1868190 - Hit MOZ_CRASH(Resolving style on <br> (0x1d9f1e0cc10) without current styles: ElementData { styles: ElementStyles { primary: Some(Some(0x1d9f2463060)), pseudos: EagerPseudoStyles(None) }, damage: GeckoRestyleDamage(nsChangeHint(0)), hint: RestyleHint(REST

Status: NEW

(Core :: CSS Parsing and Computation, defect)

Description

[Jason Kratzer [:jkratzer]]

Testcase found while fuzzing mozilla-central rev 369922cc5c4e (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build 369922cc5c4e --debug --fuzzing  -n firefox
$ python -m grizzly.replay .\firefox\firefox.exe testcase.zip

Hit MOZ_CRASH(Resolving style on <br> (0x1d9f1e0cc10) without current styles: ElementData { styles: ElementStyles { primary: Some(Some(0x1d9f2463060)), pseudos: EagerPseudoStyles(None) }, damage: GeckoRestyleDamage(nsChangeHint(0)), hint: RestyleHint(REST

    r10 = 0x00007ffd4f270000	r11 = 0x0000000bf89f9ba0	r12 = 0x0000000bf89fa85c
    r13 = 0x0000000bf89fb1f0	r14 = 0x0000000000000130	r15 = 0x00007ffce9f7eb18
     r8 = 0x000000000000000e	 r9 = 0x00007ffd4f3febf8	rax = 0x00007ffd1b665d78
    rbp = 0x0000000bf89fa6b0	rbx = 0x0000000bf89fa658	rcx = 0x9526ec83d7720000
    rdi = 0x000000000000170a	rdx = 0x0000000000000000	rip = 0x00007ffce848c493
    rsi = 0x0000000bf89fa85c	rsp = 0x0000000bf89fa5f0
    OS|Windows NT|10.0.22621
    CPU|amd64|family 6 model 186 stepping 2|6
    Crash|EXCEPTION_BREAKPOINT|0x00007ffce848c493|0
    0|0|xul.dll|RustMozCrash(char const*, int, char const*)|hg:hg.mozilla.org/mozilla-central:mozglue/static/rust/wrappers.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|17|0x23
    0|1|xul.dll|mozglue_static::panic_hook(core::panic::panic_info::PanicInfo*)|hg:hg.mozilla.org/mozilla-central:mozglue/static/rust/lib.rs:369922cc5c4efad6c87b13600325eb5a989cde81|96|0x105
    0|2|xul.dll|core::ops::function::Fn::call<void (*)(ref$<core::panic::panic_info::PanicInfo>),tuple$<ref$<core::panic::panic_info::PanicInfo> > >(void (**)(core::panic::panic_info::PanicInfo*), core::panic::panic_info::PanicInfo*)|/rustc/79e9716c980570bfd1f666e3b16ac583f0168962/library/core/src/ops/function.rs|79|0x11
    0|3|xul.dll|std::panicking::rust_panic_with_hook()|git:github.com/rust-lang/rust:library/std/src/panicking.rs:79e9716c980570bfd1f666e3b16ac583f0168962|735|0x278
    0|4|xul.dll|std::panicking::begin_panic_handler::closure$0()|git:github.com/rust-lang/rust:library/std/src/panicking.rs:79e9716c980570bfd1f666e3b16ac583f0168962|609|0xdc
    0|5|xul.dll|std::sys_common::backtrace::__rust_end_short_backtrace<std::panicking::begin_panic_handler::closure_env$0,never$>()|git:github.com/rust-lang/rust:library/std/src/sys_common/backtrace.rs:79e9716c980570bfd1f666e3b16ac583f0168962|170|0x8
    0|6|xul.dll|std::panicking::begin_panic_handler()|git:github.com/rust-lang/rust:library/std/src/panicking.rs:79e9716c980570bfd1f666e3b16ac583f0168962|597|0x6f
    0|7|xul.dll|core::panicking::panic_fmt()|git:github.com/rust-lang/rust:library/core/src/panicking.rs:79e9716c980570bfd1f666e3b16ac583f0168962|72|0x36
    0|8|xul.dll|geckoservo::glue::Servo_ResolveStyle(style::gecko_bindings::structs::root::mozilla::dom::Element*)|hg:hg.mozilla.org/mozilla-central:servo/ports/geckolib/glue.rs:369922cc5c4efad6c87b13600325eb5a989cde81|5898|0x199
    0|9|xul.dll|nsCSSFrameConstructor::ResolveComputedStyle(nsIContent*)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|4645|0x24
    0|10|xul.dll|nsCSSFrameConstructor::AddFrameConstructionItems(nsFrameConstructorState&, nsIContent*, bool, mozilla::ComputedStyle const&, nsCSSFrameConstructor::InsertionPoint const&, nsCSSFrameConstructor::FrameConstructionItemList&, mozilla::EnumSet<nsCSSFrameConstructor::ItemFlag,unsigned char>)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|5153|0x7a
    0|11|xul.dll|nsCSSFrameConstructor::AddFrameConstructionItemsInternal(nsFrameConstructorState&, nsIContent*, nsContainerFrame*, bool, mozilla::ComputedStyle*, mozilla::EnumSet<nsCSSFrameConstructor::ItemFlag,unsigned char>, nsCSSFrameConstructor::FrameConstructionItemList&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|5348|0x276
    0|12|xul.dll|nsCSSFrameConstructor::AddFrameConstructionItems(nsFrameConstructorState&, nsIContent*, bool, mozilla::ComputedStyle const&, nsCSSFrameConstructor::InsertionPoint const&, nsCSSFrameConstructor::FrameConstructionItemList&, mozilla::EnumSet<nsCSSFrameConstructor::ItemFlag,unsigned char>)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|5164|0xf8
    0|13|xul.dll|nsCSSFrameConstructor::ProcessChildren(nsFrameConstructorState&, nsIContent*, mozilla::ComputedStyle*, nsContainerFrame*, const bool, nsFrameList&, const bool, nsIFrame*)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|9777|0x4ba
    0|14|xul.dll|nsCSSFrameConstructor::ConstructFrameFromItemInternal(nsCSSFrameConstructor::FrameConstructionItem&, nsFrameConstructorState&, nsContainerFrame*, nsFrameList&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|3909|0x97a
    0|15|xul.dll|nsCSSFrameConstructor::ConstructFramesFromItem(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList::Iterator&, nsContainerFrame*, nsFrameList&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|5563|0x65
    0|16|xul.dll|nsCSSFrameConstructor::ConstructFramesFromItemList(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList&, nsContainerFrame*, bool, nsFrameList&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|9508|0x3fd
    0|17|xul.dll|nsCSSFrameConstructor::ProcessChildren(nsFrameConstructorState&, nsIContent*, mozilla::ComputedStyle*, nsContainerFrame*, const bool, nsFrameList&, const bool, nsIFrame*)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|9795|0x5e5
    0|18|xul.dll|nsCSSFrameConstructor::ConstructBlock(nsFrameConstructorState&, nsIContent*, nsContainerFrame*, nsContainerFrame*, mozilla::ComputedStyle*, nsContainerFrame**, nsFrameList&, nsIFrame*)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|10658|0x311
    0|19|xul.dll|nsCSSFrameConstructor::ConstructDocElementFrame(mozilla::dom::Element*)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|2556|0xcae
    0|20|xul.dll|nsCSSFrameConstructor::ContentRangeInserted(nsIContent*, nsIContent*, nsCSSFrameConstructor::InsertionKind)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|6872|0x173c
    0|21|xul.dll|mozilla::RestyleManager::ProcessRestyledFrames(nsStyleChangeList&)|hg:hg.mozilla.org/mozilla-central:layout/base/RestyleManager.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|1681|0x252
    0|22|xul.dll|mozilla::RestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags)|hg:hg.mozilla.org/mozilla-central:layout/base/RestyleManager.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|3254|0x623
    0|23|xul.dll|mozilla::RestyleManager::ProcessPendingRestyles()|hg:hg.mozilla.org/mozilla-central:layout/base/RestyleManager.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|3339|0xfe
    0|24|xul.dll|mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|4317|0x82d
    0|25|xul.dll|nsRefreshDriver::TickObserverArray(unsigned int, mozilla::TimeStamp)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|2497|0x85b
    0|26|xul.dll|nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|2731|0xb6c
    0|27|xul.dll|mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|344|0xb4
    0|28|xul.dll|mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|360|0xbb
    0|29|xul.dll|mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|949|0x32
    0|30|xul.dll|mozilla::VsyncRefreshDriverTimer::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|859|0x1d2
    0|31|xul.dll|mozilla::VsyncRefreshDriverTimer::NotifyVsyncOnMainThread(mozilla::VsyncEvent const&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|757|0x345
    0|32|xul.dll|mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncTimerOnMainThread()|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|591|0xda
    0|33|xul.dll|mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&)|hg:hg.mozilla.org/mozilla-central:dom/ipc/VsyncMainChild.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|66|0xf1
    0|34|xul.dll|mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&)|s3:gecko-generated-sources:7f392d669fc99cb53890b2dfa2f69f2bf8e4f1df051a77593cb429a29adbe0f4c86b00691823c827b469dee2291b8274c8c388965c4321544b952b6412eb648c/ipc/ipdl/PVsyncChild.cpp:|227|0x32c
    0|35|xul.dll|mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&)|s3:gecko-generated-sources:2695e3b8ba6cd7ad8d6d852fe5d15cc3774d9422d76b6973e6bb91653be2c4d7211535389ff2060a0d249ea85cc666ec82af69ec287e7609925e0fd6a0b1b54c/ipc/ipdl/PBackgroundChild.cpp:|5589|0x2b6
    0|36|xul.dll|mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|1813|0x14e
    0|37|xul.dll|mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message,mozilla::DefaultDelete<IPC::Message> >)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|1732|0x2a7
    0|38|xul.dll|mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|1525|0x193
    0|39|xul.dll|mozilla::ipc::MessageChannel::MessageTask::Run()|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|1623|0xdd
    0|40|xul.dll|mozilla::RunnableTask::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|549|0x1d
    0|41|xul.dll|mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex &> const&)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|876|0x9e7
    0|42|xul.dll|mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex &> const&)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|699|0x57
    0|43|xul.dll|mozilla::TaskController::ProcessPendingMTTask(bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|485|0xba
    0|44|xul.dll|mozilla::detail::RunnableFunction<`lambda at /xpcom/threads/TaskController.cpp:214:7'>::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:369922cc5c4efad6c87b13600325eb5a989cde81|548|0x16
    0|45|xul.dll|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|1198|0x7fe
    0|46|xul.dll|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|480|0x44
    0|47|xul.dll|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|107|0x11a
    0|48|xul.dll|MessageLoop::RunHandler()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:369922cc5c4efad6c87b13600325eb5a989cde81|363|0x4f
    0|49|xul.dll|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:369922cc5c4efad6c87b13600325eb5a989cde81|345|0x6e
    0|50|xul.dll|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|148|0x27
    0|51|xul.dll|nsAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/windows/nsAppShell.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|824|0x189
    0|52|xul.dll|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|721|0x78
    0|53|xul.dll|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|235|0x3c
    0|54|xul.dll|MessageLoop::RunHandler()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:369922cc5c4efad6c87b13600325eb5a989cde81|363|0x4f
    0|55|xul.dll|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:369922cc5c4efad6c87b13600325eb5a989cde81|345|0x6e
    0|56|xul.dll|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|656|0x8b9
    0|57|firefox.exe|NS_internal_main(int, char**, char**)|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|375|0x2cd
    0|58|firefox.exe|wmain(int, wchar_t**)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsWindowsWMain.cpp:369922cc5c4efad6c87b13600325eb5a989cde81|151|0x226
    0|59|firefox.exe|__scrt_common_main_seh()|/builds/worker/workspace/obj-build/browser/app/D:/a/_work/1/s/src/vctools/crt/vcstartup/src/startup/exe_common.inl|288|0x10b
    0|60|kernel32.dll||||
    0|61|ntdll.dll||||
    0|62|KERNELBASE.dll||||

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: Testcase

Comment 2

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20231208151401-31a6430ad25b.
Unable to bisect testcase (Unable to launch the start build!):

Start: 047b6fbf22713455b857a9e69f80d3a6a8ecddea (20221209033229)
End: 369922cc5c4efad6c87b13600325eb5a989cde81 (20231204091942)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False)

Comment 3

[Jason Kratzer [:jkratzer]]

Resetting these flags. I'm still working out some issues with bugmon for windows.

Comment 4

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20231208215722-6f5601bcf5ef.
Unable to bisect testcase (Unable to launch the start build!):

Start: d4fa99ef8e6f9c5ea1699a456c139c2bc12b797e (20221210092830)
End: 369922cc5c4efad6c87b13600325eb5a989cde81 (20231204091942)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False)

Comment 5

[Jason Kratzer [:jkratzer]]

Attachment: testcase.zip

Comment 6

[Jason Kratzer [:jkratzer]]

Ok, let's try this one more time. There's a startup crashed caused by the pref user_pref("gfx.webgpu.force-enabled", true) in earlier builds.

Comment 7

[Bugmon [:jkratzer for issues]]

Pernosco is only supported for Linux x86_64 bugs.

Comment 8

[Bugmon [:jkratzer for issues]]

The bug appears to have been introduced in the following build range:

Start: 9b5c52e4d5ce3d83895213c0f5ffcdce5c46d220 (20221229085942)
End: d3dd3b74e57bf40acc0373cf07e5ca4713cea70e (20221229201843)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=9b5c52e4d5ce3d83895213c0f5ffcdce5c46d220&tochange=d3dd3b74e57bf40acc0373cf07e5ca4713cea70e

Comment 9

[BugBot [:suhaib / :marco/ :calixte]]

This bug has been marked as a regression. Setting status flag for Nightly to affected.

Comment 10

[Donal Meehan [:dmeehan]]

Setting Bug 1806167 as the regressor based on the pushlog in Comment 8 - please correct if needed

Comment 11

[BugBot [:suhaib / :marco/ :calixte]]

:emilio, since you are the author of the regressor, bug 1806167, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 12

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Looks like there is no user crash.

-> S3

Comment 13

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Ah, but this should be handled in the layout.

Comment 14

[Daniel Holbert [:dholbert]]

(In reply to Bugmon [:jkratzer for issues] from comment #7)

Pernosco is only supported for Linux x86_64 bugs.

I'm guessing this was Bugmon picking up on the Platform: Windows field at the top of this bug. (I do see that comment 0 was on Windows, per the .dll suffixes in the backtrace there)

Jason, if it's not too much trouble, could you see if you can get this to crash on Linux as well? I don't know if there's any reason this should be Windows-specific, aside from maybe the particulars of font metrics & things like that (if the testcase has any sort of implicit dependency on that). If that were the only thing making this Windows-specific, I'd hope that the fuzzers would be able to discover appropriate lengths/etc. to trigger the same issue on other platforms.

(The motivation would be to get this in pernosco if possible, since that makes fuzzer bugs much easier to reason about and debug.)

Comment 15

[Jason Kratzer [:jkratzer]]

Hrmm, it does appear that this bug does in fact trigger on Linux. Let me change the platform.

Comment 16

[Bugmon [:jkratzer for issues]]

Successfully recorded a pernosco session. A link to the pernosco session will be added here shortly.

Comment 17

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1797752

Comment 18

[Bugmon [:jkratzer for issues]]

Successfully recorded a pernosco session. A link to the pernosco session will be added here shortly.

Comment 19

[Daniel Holbert [:dholbert]]

jkratzer, do you know what happened to the pernosco link here? (see comment 18 and comment 16)

Comment 20

[Bugmon [:jkratzer for issues]]

A pernosco session for this bug can be found here.

Comment 21

[Jason Kratzer [:jkratzer]]

(In reply to Daniel Holbert [:dholbert] from comment #19)

jkratzer, do you know what happened to the pernosco link here? (see comment 18 and comment 16)

Sorry :dholbert but I thought I had already responded to this. There were issues with the original pernosco recordings. At this point, we're not really sure what but the session in comment #20 works.