1897035 - Crash in [@ style::properties::UnparsedValue::substitute_variables]

Status: RESOLVED FIXED

(Core :: CSS Parsing and Computation, defect)

Description

[BugBot [:suhaib / :marco/ :calixte]]

Crash report: https://crash-stats.mozilla.org/report/index/eb22dcf6-0305-45cb-907d-f31280240515

MOZ_CRASH Reason: Expected (Animation, animation-timeline) to be in the cache but it was not!

Top 10 frames of crashing thread:

0  xul.dll  MOZ_Crash  mfbt/Assertions.h:317
0  xul.dll  RustMozCrash  mozglue/static/rust/wrappers.cpp:17
1  xul.dll  mozglue_static::panic_hook  mozglue/static/rust/lib.rs:98
2  xul.dll  core::ops::function::Fn::call<void   /rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04/library/core/src/ops/function.rs:250
3  xul.dll  alloc::boxed::impl$49::call  library/alloc/src/boxed.rs:2029
3  xul.dll  std::panicking::rust_panic_with_hook  library/std/src/panicking.rs:785
4  xul.dll  std::panicking::begin_panic_handler::closure$0  library/std/src/panicking.rs:659
5  xul.dll  std::sys_common::backtrace::__rust_end_short_backtrace<std::panicking::begin_panic_handler::closure_env$0, never$>  library/std/src/sys_common/backtrace.rs:171
6  xul.dll  std::panicking::begin_panic_handler  library/std/src/panicking.rs:647
7  xul.dll  core::panicking::panic_fmt  library/core/src/panicking.rs:72

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2024-03-22
• Process type: Parent
• Is startup crash: No
• Has user comments: No
• Is null crash: Yes - 3 out of 5 crashes happened on null or near null memory address

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::CSS Parsing and Computation' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Daniel Holbert [:dholbert]]

emilio, could you take a look here?

Looking at the last 6 months for the crashes that have a "crash reason" field, 5 of them are Expected (Animation, animation-timeline) to be in the cache but it was not! (like the one in comment 0 here), and there's also one from a few days ago for Expected (Transition, transition-behavior) to be in the cache but it was not! which was https://crash-stats.mozilla.org/report/index/9b0424bd-68f4-4fc4-9de2-b5c9e0240511

Comment 3

[Emilio Cobos Álvarez (:emilio)]

Hmm, those are prefable properties. A pref switch mid restyle could conceivably cause this maybe?

Comment 4

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1897035 - Remove nightly-only crash that now I understand. r=dholbert,#style,#layout

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/8b79b70511d7
Remove nightly-only crash that now I understand. r=dholbert

Comment 6

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/8b79b70511d7