1534128 - Crash in [@ Gecko_AddRefAtom]

Status: NEW

(Core :: CSS Parsing and Computation, defect, P2)

Description

[Julian Seward [:jseward]]

This bug is for crash report bp-7dca0090-921a-4c48-a17c-94f430190308.

This crash appears in two different installations in the Windows nightly
of 20190307215858.

Top 10 frames of crashing thread:

0 xul.dll Gecko_AddRefAtom layout/style/GeckoBindings.cpp:968
1 xul.dll static bool selectors::parser::{{impl}}::visit<style::gecko::selector_parser::SelectorImpl, style::invalidation::element::invalidation_map::CompoundSelectorDependencyCollector> servo/components/selectors/parser.rs:413
2 xul.dll static union core::result::Result< servo/components/style/invalidation/element/invalidation_map.rs:251
3 xul.dll static union core::result::Result< servo/components/style/stylist.rs:1957
4 xul.dll static union core::result::Result< servo/components/style/stylist.rs:1801
5 xul.dll void geckoservo::glue::Servo_StyleSet_FlushStyleSheets servo/ports/geckolib/glue.rs:1682
6 xul.dll mozilla::ServoStyleSet::UpdateStylist layout/style/ServoStyleSet.cpp:1283
7 xul.dll void mozilla::PresShell::DoFlushPendingNotifications layout/base/PresShell.cpp:4091
8 xul.dll void nsRefreshDriver::Tick layout/base/nsRefreshDriver.cpp:1887
9 xul.dll void mozilla::RefreshDriverTimer::TickRefreshDrivers layout/base/nsRefreshDriver.cpp:319

Comment 1

[Emilio Cobos Álvarez (:emilio)]

Hmm, I don't recall anything recent landing even remotely related to that (other than the recent atoms changes by cam?). But those landed quite a while ago...

It looks similar to the hashmap crashes we investigated during stylo, where we'd find null atoms pretty arbitrarily... Cam, do you have any idea? Otherwise we may want to dup this bug there?

Comment 2

[Cameron McCormack (:heycam)]

Yeah, I don't know of changes around atoms or invalidation map building that happened recently. Some of the other crashes in Gecko_AddRefAtom (under StylesheetInvalidationSet::scan_component, so also touching invalidation stuff) have a random pointer value. But they're taking the atom out of the selector in the style sheet, not out of existing HashMaps. So I'm not 100% sure it's the same issue.

Comment 3

[Cameron McCormack (:heycam)]

Adding dependency just in case it's related.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Since the crash volume is low (less than 5 per week), the severity is downgraded to S3. Feel free to change it back if you think the bug is still critical.

For more information, please visit auto_nag documentation.