1648095 - Crash in [@ mozilla::SharedStyleSheetCache::StartDeferredLoadsForLoader]

Status: VERIFIED FIXED

(Core :: CSS Parsing and Computation, defect, P2)

Description

[Calixte Denizet (:calixte)]

This bug is for crash report bp-983fed1b-f860-407d-b12f-8770c0200624.

Top 10 frames of crashing thread:

0 libxul.so mozilla::SharedStyleSheetCache::StartDeferredLoadsForLoader layout/style/SharedStyleSheetCache.cpp:168
1 libxul.so mozilla::css::Loader::NotifyObservers layout/style/Loader.cpp:1543
2 libxul.so mozilla::SharedStyleSheetCache::LoadCompleted layout/style/SharedStyleSheetCache.cpp:279
3 libxul.so mozilla::MozPromise<bool, bool, true>::ThenValue<mozilla::css::Loader::ParseSheet xpcom/threads/MozPromise.h:769
4 libxul.so mozilla::MozPromise<bool, bool, true>::ThenValueBase::ResolveOrRejectRunnable::Run xpcom/threads/MozPromise.h:410
5 libxul.so mozilla::SchedulerGroup::Runnable::Run xpcom/threads/SchedulerGroup.cpp:146
6 libxul.so nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1234
7 libxul.so mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:87
8 libxul.so MessageLoop::Run ipc/chromium/src/base/message_loop.cc:290
9 libxul.so nsBaseAppShell::Run widget/nsBaseAppShell.cpp:137

There are 19 crashes (from 5 installations) in nightly 79 with buildid 20200623213840. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1645122.
The moz_crash reason is always MOZ_DIAGNOSTIC_ASSERT(curr->mLoader->mPendingLoadCount) (Where did this pending load come from?)

[1] https://hg.mozilla.org/mozilla-central/rev?node=d07d66ecd6b9

Comment 1

[Emilio Cobos Álvarez (:emilio)]

I can reproduce this by session-restoring multiple 4chan tabs (taken an url from a crash report).

I'll take a look, thanks Calixte!

Comment 2

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1648095 - Don't defer the same sheet load twice. r=#style

When we call into LoadSheet when starting pending loads for a given
loader, it may be the case that the original loader may still not care
about the load. However some other loader will, so we can't defer this.

This was also causing our state to get out of sync, because if this
happened, then we'd fail to account for it in other loaders.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/aedc5ef40524
Don't defer the same sheet load twice. r=heycam

Comment 5

[Dorel Luca [:dluca]]

https://hg.mozilla.org/mozilla-central/rev/aedc5ef40524

Comment 6

[Andrei Purice]

Hey Calixte,
I cannot reproduce this issue on the mentioned build (20200623213840). Tried using Emilio's method with 4chan but still can't repro it.
Do you have more specific steps on how to repro the crash?
Can you please check if this issue is fixed on your end using the latest build?

Comment 7

[Emilio Cobos Álvarez (:emilio)]

Open multiple 4chan tabs in the browser. Press Ctrl+F5 on one, then quickly move to the next and do the same, etc. You should eventually see the tabs crash.

Comment 8

[Calixte Denizet (:calixte)]

(In reply to Andrei Purice from comment #6)

Hey Calixte,
I cannot reproduce this issue on the mentioned build (20200623213840). Tried using Emilio's method with 4chan but still can't repro it.
Do you have more specific steps on how to repro the crash?
Can you please check if this issue is fixed on your end using the latest build?

I've no idea on how to reproduce this crash (see Emilio's comment for the STR).

Comment 9

[Andrei Purice]

Reproduced in 79.0a1 (20200623213840) using Emilio's steps on Windows 10.
Verified Fixed in 79.0b2 (20200630191632) and Nightly 80.0a1 (20200702094606) on Windows 10.