Closed Bug 1729813 (CVE-2021-32810) Opened 3 years ago Closed 3 years ago

ThreadSanitizer: data race in crossbeam(?)

Categories

(Core :: CSS Parsing and Computation, defect)

Product:
Core
Component:
CSS Parsing and Computation
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
94 Branch
Tracking Flags:
Tracking Status
firefox-esr78 --- wontfix
firefox-esr91 93+ fixed
firefox92 --- wontfix
firefox93 + fixed
firefox94 + fixed

People

(Reporter: tsmith, Assigned: emilio)

References

(Blocks 3 open bugs)

Details

(Keywords: csectype-race, sec-moderate, Whiteboard: [adv-main93+][adv-esr91.2+])

Attachments

(2 files)

Bug 1729813 - Update rayon to pick up a newer crossbeam version in style/webrender. r=nical,jrmuizel
48 bytes, text/x-phabricator-request
RyanVM
: approval-mozilla-beta+
RyanVM
: approval-mozilla-esr91+
Details | Review
advisory.txt
296 bytes, text/plain
Details

Found while fuzzing m-c 20210903-3e973cba050b (--enable-thread-sanitizer --enable-fuzzing)

The fuzzers have only hit this a couple times at the time of logging. A reproducible test case is not available.

WARNING: ThreadSanitizer: data race (pid=20668)
  Write of size 8 at 0x7b7400030c00 by thread T18:
    #0 free /builds/worker/fetches/llvm-project/llvm/projects/compiler-rt/lib/tsan/rtl/tsan_interceptors_posix.cpp:707:3 (firefox+0x5b448)
    #1 std::sys::unix::alloc::_$LT$impl$u20$core..alloc..global..GlobalAlloc$u20$for$u20$std..alloc..System$GT$::dealloc::hba2331477eb1b94d /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/sys/unix/alloc.rs:42:9 (libxul.so+0x7d66366)
    #2 __rdl_dealloc /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/alloc.rs:363:18 (libxul.so+0x7d66366)
    #3 alloc::alloc::dealloc::h9bdb1598261d3ccd /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/alloc/src/alloc.rs:104:14 (libxul.so+0x75ec2c1)
    #4 _$LT$alloc..alloc..Global$u20$as$u20$core..alloc..Allocator$GT$::deallocate::hedd1e226559ef98c /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/alloc/src/alloc.rs:239:22 (libxul.so+0x75ec2c1)
    #5 alloc::alloc::box_free::hbfd2aa9eda67b981 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/alloc/src/alloc.rs:334:9 (libxul.so+0x75ec2c1)
    #6 core::ptr::drop_in_place$LT$alloc..boxed..Box$LT$crossbeam_epoch..sync..queue..Node$LT$crossbeam_epoch..internal..SealedBag$GT$$GT$$GT$::h53db4b9ca2616772 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ptr/mod.rs:192:1 (libxul.so+0x75ec2c1)
    #7 core::mem::drop::h8baef3b25e2dabab /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/mem/mod.rs:889:24 (libxul.so+0x75ec2c1)
    #8 _$LT$crossbeam_epoch..atomic..Owned$LT$T$GT$$u20$as$u20$core..ops..drop..Drop$GT$::drop::h5e9f75144ebdac23 src/third_party/rust/crossbeam-epoch/src/atomic.rs:760:13 (libxul.so+0x75ec2c1)
    #9 core::ptr::drop_in_place$LT$crossbeam_epoch..atomic..Owned$LT$crossbeam_epoch..sync..queue..Node$LT$crossbeam_epoch..internal..SealedBag$GT$$GT$$GT$::hfcd5a7b247db99e5 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ptr/mod.rs:192:1 (libxul.so+0x75ec2c1)
    #10 core::mem::drop::haf45bf98fa80cc8a /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/mem/mod.rs:889:24 (libxul.so+0x75ec2c1)
    #11 crossbeam_epoch::guard::Guard::defer_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::hc80b65a8c97073f3 src/third_party/rust/crossbeam-epoch/src/guard.rs:195:47 (libxul.so+0x75ec2c1)
    #12 crossbeam_epoch::deferred::Deferred::new::call::h098801a94e49a834 src/third_party/rust/crossbeam-epoch/src/deferred.rs:46:21 (libxul.so+0x75ec2c1)
    #13 crossbeam_epoch::deferred::Deferred::call::hb73d340cbe157248 src/third_party/rust/crossbeam-epoch/src/deferred.rs:77:18 (libxul.so+0xa162da)
    #14 _$LT$crossbeam_epoch..internal..Bag$u20$as$u20$core..ops..drop..Drop$GT$::drop::hdfcfb1d7c80e6c01 src/third_party/rust/crossbeam-epoch/src/internal.rs:201:13 (libxul.so+0xa162da)
    #15 core::ptr::drop_in_place$LT$crossbeam_epoch..internal..Bag$GT$::hbe6dac6c7aafcf64 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ptr/mod.rs:192:1 (libxul.so+0xa162da)
    #16 core::ptr::drop_in_place$LT$crossbeam_epoch..internal..SealedBag$GT$::hc8a3c1d6a20287d3 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ptr/mod.rs:192:1 (libxul.so+0xa162da)
    #17 core::mem::drop::h1eb9fccbbb17ea59 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/mem/mod.rs:889:24 (libxul.so+0xa162da)
    #18 crossbeam_epoch::internal::Global::collect::h01e3c6876382b113 src/third_party/rust/crossbeam-epoch/src/internal.rs:295:37 (libxul.so+0xa162da)
    #19 crossbeam_epoch::internal::Local::pin::hce62e5f9f2c6d46d src/third_party/rust/crossbeam-epoch/src/internal.rs:497:17 (libxul.so+0x7c4dcf5)
    #20 crossbeam_epoch::collector::LocalHandle::pin::h370d76160af1c117 src/third_party/rust/crossbeam-epoch/src/collector.rs:75:18 (libxul.so+0x7c4dcf5)
    #21 crossbeam_epoch::default::pin::_$u7b$$u7b$closure$u7d$$u7d$::h355a45cb29d2b810 src/third_party/rust/crossbeam-epoch/src/default.rs:23:26 (libxul.so+0x7c4dcf5)
    #22 crossbeam_epoch::default::with_handle::_$u7b$$u7b$closure$u7d$$u7d$::hc1efeb8a707fd9b0 src/third_party/rust/crossbeam-epoch/src/default.rs:43:23 (libxul.so+0x7c4dcf5)
    #23 std::thread::local::LocalKey$LT$T$GT$::try_with::h3556ac40255d4e48 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/thread/local.rs:400:16 (libxul.so+0x7c4dcf5)
    #24 crossbeam_epoch::default::with_handle::h6f3640b32e865679 src/third_party/rust/crossbeam-epoch/src/default.rs:42:5 (libxul.so+0x7c4dcf5)
    #25 crossbeam_epoch::default::pin::h51670c1094828c16 src/third_party/rust/crossbeam-epoch/src/default.rs:23:5 (libxul.so+0x7c4dcf5)
    #26 crossbeam_deque::Stealer$LT$T$GT$::steal::h6be1c693e0050cf3 src/third_party/rust/crossbeam-deque/src/lib.rs:698:22 (libxul.so+0x7c4d5f8)
    #27 rayon_core::registry::WorkerThread::steal::_$u7b$$u7b$closure$u7d$$u7d$::h13d0fe616bb29afd src/third_party/rust/rayon-core/src/registry.rs:779:27 (libxul.so+0x7c4d5f8)
    #28 core::iter::traits::iterator::Iterator::find_map::check::_$u7b$$u7b$closure$u7d$$u7d$::h7104d5533a05738f /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/iter/traits/iterator.rs:2350:32 (libxul.so+0x7c4d5f8)
    #29 core::iter::adapters::filter::filter_try_fold::_$u7b$$u7b$closure$u7d$$u7d$::h97cd9699b923345a /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/iter/adapters/filter.rs:44:44 (libxul.so+0x7c4d5f8)
    #30 core::ops::function::impls::_$LT$impl$u20$core..ops..function..FnMut$LT$A$GT$$u20$for$u20$$RF$mut$u20$F$GT$::call_mut::hb14e11b4b66a951e /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ops/function.rs:269:13 (libxul.so+0xa50fa0)
    #31 core::iter::traits::iterator::Iterator::try_fold::hc8779bd605b64a33 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/iter/traits/iterator.rs:1972:21 (libxul.so+0xa50fa0)
    #32 _$LT$core..iter..adapters..chain..Chain$LT$A$C$B$GT$$u20$as$u20$core..iter..traits..iterator..Iterator$GT$::try_fold::h6f7e1c827b6d9ed9 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/iter/adapters/chain.rs:104:19 (libxul.so+0xa50fa0)
    #33 _$LT$core..iter..adapters..filter..Filter$LT$I$C$P$GT$$u20$as$u20$core..iter..traits..iterator..Iterator$GT$::try_fold::h17dc8f0168fc0c9d /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/iter/adapters/filter.rs:93:9 (libxul.so+0xa50fa0)
    #34 core::iter::traits::iterator::Iterator::find_map::h840c874d0b4172da /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/iter/traits/iterator.rs:2356:9 (libxul.so+0xa50fa0)
    #35 rayon_core::registry::WorkerThread::steal::haa427a7f661862b9 src/third_party/rust/rayon-core/src/registry.rs:774:23 (libxul.so+0xa50fa0)
    #36 rayon_core::registry::WorkerThread::wait_until_cold::_$u7b$$u7b$closure$u7d$$u7d$::hc1173929c7acdfb0 src/third_party/rust/rayon-core/src/registry.rs:726:29 (libxul.so+0xa50fa0)
    #37 core::option::Option$LT$T$GT$::or_else::hf539aa07654f3427 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/option.rs:790:21 (libxul.so+0xa50fa0)
    #38 rayon_core::registry::WorkerThread::wait_until_cold::h87fcf5a198445408 src/third_party/rust/rayon-core/src/registry.rs:724:32 (libxul.so+0xa50fa0)
    #39 rayon_core::registry::WorkerThread::wait_until::h3a26a36515f5b011 src/third_party/rust/rayon-core/src/registry.rs:704:13 (libxul.so+0x7c4feb5)
    #40 rayon_core::registry::main_loop::hbe4f0cce448357fd src/third_party/rust/rayon-core/src/registry.rs:837:5 (libxul.so+0x7c4feb5)
    #41 rayon_core::registry::ThreadBuilder::run::h7cd039fc56b6ed7e src/third_party/rust/rayon-core/src/registry.rs:56:18 (libxul.so+0x7c4feb5)
    #42 _$LT$rayon_core..registry..DefaultSpawn$u20$as$u20$rayon_core..registry..ThreadSpawn$GT$::spawn::_$u7b$$u7b$closure$u7d$$u7d$::he29418d644522a8a src/third_party/rust/rayon-core/src/registry.rs:101:20 (libxul.so+0x7c4feb5)
    #43 std::sys_common::backtrace::__rust_begin_short_backtrace::h9ce1802b920ae46d /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/sys_common/backtrace.rs:125:18 (libxul.so+0x7c4feb5)
    #44 std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::hdfa8798a36632b32 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/thread/mod.rs:481:17 (libxul.so+0x7c4f1b2)
    #45 _$LT$std..panic..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::hb81373e727f13d31 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panic.rs:347:9 (libxul.so+0x7c4f1b2)
    #46 std::panicking::try::do_call::h51156d0344af92b3 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panicking.rs:401:40 (libxul.so+0x7c4f1b2)
    #47 std::panicking::try::h80edff8a7a391ead /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panicking.rs:365:19 (libxul.so+0x7c4f1b2)
    #48 std::panic::catch_unwind::h4d19453a606da23e /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panic.rs:434:14 (libxul.so+0x7c4f1b2)
    #49 std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::h71896a70e6a72321 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/thread/mod.rs:480:30 (libxul.so+0x7c4f1b2)
    #50 core::ops::function::FnOnce::call_once$u7b$$u7b$vtable.shim$u7d$$u7d$::h08f15a78fae15fad /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ops/function.rs:227:5 (libxul.so+0x7c4f1b2)
    #51 std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::hdfa8798a36632b32 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/thread/mod.rs:481:17 (libxul.so+0x7c4f1b2)
    #52 _$LT$std..panic..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::hb81373e727f13d31 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panic.rs:347:9 (libxul.so+0x7c4f1b2)
    #53 std::panicking::try::do_call::h51156d0344af92b3 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panicking.rs:401:40 (libxul.so+0x7c4f1b2)
    #54 std::panicking::try::h80edff8a7a391ead /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panicking.rs:365:19 (libxul.so+0x7c4f1b2)
    #55 std::panic::catch_unwind::h4d19453a606da23e /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panic.rs:434:14 (libxul.so+0x7c4f1b2)
    #56 std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::h71896a70e6a72321 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/thread/mod.rs:480:30 (libxul.so+0x7c4f1b2)
    #57 core::ops::function::FnOnce::call_once$u7b$$u7b$vtable.shim$u7d$$u7d$::h08f15a78fae15fad /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ops/function.rs:227:5 (libxul.so+0x7c4f1b2)
    #58 _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::h01fca7674f6d1b99 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/alloc/src/boxed.rs:1575:9 (libxul.so+0x7d674a6)
    #59 _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::h96940b98b18c7f4f /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/alloc/src/boxed.rs:1575:9 (libxul.so+0x7d674a6)
    #60 std::sys::unix::thread::Thread::new::thread_start::hd333fea24e8daf81 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/sys/unix/thread.rs:71:17 (libxul.so+0x7d674a6)

  Previous read of size 8 at 0x7b7400030c00 by thread T19:
    #0 core::ptr::read::hdb70e7455e810c57 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ptr/mod.rs:695:9 (libxul.so+0xa161f7)
    #1 core::ptr::const_ptr::_$LT$impl$u20$$BP$const$u20$T$GT$::read::h3ca66a43864421c8 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ptr/const_ptr.rs:762:18 (libxul.so+0xa161f7)
    #2 crossbeam_epoch::sync::queue::Queue$LT$T$GT$::pop_if_internal::_$u7b$$u7b$closure$u7d$$u7d$::h4d572a3711f28ebd src/third_party/rust/crossbeam-epoch/src/sync/queue.rs:156:30 (libxul.so+0xa161f7)
    #3 core::result::Result$LT$T$C$E$GT$::map::h8caf3c175d54711f /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/result.rs:504:25 (libxul.so+0xa161f7)
    #4 crossbeam_epoch::sync::queue::Queue$LT$T$GT$::pop_if_internal::h46c35d6b36c9497b src/third_party/rust/crossbeam-epoch/src/sync/queue.rs:147:17 (libxul.so+0xa161f7)
    #5 crossbeam_epoch::sync::queue::Queue$LT$T$GT$::try_pop_if::h96bced09a0406bec src/third_party/rust/crossbeam-epoch/src/sync/queue.rs:185:31 (libxul.so+0xa161f7)
    #6 crossbeam_epoch::internal::Global::collect::h01e3c6876382b113 src/third_party/rust/crossbeam-epoch/src/internal.rs:290:19 (libxul.so+0xa161f7)
    #7 crossbeam_epoch::internal::Local::pin::hce62e5f9f2c6d46d src/third_party/rust/crossbeam-epoch/src/internal.rs:497:17 (libxul.so+0x7c4dcf5)
    #8 crossbeam_epoch::collector::LocalHandle::pin::h370d76160af1c117 src/third_party/rust/crossbeam-epoch/src/collector.rs:75:18 (libxul.so+0x7c4dcf5)
    #9 crossbeam_epoch::default::pin::_$u7b$$u7b$closure$u7d$$u7d$::h355a45cb29d2b810 src/third_party/rust/crossbeam-epoch/src/default.rs:23:26 (libxul.so+0x7c4dcf5)
    #10 crossbeam_epoch::default::with_handle::_$u7b$$u7b$closure$u7d$$u7d$::hc1efeb8a707fd9b0 src/third_party/rust/crossbeam-epoch/src/default.rs:43:23 (libxul.so+0x7c4dcf5)
    #11 std::thread::local::LocalKey$LT$T$GT$::try_with::h3556ac40255d4e48 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/thread/local.rs:400:16 (libxul.so+0x7c4dcf5)
    #12 crossbeam_epoch::default::with_handle::h6f3640b32e865679 src/third_party/rust/crossbeam-epoch/src/default.rs:42:5 (libxul.so+0x7c4dcf5)
    #13 crossbeam_epoch::default::pin::h51670c1094828c16 src/third_party/rust/crossbeam-epoch/src/default.rs:23:5 (libxul.so+0x7c4dcf5)
    #14 crossbeam_deque::Stealer$LT$T$GT$::steal::h6be1c693e0050cf3 src/third_party/rust/crossbeam-deque/src/lib.rs:698:22 (libxul.so+0x7c4d5f8)
    #15 rayon_core::registry::WorkerThread::steal::_$u7b$$u7b$closure$u7d$$u7d$::h13d0fe616bb29afd src/third_party/rust/rayon-core/src/registry.rs:779:27 (libxul.so+0x7c4d5f8)
    #16 core::iter::traits::iterator::Iterator::find_map::check::_$u7b$$u7b$closure$u7d$$u7d$::h7104d5533a05738f /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/iter/traits/iterator.rs:2350:32 (libxul.so+0x7c4d5f8)
    #17 core::iter::adapters::filter::filter_try_fold::_$u7b$$u7b$closure$u7d$$u7d$::h97cd9699b923345a /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/iter/adapters/filter.rs:44:44 (libxul.so+0x7c4d5f8)
    #18 core::ops::function::impls::_$LT$impl$u20$core..ops..function..FnMut$LT$A$GT$$u20$for$u20$$RF$mut$u20$F$GT$::call_mut::hb14e11b4b66a951e /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ops/function.rs:269:13 (libxul.so+0xa50fa0)
    #19 core::iter::traits::iterator::Iterator::try_fold::hc8779bd605b64a33 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/iter/traits/iterator.rs:1972:21 (libxul.so+0xa50fa0)
    #20 _$LT$core..iter..adapters..chain..Chain$LT$A$C$B$GT$$u20$as$u20$core..iter..traits..iterator..Iterator$GT$::try_fold::h6f7e1c827b6d9ed9 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/iter/adapters/chain.rs:104:19 (libxul.so+0xa50fa0)
    #21 _$LT$core..iter..adapters..filter..Filter$LT$I$C$P$GT$$u20$as$u20$core..iter..traits..iterator..Iterator$GT$::try_fold::h17dc8f0168fc0c9d /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/iter/adapters/filter.rs:93:9 (libxul.so+0xa50fa0)
    #22 core::iter::traits::iterator::Iterator::find_map::h840c874d0b4172da /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/iter/traits/iterator.rs:2356:9 (libxul.so+0xa50fa0)
    #23 rayon_core::registry::WorkerThread::steal::haa427a7f661862b9 src/third_party/rust/rayon-core/src/registry.rs:774:23 (libxul.so+0xa50fa0)
    #24 rayon_core::registry::WorkerThread::wait_until_cold::_$u7b$$u7b$closure$u7d$$u7d$::hc1173929c7acdfb0 src/third_party/rust/rayon-core/src/registry.rs:726:29 (libxul.so+0xa50fa0)
    #25 core::option::Option$LT$T$GT$::or_else::hf539aa07654f3427 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/option.rs:790:21 (libxul.so+0xa50fa0)
    #26 rayon_core::registry::WorkerThread::wait_until_cold::h87fcf5a198445408 src/third_party/rust/rayon-core/src/registry.rs:724:32 (libxul.so+0xa50fa0)
    #27 rayon_core::registry::WorkerThread::wait_until::h3a26a36515f5b011 src/third_party/rust/rayon-core/src/registry.rs:704:13 (libxul.so+0x7c4feb5)
    #28 rayon_core::registry::main_loop::hbe4f0cce448357fd src/third_party/rust/rayon-core/src/registry.rs:837:5 (libxul.so+0x7c4feb5)
    #29 rayon_core::registry::ThreadBuilder::run::h7cd039fc56b6ed7e src/third_party/rust/rayon-core/src/registry.rs:56:18 (libxul.so+0x7c4feb5)
    #30 _$LT$rayon_core..registry..DefaultSpawn$u20$as$u20$rayon_core..registry..ThreadSpawn$GT$::spawn::_$u7b$$u7b$closure$u7d$$u7d$::he29418d644522a8a src/third_party/rust/rayon-core/src/registry.rs:101:20 (libxul.so+0x7c4feb5)
    #31 std::sys_common::backtrace::__rust_begin_short_backtrace::h9ce1802b920ae46d /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/sys_common/backtrace.rs:125:18 (libxul.so+0x7c4feb5)
    #32 std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::hdfa8798a36632b32 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/thread/mod.rs:481:17 (libxul.so+0x7c4f1b2)
    #33 _$LT$std..panic..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::hb81373e727f13d31 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panic.rs:347:9 (libxul.so+0x7c4f1b2)
    #34 std::panicking::try::do_call::h51156d0344af92b3 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panicking.rs:401:40 (libxul.so+0x7c4f1b2)
    #35 std::panicking::try::h80edff8a7a391ead /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panicking.rs:365:19 (libxul.so+0x7c4f1b2)
    #36 std::panic::catch_unwind::h4d19453a606da23e /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panic.rs:434:14 (libxul.so+0x7c4f1b2)
    #37 std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::h71896a70e6a72321 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/thread/mod.rs:480:30 (libxul.so+0x7c4f1b2)
    #38 core::ops::function::FnOnce::call_once$u7b$$u7b$vtable.shim$u7d$$u7d$::h08f15a78fae15fad /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ops/function.rs:227:5 (libxul.so+0x7c4f1b2)
    #39 std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::hdfa8798a36632b32 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/thread/mod.rs:481:17 (libxul.so+0x7c4f1b2)
    #40 _$LT$std..panic..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::hb81373e727f13d31 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panic.rs:347:9 (libxul.so+0x7c4f1b2)
    #41 std::panicking::try::do_call::h51156d0344af92b3 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panicking.rs:401:40 (libxul.so+0x7c4f1b2)
    #42 std::panicking::try::h80edff8a7a391ead /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panicking.rs:365:19 (libxul.so+0x7c4f1b2)
    #43 std::panic::catch_unwind::h4d19453a606da23e /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panic.rs:434:14 (libxul.so+0x7c4f1b2)
    #44 std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::h71896a70e6a72321 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/thread/mod.rs:480:30 (libxul.so+0x7c4f1b2)
    #45 core::ops::function::FnOnce::call_once$u7b$$u7b$vtable.shim$u7d$$u7d$::h08f15a78fae15fad /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ops/function.rs:227:5 (libxul.so+0x7c4f1b2)
    #46 _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::h01fca7674f6d1b99 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/alloc/src/boxed.rs:1575:9 (libxul.so+0x7d674a6)
    #47 _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::h96940b98b18c7f4f /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/alloc/src/boxed.rs:1575:9 (libxul.so+0x7d674a6)
    #48 std::sys::unix::thread::Thread::new::thread_start::hd333fea24e8daf81 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/sys/unix/thread.rs:71:17 (libxul.so+0x7d674a6)

  Thread T18 'StyleThread#4' (tid=20718, running) created by main thread at:
    #0 std::sys::unix::thread::Thread::new::hd59b5feb78931f82 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/sys/unix/thread.rs:50:19 (firefox+0x5c65b)
    #1 std::thread::Builder::spawn_unchecked::hee919b4cfe17ebe6 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/thread/mod.rs:505:22 (libxul.so+0x7d671fb)
    #2 std::thread::Builder::spawn::ha78645f74c8644d8 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/thread/mod.rs:388:18 (libxul.so+0x7d671fb)
    #3 _$LT$rayon_core..registry..DefaultSpawn$u20$as$u20$rayon_core..registry..ThreadSpawn$GT$::spawn::hffaf182d7402b84a src/third_party/rust/rayon-core/src/registry.rs:101:9 (libxul.so+0x7d671fb)
    #4 rayon_core::registry::Registry::new::h198bf81704afbcb9 src/third_party/rust/rayon-core/src/registry.rs:260:29 (libxul.so+0x7c4ecdf)
    #5 rayon_core::thread_pool::ThreadPool::build::h740cb3308024ba43 src/third_party/rust/rayon-core/src/thread_pool/mod.rs:69:24 (libxul.so+0x7c4ecdf)
    #6 rayon_core::ThreadPoolBuilder$LT$S$GT$::build::ha5ac436ba06df061 src/third_party/rust/rayon-core/src/lib.rs:202:9 (libxul.so+0x7c4ecdf)
    #7 _$LT$style..global_style_data..STYLE_THREAD_POOL$u20$as$u20$core..ops..deref..Deref$GT$::deref::__static_ref_initialize::h4278d5a88e517406 src/servo/components/style/global_style_data.rs:149:27 (libxul.so+0x7c4ecdf)
    #8 core::ops::function::FnOnce::call_once::h07c24c994d385c23 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ops/function.rs:227:5 (libxul.so+0x7c4ecdf)
    #9 lazy_static::lazy::Lazy$LT$T$GT$::get::_$u7b$$u7b$closure$u7d$$u7d$::h00f6fd6941cb63e8 src/third_party/rust/lazy_static/src/inline_lazy.rs:31:29 (libxul.so+0x7c4ecdf)
    #10 std::sync::once::Once::call_once::_$u7b$$u7b$closure$u7d$$u7d$::h1b867ba5b6902567 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/sync/once.rs:261:41 (libxul.so+0x7c4ecdf)
    #11 std::sync::once::Once::call_inner::ha199e1f02e938314 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/sync/once.rs:418:21 (libxul.so+0x7e8ade0)
    #12 std::sync::once::Once::call_once::h751add5255a6e98b /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/sync/once.rs:261:9 (libxul.so+0xa58a6b)
    #13 lazy_static::lazy::Lazy$LT$T$GT$::get::hb6d9d4d051569018 src/third_party/rust/lazy_static/src/inline_lazy.rs:30:9 (libxul.so+0xa58a6b)
    #14 _$LT$style..global_style_data..STYLE_THREAD_POOL$u20$as$u20$core..ops..deref..Deref$GT$::deref::__stability::hc7a9d31ad05cbb4a src/third_party/rust/lazy_static/src/lib.rs:142:21 (libxul.so+0xa58a6b)
    #15 _$LT$style..global_style_data..STYLE_THREAD_POOL$u20$as$u20$core..ops..deref..Deref$GT$::deref::h47a7aa922aa8831d src/third_party/rust/lazy_static/src/lib.rs:144:17 (libxul.so+0xa58a6b)
    #16 geckoservo::glue::traverse_subtree::h9f165e4686c3b7db src/servo/ports/geckolib/glue.rs:255:31 (libxul.so+0x80adb29)
    #17 Servo_TraverseSubtree src/servo/ports/geckolib/glue.rs:325:5 (libxul.so+0x771fcfe)
    #18 mozilla::ServoStyleSet::StyleNewSubtree(mozilla::dom::Element*) src/layout/style/ServoStyleSet.cpp:807:7 (libxul.so+0x771f78b)
    #19 nsCSSFrameConstructor::ContentRangeInserted(nsIContent*, nsIContent*, nsCSSFrameConstructor::InsertionKind) src/layout/base/nsCSSFrameConstructor.cpp:6996:9 (libxul.so+0x4b0119d)
    #20 nsCSSFrameConstructor::ContentInserted(nsIContent*, nsCSSFrameConstructor::InsertionKind) src/layout/base/nsCSSFrameConstructor.cpp:6914:3 (libxul.so+0x4be8583)
    #21 mozilla::PresShell::Initialize() src/layout/base/PresShell.cpp:1861:26 (libxul.so+0x4bf994f)
    #22 nsContentSink::StartLayout(bool) src/dom/base/nsContentSink.cpp:871:30 (libxul.so+0x4bf9511)
    #23 nsHtml5TreeOpExecutor::StartLayout(bool*) src/parser/html/nsHtml5TreeOpExecutor.cpp:827:18 (libxul.so+0x4b981fb)
    #24 umberAndFreeze, opSvgLoad, opMaybeComplainAboutCharset, opMaybeComplainAboutDeepTree, opAddClass, opAddViewSourceHref, opAddViewSourceBase, opAddErrorType, opAddLineNumberId, opStartLayout, opEnableEncodingMenu> &> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:279:14 (libxul.so+0x24f5c55)
    #25 match<TreeOperationMatcher, mozilla::Variant<uninitialized, opAppend, opDetach, opAppendChildrenToNewParent, opFosterParent, opAppendToDocument, opAddAttributes, nsHtml5DocumentMode, opCreateHTMLElement, opCreateSVGElement, opCreateMathMLElement, opSetFormElement, opAppendText, opFosterParentText, opAppendComment, opAppendCommentToDocument, opAppendDoctypeToDocument, opGetDocumentFragmentForTemplate, opGetFosterParent, opMarkAsBroken, opRunScript, opRunScriptAsyncDefer, opPreventScriptExecution, opDoneAddingChildren, opDoneCreatingElement, opSetDocumentCharset, opCharsetSwitchTo, opUpdateStyleSheet, opProcessOfflineManifest, opMarkMalformedIfScript, opStreamEnded, opSetStyleLineNumber, opSetScriptLineNumberAndFreeze, opSvgLoad, opMaybeComplainAboutCharset, opMaybeComplainAboutDeepTree, opAddClass, opAddViewSourceHref, opAddViewSourceBase, opAddErrorType, opAddLineNumberId, opStartLayout, opEnableEncodingMenu> &> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:279:14 (libxul.so+0x24f5c55)
    #26 match<TreeOperationMatcher, mozilla::Variant<uninitialized, opAppend, opDetach, opAppendChildrenToNewParent, opFosterParent, opAppendToDocument, opAddAttributes, nsHtml5DocumentMode, opCreateHTMLElement, opCreateSVGElement, opCreateMathMLElement, opSetFormElement, opAppendText, opFosterParentText, opAppendComment, opAppendCommentToDocument, opAppendDoctypeToDocument, opGetDocumentFragmentForTemplate, opGetFosterParent, opMarkAsBroken, opRunScript, opRunScriptAsyncDefer, opPreventScriptExecution, opDoneAddingChildren, opDoneCreatingElement, opSetDocumentCharset, opCharsetSwitchTo, opUpdateStyleSheet, opProcessOfflineManifest, opMarkMalformedIfScript, opStreamEnded, opSetStyleLineNumber, opSetScriptLineNumberAndFreeze, opSvgLoad, opMaybeComplainAboutCharset, opMaybeComplainAboutDeepTree, opAddClass, opAddViewSourceHref, opAddViewSourceBase, opAddErrorType, opAddLineNumberId, opStartLayout, opEnableEncodingMenu> &> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:279:14 (libxul.so+0x24f5c55)
    #27 match<TreeOperationMatcher, mozilla::Variant<uninitialized, opAppend, opDetach, opAppendChildrenToNewParent, opFosterParent, opAppendToDocument, opAddAttributes, nsHtml5DocumentMode, opCreateHTMLElement, opCreateSVGElement, opCreateMathMLElement, opSetFormElement, opAppendText, opFosterParentText, opAppendComment, opAppendCommentToDocument, opAppendDoctypeToDocument, opGetDocumentFragmentForTemplate, opGetFosterParent, opMarkAsBroken, opRunScript, opRunScriptAsyncDefer, opPreventScriptExecution, opDoneAddingChildren, opDoneCreatingElement, opSetDocumentCharset, opCharsetSwitchTo, opUpdateStyleSheet, opProcessOfflineManifest, opMarkMalformedIfScript, opStreamEnded, opSetStyleLineNumber, opSetScriptLineNumberAndFreeze, opSvgLoad, opMaybeComplainAboutCharset, opMaybeComplainAboutDeepTree, opAddClass, opAddViewSourceHref, opAddViewSourceBase, opAddErrorType, opAddLineNumberId, opStartLayout, opEnableEncodingMenu> &> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:279:14 (libxul.so+0x24f5c55)
    #28 match<TreeOperationMatcher, mozilla::Variant<uninitialized, opAppend, opDetach, opAppendChildrenToNewParent, opFosterParent, opAppendToDocument, opAddAttributes, nsHtml5DocumentMode, opCreateHTMLElement, opCreateSVGElement, opCreateMathMLElement, opSetFormElement, opAppendText, opFosterParentText, opAppendComment, opAppendCommentToDocument, opAppendDoctypeToDocument, opGetDocumentFragmentForTemplate, opGetFosterParent, opMarkAsBroken, opRunScript, opRunScriptAsyncDefer, opPreventScriptExecution, opDoneAddingChildren, opDoneCreatingElement, opSetDocumentCharset, opCharsetSwitchTo, opUpdateStyleSheet, opProcessOfflineManifest, opMarkMalformedIfScript, opStreamEnded, opSetStyleLineNumber, opSetScriptLineNumberAndFreeze, opSvgLoad, opMaybeComplainAboutCharset, opMaybeComplainAboutDeepTree, opAddClass, opAddViewSourceHref, opAddViewSourceBase, opAddErrorType, opAddLineNumberId, opStartLayout, opEnableEncodingMenu> &> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:279:14 (libxul.so+0x24f5c55)
    #29 match<TreeOperationMatcher, mozilla::Variant<uninitialized, opAppend, opDetach, opAppendChildrenToNewParent, opFosterParent, opAppendToDocument, opAddAttributes, nsHtml5DocumentMode, opCreateHTMLElement, opCreateSVGElement, opCreateMathMLElement, opSetFormElement, opAppendText, opFosterParentText, opAppendComment, opAppendCommentToDocument, opAppendDoctypeToDocument, opGetDocumentFragmentForTemplate, opGetFosterParent, opMarkAsBroken, opRunScript, opRunScriptAsyncDefer, opPreventScriptExecution, opDoneAddingChildren, opDoneCreatingElement, opSetDocumentCharset, opCharsetSwitchTo, opUpdateStyleSheet, opProcessOfflineManifest, opMarkMalformedIfScript, opStreamEnded, opSetStyleLineNumber, opSetScriptLineNumberAndFreeze, opSvgLoad, opMaybeComplainAboutCharset, opMaybeComplainAboutDeepTree, opAddClass, opAddViewSourceHref, opAddViewSourceBase, opAddErrorType, opAddLineNumberId, opStartLayout, opEnableEncodingMenu> &> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:279:14 (libxul.so+0x24f5c55)
    #30 match<TreeOperationMatcher, mozilla::Variant<uninitialized, opAppend, opDetach, opAppendChildrenToNewParent, opFosterParent, opAppendToDocument, opAddAttributes, nsHtml5DocumentMode, opCreateHTMLElement, opCreateSVGElement, opCreateMathMLElement, opSetFormElement, opAppendText, opFosterParentText, opAppendComment, opAppendCommentToDocument, opAppendDoctypeToDocument, opGetDocumentFragmentForTemplate, opGetFosterParent, opMarkAsBroken, opRunScript, opRunScriptAsyncDefer, opPreventScriptExecution, opDoneAddingChildren, opDoneCreatingElement, opSetDocumentCharset, opCharsetSwitchTo, opUpdateStyleSheet, opProcessOfflineManifest, opMarkMalformedIfScript, opStreamEnded, opSetStyleLineNumber, opSetScriptLineNumberAndFreeze, opSvgLoad, opMaybeComplainAboutCharset, opMaybeComplainAboutDeepTree, opAddClass, opAddViewSourceHref, opAddViewSourceBase, opAddErrorType, opAddLineNumberId, opStartLayout, opEnableEncodingMenu> &> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:279:14 (libxul.so+0x24f5c55)
    #31 match<TreeOperationMatcher, mozilla::Variant<uninitialized, opAppend, opDetach, opAppendChildrenToNewParent, opFosterParent, opAppendToDocument, opAddAttributes, nsHtml5DocumentMode, opCreateHTMLElement, opCreateSVGElement, opCreateMathMLElement, opSetFormElement, opAppendText, opFosterParentText, opAppendComment, opAppendCommentToDocument, opAppendDoctypeToDocument, opGetDocumentFragmentForTemplate, opGetFosterParent, opMarkAsBroken, opRunScript, opRunScriptAsyncDefer, opPreventScriptExecution, opDoneAddingChildren, opDoneCreatingElement, opSetDocumentCharset, opCharsetSwitchTo, opUpdateStyleSheet, opProcessOfflineManifest, opMarkMalformedIfScript, opStreamEnded, opSetStyleLineNumber, opSetScriptLineNumberAndFreeze, opSvgLoad, opMaybeComplainAboutCharset, opMaybeComplainAboutDeepTree, opAddClass, opAddViewSourceHref, opAddViewSourceBase, opAddErrorType, opAddLineNumberId, opStartLayout, opEnableEncodingMenu> &> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:279:14 (libxul.so+0x24f5c55)
    #32 match<TreeOperationMatcher, mozilla::Variant<uninitialized, opAppend, opDetach, opAppendChildrenToNewParent, opFosterParent, opAppendToDocument, opAddAttributes, nsHtml5DocumentMode, opCreateHTMLElement, opCreateSVGElement, opCreateMathMLElement, opSetFormElement, opAppendText, opFosterParentText, opAppendComment, opAppendCommentToDocument, opAppendDoctypeToDocument, opGetDocumentFragmentForTemplate, opGetFosterParent, opMarkAsBroken, opRunScript, opRunScriptAsyncDefer, opPreventScriptExecution, opDoneAddingChildren, opDoneCreatingElement, opSetDocumentCharset, opCharsetSwitchTo, opUpdateStyleSheet, opProcessOfflineManifest, opMarkMalformedIfScript, opStreamEnded, opSetStyleLineNumber, opSetScriptLineNumberAndFreeze, opSvgLoad, opMaybeComplainAboutCharset, opMaybeComplainAboutDeepTree, opAddClass, opAddViewSourceHref, opAddViewSourceBase, opAddErrorType, opAddLineNumberId, opStartLayout, opEnableEncodingMenu> &> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:279:14 (libxul.so+0x24f5c55)
    #33 match<TreeOperationMatcher, mozilla::Variant<uninitialized, opAppend, opDetach, opAppendChildrenToNewParent, opFosterParent, opAppendToDocument, opAddAttributes, nsHtml5DocumentMode, opCreateHTMLElement, opCreateSVGElement, opCreateMathMLElement, opSetFormElement, opAppendText, opFosterParentText, opAppendComment, opAppendCommentToDocument, opAppendDoctypeToDocument, opGetDocumentFragmentForTemplate, opGetFosterParent, opMarkAsBroken, opRunScript, opRunScriptAsyncDefer, opPreventScriptExecution, opDoneAddingChildren, opDoneCreatingElement, opSetDocumentCharset, opCharsetSwitchTo, opUpdateStyleSheet, opProcessOfflineManifest, opMarkMalformedIfScript, opStreamEnded, opSetStyleLineNumber, opSetScriptLineNumberAndFreeze, opSvgLoad, opMaybeComplainAboutCharset, opMaybeComplainAboutDeepTree, opAddClass, opAddViewSourceHref, opAddViewSourceBase, opAddErrorType, opAddLineNumberId, opStartLayout, opEnableEncodingMenu> &> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:279:14 (libxul.so+0x24f5c55)
    #34 match<TreeOperationMatcher> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:852:12 (libxul.so+0x24f5c55)
    #35 nsHtml5TreeOperation::Perform(nsHtml5TreeOpExecutor*, nsIContent**, bool*, bool*) src/parser/html/nsHtml5TreeOperation.cpp:1213:21 (libxul.so+0x24f5c55)
    #36 <null> <null> (libxul.so+0x1cd227a)
    #37 <null> <null> (libxul.so+0x1cd1358)
    #38 nsHtml5TreeOpExecutor::RunFlushLoop() src/parser/html/nsHtml5TreeOpExecutor.cpp:646:19 (libxul.so+0x1ccfac8)
    #39 nsHtml5ExecutorFlusher::Run() src/parser/html/nsHtml5StreamParser.cpp:177:18 (libxul.so+0x1cd448e)
    #40 mozilla::SchedulerGroup::Runnable::Run() src/xpcom/threads/SchedulerGroup.cpp:144:20 (libxul.so+0xc6419f)
    #41 mozilla::RunnableTask::Run() src/xpcom/threads/TaskController.cpp:502:16 (libxul.so+0xc8e3e7)
    #42 mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:805:26 (libxul.so+0xc6c382)
    #43 mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:641:15 (libxul.so+0xc6a9d6)
    #44 mozilla::TaskController::ProcessPendingMTTask(bool) src/xpcom/threads/TaskController.cpp:425:36 (libxul.so+0xc6aca4)
    #45 operator() src/xpcom/threads/TaskController.cpp:135:37 (libxul.so+0xc91e27)
    #46 mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_0>::Run() src/xpcom/threads/nsThreadUtils.h:531:5 (libxul.so+0xc91e27)
    #47 nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1148:16 (libxul.so+0xc7d9fa)
    #48 NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:466:10 (libxul.so+0xc848c2)
    #49 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:85:21 (libxul.so+0x155812d)
    #50 mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:268:30 (libxul.so+0x155891b)
    #51 RunInternal src/ipc/chromium/src/base/message_loop.cc:331:10 (libxul.so+0x14db5dc)
    #52 RunHandler src/ipc/chromium/src/base/message_loop.cc:324:3 (libxul.so+0x14db5dc)
    #53 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:306:3 (libxul.so+0x14db5dc)
    #54 nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27 (libxul.so+0x4877a36)
    #55 XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:917:20 (libxul.so+0x65e2ff9)
    #56 mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:235:9 (libxul.so+0x15588cd)
    #57 RunInternal src/ipc/chromium/src/base/message_loop.cc:331:10 (libxul.so+0x14db5dc)
    #58 RunHandler src/ipc/chromium/src/base/message_loop.cc:324:3 (libxul.so+0x14db5dc)
    #59 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:306:3 (libxul.so+0x14db5dc)
    #60 XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:749:34 (libxul.so+0x65e2d3c)
    #61 mozilla::BootstrapImpl::XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/Bootstrap.cpp:67:12 (libxul.so+0x65eac72)
    #62 content_process_main src/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28 (firefox+0xc93c1)
    #63 main src/browser/app/nsBrowserApp.cpp:327:18 (firefox+0xc93c1)

  Thread T19 'StyleThread#5' (tid=20719, running) created by main thread at:
    #0 rayon_core::registry::Registry::new::h198bf81704afbcb9 src/third_party/rust/rayon-core/src/registry.rs:260:29 (firefox+0x5c65b)
    #1 rayon_core::thread_pool::ThreadPool::build::h740cb3308024ba43 src/third_party/rust/rayon-core/src/thread_pool/mod.rs:69:24 (firefox+0x5c65b)
    #2 rayon_core::ThreadPoolBuilder$LT$S$GT$::build::ha5ac436ba06df061 src/third_party/rust/rayon-core/src/lib.rs:202:9 (firefox+0x5c65b)
    #3 _$LT$style..global_style_data..STYLE_THREAD_POOL$u20$as$u20$core..ops..deref..Deref$GT$::deref::__static_ref_initialize::h4278d5a88e517406 src/servo/components/style/global_style_data.rs:149:27 (firefox+0x5c65b)
    #4 core::ops::function::FnOnce::call_once::h07c24c994d385c23 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ops/function.rs:227:5 (firefox+0x5c65b)
    #5 lazy_static::lazy::Lazy$LT$T$GT$::get::_$u7b$$u7b$closure$u7d$$u7d$::h00f6fd6941cb63e8 src/third_party/rust/lazy_static/src/inline_lazy.rs:31:29 (firefox+0x5c65b)
    #6 std::sync::once::Once::call_once::_$u7b$$u7b$closure$u7d$$u7d$::h1b867ba5b6902567 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/sync/once.rs:261:41 (firefox+0x5c65b)
    #7 std::sync::once::Once::call_inner::ha199e1f02e938314 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/sync/once.rs:418:21 (libxul.so+0x7d671fb)
    #8 std::sync::once::Once::call_once::h751add5255a6e98b /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/sync/once.rs:261:9 (libxul.so+0x7c4ecdf)
    #9 lazy_static::lazy::Lazy$LT$T$GT$::get::hb6d9d4d051569018 src/third_party/rust/lazy_static/src/inline_lazy.rs:30:9 (libxul.so+0x7c4ecdf)
    #10 _$LT$style..global_style_data..STYLE_THREAD_POOL$u20$as$u20$core..ops..deref..Deref$GT$::deref::__stability::hc7a9d31ad05cbb4a src/third_party/rust/lazy_static/src/lib.rs:142:21 (libxul.so+0x7c4ecdf)
    #11 _$LT$style..global_style_data..STYLE_THREAD_POOL$u20$as$u20$core..ops..deref..Deref$GT$::deref::h47a7aa922aa8831d src/third_party/rust/lazy_static/src/lib.rs:144:17 (libxul.so+0x7c4ecdf)
    #12 geckoservo::glue::traverse_subtree::h9f165e4686c3b7db src/servo/ports/geckolib/glue.rs:255:31 (libxul.so+0x7e8ade0)
    #13 Servo_TraverseSubtree src/servo/ports/geckolib/glue.rs:325:5 (libxul.so+0xa58a6b)
    #14 mozilla::ServoStyleSet::StyleNewSubtree(mozilla::dom::Element*) src/layout/style/ServoStyleSet.cpp:807:7 (libxul.so+0x80adb29)
    #15 nsCSSFrameConstructor::ConstructDocElementFrame(mozilla::dom::Element*) src/layout/base/nsCSSFrameConstructor.cpp:2294:29 (libxul.so+0x771fcfe)
    #16 nsCSSFrameConstructor::ContentRangeInserted(nsIContent*, nsIContent*, nsCSSFrameConstructor::InsertionKind) src/layout/base/nsCSSFrameConstructor.cpp:6996:9 (libxul.so+0x771f78b)
    #17 nsCSSFrameConstructor::ContentInserted(nsIContent*, nsCSSFrameConstructor::InsertionKind) src/layout/base/nsCSSFrameConstructor.cpp:6914:3 (libxul.so+0x4b0119d)
    #18 mozilla::PresShell::Initialize() src/layout/base/PresShell.cpp:1861:26 (libxul.so+0x4be8583)
    #19 nsContentSink::StartLayout(bool) src/dom/base/nsContentSink.cpp:871:30 (libxul.so+0x4bf994f)
    #20 nsHtml5TreeOpExecutor::StartLayout(bool*) src/parser/html/nsHtml5TreeOpExecutor.cpp:827:18 (libxul.so+0x4bf9511)
    #21 umberAndFreeze, opSvgLoad, opMaybeComplainAboutCharset, opMaybeComplainAboutDeepTree, opAddClass, opAddViewSourceHref, opAddViewSourceBase, opAddErrorType, opAddLineNumberId, opStartLayout, opEnableEncodingMenu> &> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:279:14 (libxul.so+0x4b981fb)
    #22 match<TreeOperationMatcher, mozilla::Variant<uninitialized, opAppend, opDetach, opAppendChildrenToNewParent, opFosterParent, opAppendToDocument, opAddAttributes, nsHtml5DocumentMode, opCreateHTMLElement, opCreateSVGElement, opCreateMathMLElement, opSetFormElement, opAppendText, opFosterParentText, opAppendComment, opAppendCommentToDocument, opAppendDoctypeToDocument, opGetDocumentFragmentForTemplate, opGetFosterParent, opMarkAsBroken, opRunScript, opRunScriptAsyncDefer, opPreventScriptExecution, opDoneAddingChildren, opDoneCreatingElement, opSetDocumentCharset, opCharsetSwitchTo, opUpdateStyleSheet, opProcessOfflineManifest, opMarkMalformedIfScript, opStreamEnded, opSetStyleLineNumber, opSetScriptLineNumberAndFreeze, opSvgLoad, opMaybeComplainAboutCharset, opMaybeComplainAboutDeepTree, opAddClass, opAddViewSourceHref, opAddViewSourceBase, opAddErrorType, opAddLineNumberId, opStartLayout, opEnableEncodingMenu> &> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:279:14 (libxul.so+0x4b981fb)
    #23 match<TreeOperationMatcher, mozilla::Variant<uninitialized, opAppend, opDetach, opAppendChildrenToNewParent, opFosterParent, opAppendToDocument, opAddAttributes, nsHtml5DocumentMode, opCreateHTMLElement, opCreateSVGElement, opCreateMathMLElement, opSetFormElement, opAppendText, opFosterParentText, opAppendComment, opAppendCommentToDocument, opAppendDoctypeToDocument, opGetDocumentFragmentForTemplate, opGetFosterParent, opMarkAsBroken, opRunScript, opRunScriptAsyncDefer, opPreventScriptExecution, opDoneAddingChildren, opDoneCreatingElement, opSetDocumentCharset, opCharsetSwitchTo, opUpdateStyleSheet, opProcessOfflineManifest, opMarkMalformedIfScript, opStreamEnded, opSetStyleLineNumber, opSetScriptLineNumberAndFreeze, opSvgLoad, opMaybeComplainAboutCharset, opMaybeComplainAboutDeepTree, opAddClass, opAddViewSourceHref, opAddViewSourceBase, opAddErrorType, opAddLineNumberId, opStartLayout, opEnableEncodingMenu> &> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:279:14 (libxul.so+0x4b981fb)
    #24 match<TreeOperationMatcher, mozilla::Variant<uninitialized, opAppend, opDetach, opAppendChildrenToNewParent, opFosterParent, opAppendToDocument, opAddAttributes, nsHtml5DocumentMode, opCreateHTMLElement, opCreateSVGElement, opCreateMathMLElement, opSetFormElement, opAppendText, opFosterParentText, opAppendComment, opAppendCommentToDocument, opAppendDoctypeToDocument, opGetDocumentFragmentForTemplate, opGetFosterParent, opMarkAsBroken, opRunScript, opRunScriptAsyncDefer, opPreventScriptExecution, opDoneAddingChildren, opDoneCreatingElement, opSetDocumentCharset, opCharsetSwitchTo, opUpdateStyleSheet, opProcessOfflineManifest, opMarkMalformedIfScript, opStreamEnded, opSetStyleLineNumber, opSetScriptLineNumberAndFreeze, opSvgLoad, opMaybeComplainAboutCharset, opMaybeComplainAboutDeepTree, opAddClass, opAddViewSourceHref, opAddViewSourceBase, opAddErrorType, opAddLineNumberId, opStartLayout, opEnableEncodingMenu> &> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:279:14 (libxul.so+0x4b981fb)
    #25 match<TreeOperationMatcher, mozilla::Variant<uninitialized, opAppend, opDetach, opAppendChildrenToNewParent, opFosterParent, opAppendToDocument, opAddAttributes, nsHtml5DocumentMode, opCreateHTMLElement, opCreateSVGElement, opCreateMathMLElement, opSetFormElement, opAppendText, opFosterParentText, opAppendComment, opAppendCommentToDocument, opAppendDoctypeToDocument, opGetDocumentFragmentForTemplate, opGetFosterParent, opMarkAsBroken, opRunScript, opRunScriptAsyncDefer, opPreventScriptExecution, opDoneAddingChildren, opDoneCreatingElement, opSetDocumentCharset, opCharsetSwitchTo, opUpdateStyleSheet, opProcessOfflineManifest, opMarkMalformedIfScript, opStreamEnded, opSetStyleLineNumber, opSetScriptLineNumberAndFreeze, opSvgLoad, opMaybeComplainAboutCharset, opMaybeComplainAboutDeepTree, opAddClass, opAddViewSourceHref, opAddViewSourceBase, opAddErrorType, opAddLineNumberId, opStartLayout, opEnableEncodingMenu> &> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:279:14 (libxul.so+0x4b981fb)
    #26 match<TreeOperationMatcher, mozilla::Variant<uninitialized, opAppend, opDetach, opAppendChildrenToNewParent, opFosterParent, opAppendToDocument, opAddAttributes, nsHtml5DocumentMode, opCreateHTMLElement, opCreateSVGElement, opCreateMathMLElement, opSetFormElement, opAppendText, opFosterParentText, opAppendComment, opAppendCommentToDocument, opAppendDoctypeToDocument, opGetDocumentFragmentForTemplate, opGetFosterParent, opMarkAsBroken, opRunScript, opRunScriptAsyncDefer, opPreventScriptExecution, opDoneAddingChildren, opDoneCreatingElement, opSetDocumentCharset, opCharsetSwitchTo, opUpdateStyleSheet, opProcessOfflineManifest, opMarkMalformedIfScript, opStreamEnded, opSetStyleLineNumber, opSetScriptLineNumberAndFreeze, opSvgLoad, opMaybeComplainAboutCharset, opMaybeComplainAboutDeepTree, opAddClass, opAddViewSourceHref, opAddViewSourceBase, opAddErrorType, opAddLineNumberId, opStartLayout, opEnableEncodingMenu> &> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:279:14 (libxul.so+0x4b981fb)
    #27 match<TreeOperationMatcher, mozilla::Variant<uninitialized, opAppend, opDetach, opAppendChildrenToNewParent, opFosterParent, opAppendToDocument, opAddAttributes, nsHtml5DocumentMode, opCreateHTMLElement, opCreateSVGElement, opCreateMathMLElement, opSetFormElement, opAppendText, opFosterParentText, opAppendComment, opAppendCommentToDocument, opAppendDoctypeToDocument, opGetDocumentFragmentForTemplate, opGetFosterParent, opMarkAsBroken, opRunScript, opRunScriptAsyncDefer, opPreventScriptExecution, opDoneAddingChildren, opDoneCreatingElement, opSetDocumentCharset, opCharsetSwitchTo, opUpdateStyleSheet, opProcessOfflineManifest, opMarkMalformedIfScript, opStreamEnded, opSetStyleLineNumber, opSetScriptLineNumberAndFreeze, opSvgLoad, opMaybeComplainAboutCharset, opMaybeComplainAboutDeepTree, opAddClass, opAddViewSourceHref, opAddViewSourceBase, opAddErrorType, opAddLineNumberId, opStartLayout, opEnableEncodingMenu> &> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:279:14 (libxul.so+0x4b981fb)
    #28 match<TreeOperationMatcher, mozilla::Variant<uninitialized, opAppend, opDetach, opAppendChildrenToNewParent, opFosterParent, opAppendToDocument, opAddAttributes, nsHtml5DocumentMode, opCreateHTMLElement, opCreateSVGElement, opCreateMathMLElement, opSetFormElement, opAppendText, opFosterParentText, opAppendComment, opAppendCommentToDocument, opAppendDoctypeToDocument, opGetDocumentFragmentForTemplate, opGetFosterParent, opMarkAsBroken, opRunScript, opRunScriptAsyncDefer, opPreventScriptExecution, opDoneAddingChildren, opDoneCreatingElement, opSetDocumentCharset, opCharsetSwitchTo, opUpdateStyleSheet, opProcessOfflineManifest, opMarkMalformedIfScript, opStreamEnded, opSetStyleLineNumber, opSetScriptLineNumberAndFreeze, opSvgLoad, opMaybeComplainAboutCharset, opMaybeComplainAboutDeepTree, opAddClass, opAddViewSourceHref, opAddViewSourceBase, opAddErrorType, opAddLineNumberId, opStartLayout, opEnableEncodingMenu> &> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:279:14 (libxul.so+0x4b981fb)
    #29 match<TreeOperationMatcher, mozilla::Variant<uninitialized, opAppend, opDetach, opAppendChildrenToNewParent, opFosterParent, opAppendToDocument, opAddAttributes, nsHtml5DocumentMode, opCreateHTMLElement, opCreateSVGElement, opCreateMathMLElement, opSetFormElement, opAppendText, opFosterParentText, opAppendComment, opAppendCommentToDocument, opAppendDoctypeToDocument, opGetDocumentFragmentForTemplate, opGetFosterParent, opMarkAsBroken, opRunScript, opRunScriptAsyncDefer, opPreventScriptExecution, opDoneAddingChildren, opDoneCreatingElement, opSetDocumentCharset, opCharsetSwitchTo, opUpdateStyleSheet, opProcessOfflineManifest, opMarkMalformedIfScript, opStreamEnded, opSetStyleLineNumber, opSetScriptLineNumberAndFreeze, opSvgLoad, opMaybeComplainAboutCharset, opMaybeComplainAboutDeepTree, opAddClass, opAddViewSourceHref, opAddViewSourceBase, opAddErrorType, opAddLineNumberId, opStartLayout, opEnableEncodingMenu> &> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:279:14 (libxul.so+0x4b981fb)
    #30 match<TreeOperationMatcher, mozilla::Variant<uninitialized, opAppend, opDetach, opAppendChildrenToNewParent, opFosterParent, opAppendToDocument, opAddAttributes, nsHtml5DocumentMode, opCreateHTMLElement, opCreateSVGElement, opCreateMathMLElement, opSetFormElement, opAppendText, opFosterParentText, opAppendComment, opAppendCommentToDocument, opAppendDoctypeToDocument, opGetDocumentFragmentForTemplate, opGetFosterParent, opMarkAsBroken, opRunScript, opRunScriptAsyncDefer, opPreventScriptExecution, opDoneAddingChildren, opDoneCreatingElement, opSetDocumentCharset, opCharsetSwitchTo, opUpdateStyleSheet, opProcessOfflineManifest, opMarkMalformedIfScript, opStreamEnded, opSetStyleLineNumber, opSetScriptLineNumberAndFreeze, opSvgLoad, opMaybeComplainAboutCharset, opMaybeComplainAboutDeepTree, opAddClass, opAddViewSourceHref, opAddViewSourceBase, opAddErrorType, opAddLineNumberId, opStartLayout, opEnableEncodingMenu> &> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:279:14 (libxul.so+0x4b981fb)
    #31 match<TreeOperationMatcher> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:852:12 (libxul.so+0x4b981fb)
    #32 nsHtml5TreeOperation::Perform(nsHtml5TreeOpExecutor*, nsIContent**, bool*, bool*) src/parser/html/nsHtml5TreeOperation.cpp:1213:21 (libxul.so+0x4b981fb)
    #33 <null> <null> (libxul.so+0x24f5c55)
    #34 <null> <null> (libxul.so+0x1cd227a)
    #35 nsHtml5TreeOpExecutor::RunFlushLoop() src/parser/html/nsHtml5TreeOpExecutor.cpp:646:19 (libxul.so+0x1cd1358)
    #36 nsHtml5ExecutorFlusher::Run() src/parser/html/nsHtml5StreamParser.cpp:177:18 (libxul.so+0x1ccfac8)
    #37 mozilla::SchedulerGroup::Runnable::Run() src/xpcom/threads/SchedulerGroup.cpp:144:20 (libxul.so+0x1cd448e)
    #38 mozilla::RunnableTask::Run() src/xpcom/threads/TaskController.cpp:502:16 (libxul.so+0xc6419f)
    #39 mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:805:26 (libxul.so+0xc8e3e7)
    #40 mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:641:15 (libxul.so+0xc6c382)
    #41 mozilla::TaskController::ProcessPendingMTTask(bool) src/xpcom/threads/TaskController.cpp:425:36 (libxul.so+0xc6a9d6)
    #42 operator() src/xpcom/threads/TaskController.cpp:135:37 (libxul.so+0xc6aca4)
    #43 mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_0>::Run() src/xpcom/threads/nsThreadUtils.h:531:5 (libxul.so+0xc6aca4)
    #44 nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1148:16 (libxul.so+0xc91e27)
    #45 NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:466:10 (libxul.so+0xc7d9fa)
    #46 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:85:21 (libxul.so+0xc848c2)
    #47 mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:268:30 (libxul.so+0x155812d)
    #48 RunInternal src/ipc/chromium/src/base/message_loop.cc:331:10 (libxul.so+0x155891b)
    #49 RunHandler src/ipc/chromium/src/base/message_loop.cc:324:3 (libxul.so+0x155891b)
    #50 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:306:3 (libxul.so+0x155891b)
    #51 nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27 (libxul.so+0x14db5dc)
    #52 XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:917:20 (libxul.so+0x4877a36)
    #53 mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:235:9 (libxul.so+0x65e2ff9)
    #54 RunInternal src/ipc/chromium/src/base/message_loop.cc:331:10 (libxul.so+0x15588cd)
    #55 RunHandler src/ipc/chromium/src/base/message_loop.cc:324:3 (libxul.so+0x15588cd)
    #56 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:306:3 (libxul.so+0x15588cd)
    #57 XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:749:34 (libxul.so+0x14db5dc)
    #58 mozilla::BootstrapImpl::XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/Bootstrap.cpp:67:12 (libxul.so+0x65e2d3c)
    #59 content_process_main src/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28 (libxul.so+0x65eac72)
    #60 main src/browser/app/nsBrowserApp.cpp:327:18 (libxul.so+0x65eac72)
    #61 __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16 (firefox+0xc93c1)
    #62 pthread_create /builds/worker/fetches/llvm-project/llvm/projects/compiler-rt/lib/tsan/rtl/tsan_interceptors_posix.cpp:965:3 (libc.so.6+0x270b2)
Blocks: 1729880

It was downgraded to investigate some windows crashes which ended up
being a crossbeam issue. So update it again to get fixes to some
crossbeam races.

Assignee: nobody → emilio
Status: NEW → ASSIGNED

Can I get a sec rating?

Flags: needinfo?(tom)

(Seems hard to potentially exploit fwiw)

Didn't we already fix bug 1716028? Is this a different race?

Interesting -- in the patch third_party/rust/crossbeam-deque/CHANGELOG.md is missing version 0.7.4 (the fixed version in the other bug), jumps to 0.8.0 and then has a 0.8.1 that mentions the same vulnerability description.

Keywords: sec-moderate
Flags: needinfo?(tom)

Update rayon to pick up a newer crossbeam version in style/webrender. r=nical
https://hg.mozilla.org/integration/autoland/rev/b5b0491d7707bdda7efa143a4d5dc51a4eba7ad7
https://hg.mozilla.org/mozilla-central/rev/b5b0491d7707

Group: layout-core-security → core-security-release
Status: ASSIGNED → RESOLVED
Closed: 3 years ago
status-firefox94: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → 94 Branch

The patch landed in nightly and beta is affected.
:emilio, is this bug important enough to require an uplift?
If not please set status_beta to wontfix.

For more information, please visit auto_nag documentation.

Flags: needinfo?(emilio)

It's unclear if this is enough to fix it (but if it's not then we have something to report upstream). So I'd wait a bit before uplifting at least, though it should be harmless.

Flags: needinfo?(emilio)

Any recent signs of this race with the fuzzers, Tyson?

Flags: needinfo?(twsmith)

(In reply to Ryan VanderMeulen [:RyanVM] from comment #8)

Any recent signs of this race with the fuzzers, Tyson?

So far no reports from the fuzzers.

Flags: needinfo?(twsmith)

Sounds like this is ready for Beta/ESR91 approval requests?

Flags: needinfo?(emilio)

Comment on attachment 9240250 [details]
Bug 1729813 - Update rayon to pick up a newer crossbeam version in style/webrender. r=nical,jrmuizel

Beta/Release Uplift Approval Request

  • User impact if declined: Data race, potentially random-ish crashes.
  • Is this code covered by automated tests?: Yes
  • Has the fix been verified in Nightly?: No
  • Needs manual test from QE?: No
  • If yes, steps to reproduce:
  • List of other uplifts needed: none
  • Risk to taking this patch: Low
  • Why is the change risky/not risky? (and alternatives if risky): Simple dep update that seems to have helped according to the last few comments, and has been baking on nightly for a bit.
  • String changes made/needed: none

ESR Uplift Approval Request

  • If this is not a sec:{high,crit} bug, please state case for ESR consideration: see above
  • User impact if declined: see above
  • Fix Landed on Version: 93
  • Risk to taking this patch: Low
  • Why is the change risky/not risky? (and alternatives if risky): See above
  • String or UUID changes made by this patch: noen
Flags: needinfo?(emilio)
Attachment #9240250 - Flags: approval-mozilla-esr91?
Attachment #9240250 - Flags: approval-mozilla-beta?

Comment on attachment 9240250 [details]
Bug 1729813 - Update rayon to pick up a newer crossbeam version in style/webrender. r=nical,jrmuizel

Approved for 93.0b8 and 91.2esr.

Attachment #9240250 - Flags: approval-mozilla-esr91?
Attachment #9240250 - Flags: approval-mozilla-esr91+
Attachment #9240250 - Flags: approval-mozilla-beta?
Attachment #9240250 - Flags: approval-mozilla-beta+
QA Whiteboard: [post-critsmash-triage]
Flags: qe-verify-
Whiteboard: [adv-main93+]
Whiteboard: [adv-main93+] → [adv-main93+][adv-esr91.2+]
Alias: CVE-2021-32810
Attached file advisory.txt —
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: