1777931 - Crash in [@ mozilla::SharedStyleSheetCache::LoadCompletedInternal] (MOZ_DIAGNOSTIC_ASSERT(value))

Status: NEW

(Core :: CSS Parsing and Computation, defect)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

20 crashes from 12 installations, all with Firefox 104.0a1 starting with 20220629070023. Chinese and Spanish are overrepresented in the crash reports. The crashes are reported for documents loaded in extension processes.

Changelog which likely added the regression

Emilio, could you investigate?

Crash report: https://crash-stats.mozilla.org/report/index/d9a18962-3cc1-4698-a5b4-675280220704

MOZ_CRASH Reason: MOZ_DIAGNOSTIC_ASSERT(value)

Top 10 frames of crashing thread:

0 xul.dll static mozilla::SharedStyleSheetCache::LoadCompletedInternal layout/style/SharedStyleSheetCache.cpp:113
1 xul.dll static mozilla::SharedStyleSheetCache::LoadCompleted layout/style/SharedStyleSheetCache.cpp:63
2 xul.dll mozilla::css::SheetLoadData::VerifySheetReadyToParse layout/style/Loader.cpp:704
3 xul.dll mozilla::css::StreamLoader::OnStopRequest layout/style/StreamLoader.cpp:81
4 xul.dll std::_Func_impl_no_alloc<`lambda at /builds/worker/checkouts/gecko/netwerk/protocol/http/HttpChannelChild.cpp:786:13', void>::_Do_call 
5 xul.dll mozilla::net::ChannelEventQueue::FlushQueue netwerk/ipc/ChannelEventQueue.cpp:94
6 xul.dll mozilla::net::ChannelEventQueue::ResumeInternal::CompleteResumeRunnable::Run netwerk/ipc/ChannelEventQueue.cpp:152
7 xul.dll mozilla::SchedulerGroup::Runnable::Run xpcom/threads/SchedulerGroup.cpp:140
8 xul.dll mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal xpcom/threads/TaskController.cpp:851
9 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1205

Comment 1

[Emilio Cobos Álvarez (:emilio)]

I don't see anything particularly likely to cause this in that pushlog unfortunately.

Most of the URLs in the crash report are from extensions like: moz-extension://eb04ea5d-630b-412d-9cfb-269c9995c0e9/src/action/index.html

Andreas, do you know how could I find which extension popup does that correspond to?

Comment 2

[Andreas Wagner [:TheOne] [use NI]]

(In reply to Emilio Cobos Álvarez (:emilio) from comment #1)

I don't see anything particularly likely to cause this in that pushlog unfortunately.

Most of the URLs in the crash report are from extensions like: moz-extension://eb04ea5d-630b-412d-9cfb-269c9995c0e9/src/action/index.html

Andreas, do you know how could I find which extension popup does that correspond to?

The moz-extension UUID is generated per install, so it's impossible to say without more information, unfortunately.

Comment 3

[Daniel Holbert [:dholbert]]

Notably, this is a diagnostic assert (so it's nightly/early-beta only). So Firefox release users will sail right past this without crashing, probably without too much going wrong in this case.

Comment 4

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1777931 - Add a few diagnostic asserts to the sub-resource cache. r=dholbert,#layout

The only thing that could trigger this is a bogus key, or overriding an
already-loading stylesheet which we didn't correctly coalesce.

Either of those is a bug.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/42150cbcb4fc
Add a few diagnostic asserts to the sub-resource cache. r=dholbert,layout-reviewers

Comment 6

[Marian-Vasile Laza]

https://hg.mozilla.org/mozilla-central/rev/42150cbcb4fc

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:emilio, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox104 to wontfix.

For more information, please visit auto_nag documentation.

Comment 8

[Emilio Cobos Álvarez (:emilio)]

I guess this doesn't fix the crash (only possibly moves it)

Comment 9

[Daniel Holbert [:dholbert]]

emilio, any other ideas here? Any additional diagnostic asserts that we could add to test other theories?

Comment 10

[Emilio Cobos Álvarez (:emilio)]

Not really, given crash volume doesn't feel like S3 tho.

Comment 11

[BugBot [:suhaib / :marco/ :calixte]]

The bug is linked to a topcrash signature, which matches the following criterion:

• Top 10 AArch64 and ARM crashes on beta

:emilio, could you consider increasing the severity of this top-crash bug?

For more information, please visit BugBot documentation.

Comment 12

[Emilio Cobos Álvarez (:emilio)]

Sunil, might this spike be due to bug 1864817? There are no crashes on release or past beta6, so it sure smells like it...

Comment 13

[Sunil Mayya]

May be I am missing something Emilio?
Looking at this graph for the nightly release I don't see any new spikes after merging my ODF patch on March 10th?

Comment 14

[BugBot [:suhaib / :marco/ :calixte]]

Based on the topcrash criteria, the crash signatures linked to this bug are not in the topcrash signatures anymore.

For more information, please visit BugBot documentation.

Comment 15

[Emilio Cobos Álvarez (:emilio)]

Ah, d'uh, so I'm dumb, sorry. The reason why there are no crashes after b6 is that what's failing is a diagnostic assert (here). That comes from bug 1599160 originally... A test-case, steps to repro here would be really useful, but this doesn't affect release users.

Comment 16

[Mayank Bansal]

I got a crash with this crash signature : [@ mozilla::SharedSubResourceCache<T>::LoadCompleted ]

I opened https://yb7t4.csb.app/ and had enabled the profiler. The page seemingly didnt load (or kept loading), and after maybe 30s the tab crashed.
I havent tried to repro.

Crash: https://crash-stats.mozilla.org/report/index/278cc8fb-df58-4344-93a4-091bb0240906#tab-bugzilla

Comment 17

[Mayank Bansal]

I tried to repro a couple of times, but couldnt. I think to repro, the URL should be opened in a private window each time or something and/or do hard reloads.

I did end up getting another crash for which i filed bug 1917312

Comment 18

[Mayank Bansal]

I got a crash again. Maybe wait for the page to load, then do a hard reload. Maybe hard reload a couple of times. Maybe try opening the page in two tabs and hard reload both.

Comment 19

[Mayank Bansal]

Attachment: bandicam 2024-09-06 22-21-29-906.mp4

See the STR in the video.

1. Create new Nightly profile
2. Press F12 which will open the dev toolbar
3. Go to the URL (https://yb7t4.csb.app/) . Click on proceed.
4. Let the page load. It will crash.
5. If it does not crash, try hard reloading the page (Ctrl+ Shift + R on Windows).
6. Repeat from Step1 if it does not repro.

Comment 20

[Emilio Cobos Álvarez (:emilio)]

I haven't been able to repro this in ~10 attempts (on Linux tho)... How reproducible is it for you?

Comment 21

[Mayank Bansal]

(In reply to Emilio Cobos Álvarez (:emilio) from comment #20)

I haven't been able to repro this in ~10 attempts (on Linux tho)... How reproducible is it for you?

Reproducible enough that I got it to repro the first time in a new profile just now : https://crash-stats.mozilla.org/report/index/efbabd58-cba7-4f54-87c9-94c640240909#tab-bugzilla
But not reproducible enough that I can do a bisection.

Comment 22

[Emilio Cobos Álvarez (:emilio)]

Ok will try to repro harder...

Comment 23

[Emilio Cobos Álvarez (:emilio)]

I still haven't been able to repro...

Comment 24

[Mayank Bansal]

Even I cannot repro now.
The "fix" range (not 100% sure) is this, which contains bug 1904059 (of which bug 1917312 is a dupe).
Make what you will of this.