1487819 - Crash in Servo_StyleSet_FlushStyleSheets

Status: RESOLVED DUPLICATE of bug 1490012

(Core :: CSS Parsing and Computation, defect)

Description

[Calixte Denizet (:calixte)]

This bug was filed from the Socorro interface and is
report bp-10e7ac9f-f211-4df5-939d-fa8f30180831.
=============================================================

Top 10 frames of crashing thread:

0 libxul.so Servo_StyleSet_FlushStyleSheets src/libcore/sync/atomic.rs:1766
1 libxul.so mozilla::ServoStyleSet::UpdateStylist layout/style/ServoStyleSet.cpp:1461
2 libxul.so mozilla::PresShell::DoFlushPendingNotifications layout/base/PresShell.cpp:4274
3 libxul.so nsRefreshDriver::Tick layout/base/nsRefreshDriver.cpp:1900
4 libxul.so mozilla::InactiveRefreshDriverTimer::TickOne layout/base/nsRefreshDriver.cpp:324
5 libxul.so mozilla::InactiveRefreshDriverTimer::TimerTickOne layout/base/nsRefreshDriver.cpp:949
6 libxul.so nsTimerImpl::Fire xpcom/threads/nsTimerImpl.cpp:701
7 libxul.so nsTimerEvent::Run xpcom/threads/TimerThread.cpp:297
8 libxul.so nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1167
9 libxul.so NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:519

=============================================================

There are 2 crashes (from 1 installation) in nightly 63 with buildid 20180830111743. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1486536.

[1] https://hg.mozilla.org/mozilla-central/rev?node=15d80c644e1e

Comment 1

[Emilio Cobos Álvarez (:emilio)]

I don't understand how could we get into an state where mIsDestroying is false, but mRawSet is nullptr...

Please let me know if this becomes a bit more high-volume, but I'm wary of wallpapering it without understanding what's going on...

Jason (& co), is there any chance you could add this signature to your fuzzing machinery so I notice should a test-case for this signature appears? Thanks a lot!

Comment 2

[Jason Kratzer [:jkratzer]]

(In reply to Emilio Cobos Álvarez (:emilio) from comment #1)
> I don't understand how could we get into an state where mIsDestroying is
> false, but mRawSet is nullptr...
> 
> Please let me know if this becomes a bit more high-volume, but I'm wary of
> wallpapering it without understanding what's going on...
> 
> Jason (& co), is there any chance you could add this signature to your
> fuzzing machinery so I notice should a test-case for this signature appears?
> Thanks a lot!

Done.  I'll update here if a testcase becomes available.

Comment 3

[Marcia Knous [:marcia]]

I see another similar signature that seems to be all Windows crashes: https://bit.ly/2wHX4P5 that seems to have started using 20180828220157. The signature currently in the bug is Mac, Linux and Android crashes. If it isn't the same issue as this bug, I can file a separate one.

Comment 4

[[:philipp]]

yes, most likely it's the same regression.

Comment 5

[Emilio Cobos Álvarez (:emilio)]

Bug 1490012 has a test-case, duping there.