1613797 - Crash in [@ IPCError-browser | ShutDownKill | hashglobe::hash_map::HashMap<T>::clear<T>]

Status: RESOLVED WORKSFORME

(Core :: CSS Parsing and Computation, defect, P3)

Description

[Andrew McCreight [:mccr8]]

This bug is for crash report bp-23dbaa5d-d06c-467e-96d7-14d1b0200206.

Top 10 frames of crashing thread:

0 xul.dll hashglobe::hash_map::HashMap<style::gecko_string_cache::Atom, smallvec::SmallVec<[style::stylist::Rule; 1]>, core::hash::BuildHasherDefault<style::selector_map::PrecomputedHasher>>::clear<style::gecko_string_cache::Atom, smallvec::SmallVec<[style::stylist::Rule; 1]>, core::hash::BuildHasherDefault<style::selector_map::PrecomputedHasher>> servo/components/hashglobe/src/hash_map.rs:1079
1 xul.dll style::stylist::GenericElementAndPseudoRules<style::selector_map::SelectorMap<style::stylist::Rule>>::clear servo/components/style/stylist.rs:1705
2 xul.dll style::stylist::CascadeData::clear_cascade_data servo/components/style/stylist.rs:2241
3 xul.dll style::stylist::CascadeData::clear servo/components/style/stylist.rs:2259
4 xul.dll style::stylist::CascadeData::rebuild<style::gecko::data::GeckoStyleSheet> servo/components/style/stylist.rs:1844
5 xul.dll geckoservo::glue::Servo_StyleSet_FlushStyleSheets servo/ports/geckolib/glue.rs:1900
6 xul.dll mozilla::ServoStyleSet::UpdateStylist layout/style/ServoStyleSet.cpp:1128
7 xul.dll mozilla::ServoStyleSet::ShellDetachedFromDocument layout/style/ServoStyleSet.cpp:133
8 xul.dll mozilla::dom::Document::DeletePresShell dom/base/Document.cpp:6311
9 xul.dll mozilla::PresShell::Destroy layout/base/PresShell.cpp:1333

This signature is one of the more common ones, at least in the Nightly I looked at. In the crashes I skimmed, it was clearing Stylo data while destroying a pres shell.

Comment 1

[Emilio Cobos Álvarez (:emilio)]

Does the signature mean this is a shutdown hang? Or something else?

Comment 2

[Andrew McCreight [:mccr8]]

Yes, I think that's what it means. Or at least, a hang while the process is shutting down.

Comment 3

[Gabriele Svelto [:gsvelto]]

Yes, these aren't crashes. They're snapshots of content processes that were told to shut down but didn't succeed within a minute. When this happens we take a minidump of the content process, kill it and then submit the crash report. Note the mozilla::dom::BrowserChild::RecvDestroy() frame on the stack.

Comment 4

[Gabriele Svelto [:gsvelto]]

This seems to happen across all Windows versions.

Comment 5

[Gabriele Svelto [:gsvelto]]

I found another signature, all the crashes from the past six months have been reprocessed so this should now cover pretty much all of them.

Comment 6

[Daniel Holbert [:dholbert]]

Calling this P3, since it's presumably not an especially user-visible issue, given that we eventually clean up the hanging process.

Comment 7

[Ryan VanderMeulen [:RyanVM]]

This is showing up very high in the Nightly crash stats. Is there something we can do to improve the situation here?

Comment 8

[Andrew McCreight [:mccr8]]

Could we do something like not destroy this style data if we're shutting down? It'll be a little tricky because we do need to destroy it in debug builds for leak checking purposes. The stacks I've seen are inside mozilla::dom::BrowserChild::RecvDestroy() so it should be possible to detect.

Comment 9

[Andrew McCreight [:mccr8]]

I added two more signatures that look like the same issue (synchronously destroying style data during shutdown).

Comment 10

[BugBot [:suhaib / :marco/ :calixte]]

Bugbug thinks this bug is a regression, but please revert this change in case of error.

Comment 11

[Gabriele Svelto [:gsvelto]]

Added a couple more signatures. We also have a corresponding shutdownhang entry (bug 1625835).

Comment 13

[Gabriele Svelto [:gsvelto]]

Added two more signatures.

Comment 15

[alex_mayorga]

¡Hola y'all!

https://crash-stats.mozilla.org/report/index/19c64efd-1293-44a7-83ff-440370210524#tab-details bite me on 90.

Updating flags per https://crash-stats.mozilla.org/signature/?product=Firefox&signature=IPCError-browser%20%7C%20ShutDownKill%20%7C%20mozilla%3A%3ARestyleManager%3A%3AClearServoDataFromSubtree&date=%3E%3D2021-04-27T16%3A47%3A00.000Z&date=%3C2021-05-27T16%3A47%3A00.000Z FWIW.

Please let me know if there's anything you might need from the profile or device.

¡Gracias!
Alex

Comment 16

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.