1696409 - Crash in [@ core::option::expect_failed | style::properties::UnparsedValue::substitute_variables]

Status: RESOLVED FIXED

(Core :: CSS Parsing and Computation, defect)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Firefox 87+ content crash on Windows, 87.0b3 had 12 installations which reported this crash.

Crash report: https://crash-stats.mozilla.org/report/index/266d9350-60ab-4635-9516-9ac2f0210304

MOZ_CRASH Reason: no entry found for key

Top 10 frames of crashing thread:

0 xul.dll RustMozCrash mozglue/static/rust/wrappers.cpp:16
1 xul.dll mozglue_static::panic_hook mozglue/static/rust/lib.rs:89
2 xul.dll core::ops::function::Fn::call<fn ../cb75ad5db02783e8b0222fee363c5f63f7e2cf5b/library/core/src/ops/function.rs:227
3 xul.dll std::panicking::rust_panic_with_hook ../cb75ad5db02783e8b0222fee363c5f63f7e2cf5b//library/std/src/panicking.rs:595
4 xul.dll std::panicking::begin_panic_handler::{{closure}} ../cb75ad5db02783e8b0222fee363c5f63f7e2cf5b//library/std/src/panicking.rs:497
5 xul.dll std::sys_common::backtrace::__rust_end_short_backtrace<closure-0, !> ../cb75ad5db02783e8b0222fee363c5f63f7e2cf5b//library/std/src/sys_common/backtrace.rs:141
6 xul.dll std::panicking::begin_panic_handler ../cb75ad5db02783e8b0222fee363c5f63f7e2cf5b//library/std/src/panicking.rs:493
7 xul.dll core::panicking::panic_fmt ../cb75ad5db02783e8b0222fee363c5f63f7e2cf5b//library/core/src/panicking.rs:92
8 xul.dll core::option::expect_failed ../cb75ad5db02783e8b0222fee363c5f63f7e2cf5b//library/core/src/option.rs:1260
9 xul.dll style::properties::UnparsedValue::substitute_variables x86_64-pc-windows-msvc/release/build/style-4a370e3662cd9e56/out/properties.rs:43882

Comment 1

[Emilio Cobos Álvarez (:emilio)]

Should be a regression from bug 1690836. Jason do you know if any fuzzer has seen this?

Comment 2

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1696409 - Paper over a crash in non-nightly. r=#style

Comment 3

[Emilio Cobos Álvarez (:emilio)]

Comment on attachment 9207343 [details]
Bug 1696409 - Paper over a crash in non-nightly. r=#style

Beta/Release Uplift Approval Request

• User impact if declined: Potential crash (unclear for now what conditions cause this, I've added more diagnostic info to the crash message).
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: none
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Fall back to a safe invalid value when this happens instead of crashing.
• String changes made/needed: none

Comment 4

[Jason Kratzer [:jkratzer]]

(In reply to Emilio Cobos Álvarez (:emilio) from comment #1)

Should be a regression from bug 1690836. Jason do you know if any fuzzer has seen this?

No unfortunately not. Any idea if this could be a Windows only issue?

Comment 5

[Emilio Cobos Álvarez (:emilio)]

It shouldn't be.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/5d938d1793e8
Paper over a crash in non-nightly. r=boris

Comment 7

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/5d938d1793e8

Comment 8

[Julien Cristau [:jcristau] (back April 22)]

Comment on attachment 9207343 [details]
Bug 1696409 - Paper over a crash in non-nightly. r=#style

approved for 87.0b8

Comment 9

[Julien Cristau [:jcristau] (back April 22)]

https://hg.mozilla.org/releases/mozilla-beta/rev/32f1f95aa285