1620975 - Crash in [@ style::properties::animated_properties::AnimationValue::from_computed_values]

Status: RESOLVED DUPLICATE of bug 1581121

(Core :: Layout, defect)

Description

[Randell Jesup [:jesup] (needinfo me)]

UAF is Ubuntu (and a couple of other distros); from a sampling all of them appear to be packaged builds, not mozilla builds (though that's common on Linux). It's possible that build options used or default prefs for these builds might have triggered this.

May be fixed as all but 1 crash are for 73; and the 74b crash has a different crash address (e5e5e5 vs 73's 0xe5e5e631)

This bug is for crash report bp-bfa91bc3-9f19-49a4-88f9-83c2a0200306.

Top 10 frames of crashing thread:

0 libxul.so style::properties::animated_properties::AnimationValue::from_computed_values /build/firefox-S5EXpd/firefox-73.0.1+build1/obj-i686-linux-gnu/i686-unknown-linux-gnu/release/build/style-439928868a7ffbd5/out/properties.rs:33558
1 libpthread-2.27.so __pthread_mutex_unlock /build/glibc-HFHis7/glibc-2.27/nptl/pthread_mutex_unlock.c:345
2 firefox MallocSmall /build/firefox-S5EXpd/firefox-73.0.1+build1/memory/build/mozjemalloc.cpp:2840
3 firefox malloc /build/firefox-S5EXpd/firefox-73.0.1+build1/memory/build/mozjemalloc.cpp:3956
4 firefox <name omitted> /build/firefox-S5EXpd/firefox-73.0.1+build1/memory/build/malloc_decls.h:51
5 libxul.so style::gecko::wrapper::get_animation_rule /build/firefox-S5EXpd/firefox-73.0.1+build1/servo/components/style/gecko/wrapper.rs:899
6 libxul.so style::matching::PrivateMatchMethods::replace_rules_internal /build/firefox-S5EXpd/firefox-73.0.1+build1/servo/components/style/matching.rs:182
7 libxul.so style::traversal::compute_style /build/firefox-S5EXpd/firefox-73.0.1+build1/servo/components/style/traversal.rs:625
8 libxul.so geckoservo::glue::traverse_subtree /build/firefox-S5EXpd/firefox-73.0.1+build1/servo/ports/geckolib/glue.rs:262
9 libxul.so Servo_TraverseSubtree /build/firefox-S5EXpd/firefox-73.0.1+build1/servo/ports/geckolib/glue.rs:312

Comment 1

[Sean Voisen (:svoisen)]

These crashes look mostly to be on Ubuntu 18.04 or lower, 32-bit. Leads me to believe this is a dupe of bug 1581121. Especially with animated_properties::AnimationValue in the stack. Though I do see Fennec in a few places.

Emilio: Is this a dupe of bug 1581121?

Comment 2

[Emilio Cobos Álvarez [:emilio]]

Yes, it's a dupe. Where did you see android ones? If I sort by platform the vast majority is linux x32, there is two crashes for mac and 5 for windows, but those are for older versions and share installs. Except the two windows crashes in FF73, which I'm a bit mistifyed about but...