1685778 - Mozilla Firefox crashes in [@ style::bloom::StyleBloom<T>::push<T> ]

Status: VERIFIED INVALID

(Core :: CSS Parsing and Computation, defect)

Description

[Virtual_ManPL [:Virtual] 🇵🇱 - (please needinfo? me - so I will see your comment/reply/question/etc.)]

I was closing few tabs and crash happened in [@ style::bloom::StyleBloom<T>::push<T> ].

Crash report:
https://crash-stats.mozilla.org/report/index/7fc96b8f-553d-4126-9aa0-bbdfc0210108#tab-details

Comment 1

[Emilio Cobos Álvarez [:emilio]]

So chkimg claims that the binary is alright... David, this is a Windows crash, do you know how can I check for other signs of corruption? I don't know how we'd crash in that function... It might be that we have a dead element or something in the DOM (unlikely though), and the crash points to line 166 which is a closing brace, so not clear to me what code it corresponds to.

Comment 2

[Emilio Cobos Álvarez [:emilio]]

The crash address doesn't seem like a UAF or other stuff like that which is odd. The filter itself is stored in TLS and never deleted... The stack also isn't very deep so it doesn't seem like it'd be a stack overflow of any sort.

Comment 3

[(Away)]

The execution somehow jumped into the middle of an instruction. The code should have looked like:

000007fe`ea1b3585 0f8419020000    je      xul!style::bloom::StyleBloom<style::gecko::wrapper::GeckoElement>::push<style::gecko::wrapper::GeckoElement>+0x504 (000007fe`ea1b37a4)

But rip is on the latter 0000 there:

000007fe`ea1b3589 0000            add     byte ptr [rax],al ds:00000000`a42800b6=??

Since I don't see any deliberate jumps in this function to that address, it's looking like something went wrong at hardware level.

Comment 4

[Emilio Cobos Álvarez [:emilio]]

Ok, not all that much we can do here then unfortunately :(

Comment 5

[Virtual_ManPL [:Virtual] 🇵🇱 - (please needinfo? me - so I will see your comment/reply/question/etc.)]

(In reply to :dmajor from comment #3)

[...] it's looking like something went wrong at hardware level.

Thank you very much for deep analyzing. Looks like it could be the cause, as 1 per 2 months I have some odd issues with my old PC, like freeze or BSoD.