1834717 - Firefox crashes on :nth-child():before() selector combination

Status: VERIFIED FIXED

(Core :: CSS Parsing and Computation, defect)

Description

[schellmax01]

Steps to reproduce:

using the following css selector:

div:nth-child(odd of .b):before{content:'x'}

for an online demonstration, see https://codepen.io/schellmax01/pen/RwevJqv

Actual results:

firefox crashes

Expected results:

firefox should not crash :)

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::CSS Parsing and Computation' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Mayank Bansal]

https://crash-stats.mozilla.org/report/index/39125196-17c0-4eaa-8242-c93160230524#tab-bugzilla

Comment 3

[Mayank Bansal]

Attachment: Reporters_Standalone_Testcase.html

Comment 4

[Mayank Bansal]

With layout.css.nth-child-of.enabled= True,

Bug 1808228 - Implement selector matching for :nth-child(An+B of selector list) and :nth-last-child(An+B of selector list) r=emilio

Since we have been using a single hash map to cache all :nth-child
indices (with no selector list), each different selector will need its
own cache.

As a side note, this patch does not address invalidation.

Differential Revision: https://phabricator.services.mozilla.com/D166266

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1808228

Comment 6

[Emilio Cobos Álvarez [:emilio]]

Attachment: Bug 1834717 - Properly increase the nesting level when matching :nth-child(of) selectors. r=zrhoffman,#style,#layout

Comment 7

[Emilio Cobos Álvarez [:emilio]]

Attachment: Bug 1834717 - More gracefully deal with broken calls into selector matching. r=zrhoffman,#style

If this happens again, it might be worth not matching rather than
potentially crashing. Though I guess crashing is a very good way getting
it reported soon...

Comment 8

[Emilio Cobos Álvarez [:emilio]]

Comment on attachment 9335626 [details]
Bug 1834717 - Properly increase the nesting level when matching :nth-child(of) selectors. r=zrhoffman,#style,#layout

Beta/Release Uplift Approval Request

• User impact if declined: Trivial crash fix.
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: Yes
• If yes, steps to reproduce: open test-case.
• List of other uplifts needed: none
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Trivial fix, kinda sad that we didn't have coverage for this case o.O
• String changes made/needed: none
• Is Android affected?: Yes

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/ee81e273e78b
Properly increase the nesting level when matching :nth-child(of) selectors. r=dshin

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b46c07780ebc
More gracefully deal with broken calls into selector matching. r=dshin

Comment 11

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/40196 for changes under testing/web-platform/tests

Comment 12

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/ee81e273e78b

Comment 13

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot

Comment 14

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/b46c07780ebc

Comment 15

[Pascal Chevrel:pascalc]

Emilio, two patches landed on mozilla-central but you only requested uplift to one of them, is that intended? Thanks

Comment 16

[Emilio Cobos Álvarez [:emilio]]

Yeah the second is basically a mitigation. The first is enough to fix the crash.

Comment 17

[Pascal Chevrel:pascalc]

Comment on attachment 9335626 [details]
Bug 1834717 - Properly increase the nesting level when matching :nth-child(of) selectors. r=zrhoffman,#style,#layout

Approved for 114 beta 9, thanks.

Comment 18

[Pascal Chevrel:pascalc]

https://hg.mozilla.org/releases/mozilla-beta/rev/59fe04f5984b

Comment 19

[Hani Yacoub, Desktop QA]

Verified as fixed on Windows 10 x64, macOS 11.6.

Comment 20

[Hani Yacoub, Desktop QA]

Verified as fixed on Windows 10 x64, macOS 11.6 and on Ubuntu 20.04 x64.