Closed Bug 1506620 Opened 6 years ago Closed 6 years ago

Crash in core::ptr::drop_in_place<T> | style::selector_map::MaybeCaseInsensitiveHashMap<T>::clear<T>

Categories

(Core :: CSS Parsing and Computation, defect)

Unspecified
Windows 8
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 1406996
Tracking Status
firefox63 --- wontfix
firefox64 --- wontfix
firefox65 --- fix-optional
firefox66 --- fix-optional
firefox67 --- wontfix
firefox68 --- fix-optional
firefox69 --- fix-optional

People

(Reporter: marcia, Unassigned)

Details

(Keywords: crash, regression)

Crash Data

This bug was filed from the Socorro interface and is
report bp-c2693f05-707f-442c-b33a-a3b5f0181109.
=============================================================

Seen while looking at nightly crash stats, although this crash appears on other branches as well: https://bit.ly/2JVDJzR. All versions of Windows are affected, although it appears from the data Win 7 has more crashes. 

Nightly correlations for this signature show some kind of correlation to the ja locale, as well as a few other addons. Beta correlations do not show the same correlation.

(75.00% in signature vs 00.21% overall) bios_manufacturer = NEC [100.0% vs 00.43% if startup_crash = null]
(75.00% in signature vs 01.95% overall) useragent_locale = ja [100.0% vs 00.69% if startup_crash = null]
(75.00% in signature vs 02.15% overall) cpu_microcode_version = 0x1b [100.0% vs 19.31% if CPU Info = GenuineIntel family 6 model 58 stepping 9]
(75.00% in signature vs 00.76% overall) adapter_driver_version = 10.18.10.4885 [85.71% vs 01.41% if adapter_vendor_id = 0x8086]
(75.00% in signature vs 00.76% overall) adapter_driver_version_clean = 4885 [85.71% vs 01.41% if adapter_vendor_id = 0x8086]
(75.00% in signature vs 01.86% overall) adapter_device_id = 0x0152 [85.71% vs 03.45% if adapter_vendor_id = 0x8086]
(75.00% in signature vs 02.72% overall) Module "igdusc32.dll" = true [85.71% vs 04.26% if platform_pretty_version = Windows 7]
(75.00% in signature vs 03.05% overall) Module "igd10iumd32.dll" = true [85.71% vs 04.53% if platform_pretty_version = Windows 7]
(75.00% in signature vs 01.42% overall) Module "DXGIDebug.dll" = true [85.71% vs 04.95% if platform_version = 6.1.7601 Service Pack 1]
(87.50% in signature vs 12.98% overall) Module "icm32.dll" = true
(75.00% in signature vs 00.13% overall) Addon "addon-firefox-WebExt@skysea.skygroup.jp" = true
(75.00% in signature vs 00.13% overall) Addon "com.trendmicro.tmopfirefox.ext@trendop" = true
(75.00% in signature vs 00.15% overall) Module "LavasoftTcpService.dll" = true
(75.00% in signature vs 00.32% overall) Addon "ascsurfingprotectionnew@iobit.com" = true
(75.00% in signature vs 00.80% overall) reason = EXCEPTION_ACCESS_VIOLATION_WRITE
(75.00% in signature vs 01.83% overall) CPU Info = GenuineIntel family 6 model 58 stepping 9
(87.50% in signature vs 02.98% overall) os_arch = x86 [83.33% vs 08.29% if startup_crash = null]
(75.00% in signature vs 05.25% overall) address = 0x0
(75.00% in signature vs 11.89% overall) startup_crash = null [71.43% vs 04.11% if process_type = content]
(75.00% in signature vs 99.96% overall) ipc_fatal_error_msg = null
(75.00% in signature vs 100.0% overall) gmp_plugin = null [85.71% vs 60.17% if process_type = content]

Top 10 frames of crashing thread:

0 xul.dll static void core::ptr::drop_in_place<smallvec::SmallVec<[style::stylist::Rule; 1]>> /libcore/ptr.rs:59
1 xul.dll static void style::selector_map::MaybeCaseInsensitiveHashMap<style::gecko_string_cache::Atom, smallvec::SmallVec<[style::stylist::Rule; 1]>>::clear<smallvec::SmallVec<[style::stylist::Rule; 1]>> servo/components/style/selector_map.rs:607
2 xul.dll static void style::stylist::ElementAndPseudoRules::clear servo/components/style/stylist.rs:1922
3 xul.dll static void style::stylist::CascadeData::clear_cascade_data servo/components/style/stylist.rs:2421
4 xul.dll static union core::result::Result< servo/components/style/stylist.rs:2066
5 xul.dll void geckoservo::glue::Servo_StyleSet_FlushStyleSheets servo/ports/geckolib/glue.rs:1531
6 xul.dll mozilla::ServoStyleSet::UpdateStylist layout/style/ServoStyleSet.cpp:1465
7 xul.dll mozilla::PresShell::DoFlushPendingNotifications layout/base/PresShell.cpp:4317
8 xul.dll void nsRefreshDriver::Tick layout/base/nsRefreshDriver.cpp:1906
9 xul.dll void mozilla::InactiveRefreshDriverTimer::TickOne layout/base/nsRefreshDriver.cpp:944

=============================================================
Looks like a signature change.
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → DUPLICATE
Group: core-security
Crash Signature: [@ core::ptr::drop_in_place<T> | style::selector_map::MaybeCaseInsensitiveHashMap<T>::clear<T>] → [@ core::ptr::drop_in_place<T> | style::selector_map::MaybeCaseInsensitiveHashMap<T>::clear<T>] [@ core::ptr::real_drop_in_place<T> | style::selector_map::MaybeCaseInsensitiveHashMap<T>::clear<T> ]
Group: core-security
You need to log in before you can comment on or make changes to this bug.