1876539 - Crash in [@ mozilla::ServoStyleSet::ClearNonInheritingComputedStyles]

Status: RESOLVED FIXED

(Core :: DOM: CSS Object Model, defect)

Description

[Donal Meehan [:dmeehan]]

Crash report: https://crash-stats.mozilla.org/report/index/606566e1-0539-410a-9a7f-2b97a0240114

Reason: SIGSEGV / SEGV_MAPERR

Top 10 frames of crashing thread:

0  libxul.so  RefPtr<mozilla::ComputedStyle>::assign_assuming_AddRef  mfbt/RefPtr.h:70
0  libxul.so  RefPtr<mozilla::ComputedStyle>::operator=  mfbt/RefPtr.h:188
0  libxul.so  mozilla::ServoStyleSet::ClearNonInheritingComputedStyles  layout/style/ServoStyleSet.cpp:1188
0  libxul.so  mozilla::ServoStyleSet::ShellDetachedFromDocument  layout/style/ServoStyleSet.cpp:139
1  libxul.so  mozilla::dom::Document::DeletePresShell  dom/base/Document.cpp:7138
2  libxul.so  mozilla::PresShell::Destroy  layout/base/PresShell.cpp:1310
3  libxul.so  nsDocumentViewer::DestroyPresShell  layout/base/nsDocumentViewer.cpp:3519
4  libxul.so  nsDocumentViewer::Destroy  layout/base/nsDocumentViewer.cpp:1741
5  libxul.so  nsDocumentViewer::~nsDocumentViewer  layout/base/nsDocumentViewer.cpp:566
6  libxul.so  nsDocumentViewer::Release  layout/base/nsDocumentViewer.cpp:533

Comment 1

[Donal Meehan [:dmeehan]]

The first reports for this are in Fx122.0b7

Comment 2

[Donal Meehan [:dmeehan]]

Pinging triage owner, not sure what introduced this, nor why we didn't see it start in Nightly around the same time.
The following were the patches that were uplift to mozilla-central before Fx122.0b7:
https://hg.mozilla.org/releases/mozilla-beta/pushloghtml?fromchange=DEVEDITION_122_0b6_RELEASE&tochange=DEVEDITION_122_0b7_RELEASE

Comment 3

[Arturo Mejia [:amejia]]

I reached out the the DOM team to see if someone in the team is familiar with crash.

Comment 4

[Emilio Cobos Álvarez [:emilio]]

Maybe Olli's lazy styleset creation? Looks like the styleset is null maybe prematurely?

Comment 5

[Olli Pettay [:smaug][[e-mail]]]

Hmm, something about printing

Comment 6

[Olli Pettay [:smaug][[e-mail]]]

I think the issue is this order https://searchfox.org/mozilla-central/rev/1e726a0e49225dc174ab55d1d0b21e86208d7251/layout/base/nsDocumentViewer.cpp#548,566

Comment 7

[Olli Pettay [:smaug][[e-mail]]]

Ok, on Nightly we have https://crash-stats.mozilla.org/report/index/e93b5f66-57d4-4f91-b544-1c1c60240125
but late beta doesn't have DIAGNOSTIC_ASSERT

Comment 8

[Olli Pettay [:smaug][[e-mail]]]

Attachment: Bug 1876539, drop styleset only if presshell has been disconnected, r=emilio

Comment 9

[Olli Pettay [:smaug][[e-mail]]]

Attachment: Bug 1876539, drop styleset only if presshell has been disconnected, r=emilio

Original Revision: https://phabricator.services.mozilla.com/D199674

Comment 10

[Phabricator Automation]

Uplift Approval Request

• Risk associated with taking this patch: Very low. Just not clearing some data early, and we used to have that behavior
• String changes made/needed: NA
• Needs manual QE test: no
• Explanation of risk level: ^
• User impact if declined: crashes
• Is Android affected?: yes
• Fix verified in Nightly: no
• Code covered by automated testing: no
• Steps to reproduce for manual QE testing: We don't have steps to reproduce

Comment 11

[Olli Pettay [:smaug][[e-mail]]]

Attachment: Bug 1876539, drop styleset only if presshell has been disconnected, r=emilio

Original Revision: https://phabricator.services.mozilla.com/D199674

Comment 12

[Phabricator Automation]

Uplift Approval Request

• Risk associated with taking this patch: Very slow, we just don't clear certain data (always) early, similarly what we did before
• String changes made/needed: NA
• Needs manual QE test: no
• Explanation of risk level: ^
• User impact if declined: Crashes
• Steps to reproduce for manual QE testing: We don't have STR
• Is Android affected?: yes
• Fix verified in Nightly: no
• Code covered by automated testing: no

Comment 13

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/c7d31544e88e
drop styleset only if presshell has been disconnected, r=emilio

Comment 14

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/c7d31544e88e

Comment 15

[BugBot [:suhaib / :marco/ :calixte]]

Since nightly and release are affected, beta will likely be affected too.
For more information, please visit BugBot documentation.

Comment 16

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-beta/rev/62a7361b983c

Comment 17

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-release/rev/f66107c35b12