1863991 - Crash in [@ style::properties::cascade::Cascade::apply_non_prioritary_properties]

Status: NEW

(Core :: CSS Parsing and Computation, defect)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

35 crashes from 22 installations on Windows. More than half the crashes since yesterday, both with Firefox 119.0 and 119.0.1. There is a correlation with video sites triggering this crash.
No common pattern from add-ons installed.

Emilio, any idea why this started now?

Crash report: https://crash-stats.mozilla.org/report/index/6e30fe08-bcb9-45be-a862-bc5830231109

Reason: EXCEPTION_ACCESS_VIOLATION_WRITE

Top 10 frames of crashing thread:

0  xul.dll  style::properties::cascade::Cascade::apply_non_prioritary_properties  servo/components/style/properties/cascade.rs:792
1  xul.dll  style::properties::cascade::apply_declarations  servo/components/style/properties/cascade.rs:339
1  xul.dll  style::properties::cascade::cascade_rules  servo/components/style/properties/cascade.rs:200
1  xul.dll  style::properties::cascade::cascade  servo/components/style/properties/cascade.rs:82
1  xul.dll  style::stylist::Stylist::cascade_style_and_visited  servo/components/style/stylist.rs:1138
1  xul.dll  style::style_resolver::StyleResolverForElement<style::gecko::wrapper::GeckoElement>::cascade_style_and_visited  servo/components/style/style_resolver.rs:349
1  xul.dll  style::style_resolver::StyleResolverForElement<style::gecko::wrapper::GeckoElement>::cascade_primary_style<style::gecko::wrapper::GeckoElement>  servo/components/style/style_resolver.rs:246
2  xul.dll  style::style_resolver::impl$3::cascade_styles_with_default_parents::closure$0  servo/components/style/style_resolver.rs:379
2  xul.dll  style::style_resolver::with_default_parent_styles<style::gecko::wrapper::GeckoElement, style::style_resolver::impl$3::cascade_styles_with_default_parents::closure_env$0<style::gecko::wrapper::GeckoElement>, style::style_resolver::ResolvedElementStyles>  servo/components/style/style_resolver.rs:119
3  xul.dll  style::style_resolver::StyleResolverForElement<style::gecko::wrapper::GeckoElement>::cascade_styles_with_default_parents  servo/components/style/style_resolver.rs:377

Comment 1

[Emilio Cobos Álvarez (:emilio)]

I don't see how https://hg.mozilla.org/releases/mozilla-release/annotate/b8f0d32ac6a5c34db8692ed382c3018e6309ea09/servo/components/style/properties/cascade.rs#l792 could possibly be causing an EXCEPTION_ACCESS_VIOLATION_WRITE, that only reads and returns another value on the stack.

Gabriele, any idea?

Comment 2

[Gabriele Svelto [:gsvelto]]

The vast majority of the crashes have either the crash reason set to EXCEPTION_ACCESS_VIOLATION_READ and the address to 0x123038fc71806840 or the crash reason set to EXCEPTION_ACCESS_VIOLATION_WRITE and the address to 0xffffffffffff68c3. In both cases these are coming from machines with the CPU info "family 23 model 1 stepping 1", aka first-generation AMD Zen processors. We're very likely hitting a CPU bug which accounts for more than 90% of the volume here, and in particular for buildid 20231106151204.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:alaskanemily, could you have a look please?

For more information, please visit BugBot documentation.

Comment 4

[Daniel Holbert [:dholbert]]

I think we can consider this S3 at-best, given comment 2 and given that the crash spike has gone away.

(November had several days with 20+ crashes/day, but now we're down to 0-3 crashes per day again).