<T>::match_primary<T>: "called `Option::unwrap()` on a `None` value"

Status: RESOLVED DUPLICATE of bug 1411008

(Core :: CSS Parsing and Computation, defect, P3)

Description

[Nicholas Nethercote [inactive]]

This bug was filed from the Socorro interface and is
report bp-16502b9f-ac6f-4661-ab05-ee41b0171118.
=============================================================

Top 10 frames of crashing thread:

0 xul.dll std::panicking::rust_panic_with_hook src/libstd/panicking.rs:617
1 xul.dll std::panicking::begin_panic<alloc::string::String> src/libstd/panicking.rs:572
2 xul.dll std::panicking::begin_panic_fmt src/libstd/panicking.rs:522
3 xul.dll core::panicking::panic_fmt src/libcore/panicking.rs:70
4 xul.dll core::panicking::panic src/libcore/panicking.rs:51
5 xul.dll style::style_resolver::StyleResolverForElement<style::gecko::wrapper::GeckoElement>::match_primary<style::gecko::wrapper::GeckoElement> servo/components/style/style_resolver.rs:439
6 xul.dll style::style_resolver::StyleResolverForElement<style::gecko::wrapper::GeckoElement>::resolve_style<style::gecko::wrapper::GeckoElement> servo/components/style/style_resolver.rs:223
7 xul.dll style::traversal::compute_style<style::gecko::wrapper::GeckoElement> servo/components/style/traversal.rs:631
8 xul.dll geckoservo::glue::traverse_subtree servo/ports/geckolib/glue.rs:274
9 xul.dll geckoservo::glue::Servo_TraverseSubtree servo/ports/geckolib/glue.rs:313

=============================================================

This is the #12 Windows topcrash in Nightly 20171117222953. Emilio, can you take a look?

Comment 1

[Emilio Cobos Álvarez (:emilio)]

So the line information from the stacks makes no sense, but happens to be the same as for the crashtest of bug 1411008, so I'm gonna go and suspect that it's the same kind of issue:

  https://crash-stats.mozilla.com/report/index/849eb26c-2eeb-4b1c-a866-c9ac30171118

I have absolutely no clue of what kind of brokenness is causing this unwrap to fail (in that crashtest it's obvious, but I have no clue how that would be hit under Servo_TraverseSubtre, which is a normal style flush), but I can try to get more info...

Comment 2

[Emilio Cobos Álvarez (:emilio)]

https://github.com/servo/servo/pull/19294 adds the extra debugging info, so I'd expect this signature to change... Nick, what's the best way to make sure the new crashes somehow arrive here (or at least that I'm CCd on them?).

Comment 3

[Nicholas Nethercote [inactive]]

The new crash reports will probably have the same signature.

In a day or two, I suggest looking at the crash reports for the first build that has the change at https://dbaron.org/mozilla/crashes-by-build.

Comment 4

[Chris Peterson [:cpeterson]]

Firefox 57 and 58 are also affected, but the crash volume is very low.

Comment 5

[Emilio Cobos Álvarez (:emilio)]

I don't see this signature in the last few days.

Comment 6

[Emilio Cobos Álvarez (:emilio)]

I don't see any report with buildid >= 20171120142222. Should I call this WFM Nick? Or do you think it's worth waiting a few more days? This is likely the same root cause as the animation crashes that have been fixed recently.

Comment 7

[Nicholas Nethercote [inactive]]

Seems like it's gone. We can always reopen if it comes back.

Comment 8

[Chris Peterson [:cpeterson]]

I think this is a dupe of fuzz bug 1411008, which includes a test case.