1951563 - Crash in [@ servo_arc::impl$11::deref]

Status: NEW

(Core :: CSS Parsing and Computation, defect)

Description

[BugBot [:suhaib / :marco]]

Crash report: https://crash-stats.mozilla.org/report/index/a820688e-9502-42c8-a4ca-66d690240914

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  xul.dll  servo_arc::impl$11::deref  servo/components/servo_arc/lib.rs:729
0  xul.dll  selectors::parser::Selector<style::gecko::selector_parser::SelectorImpl>::iter_raw_match_order  servo/components/selectors/parser.rs:1008
0  xul.dll  selectors::parser::Selector<style::gecko::selector_parser::SelectorImpl>::iter  servo/components/selectors/parser.rs:932
0  xul.dll  selectors::matching::matches_complex_selector_list::closure$0  servo/components/selectors/matching.rs:456
0  xul.dll  selectors::kleene_value::KleeneValue::any_value  servo/components/selectors/kleene_value.rs:68
0  xul.dll  selectors::kleene_value::KleeneValue::any  servo/components/selectors/kleene_value.rs:46
0  xul.dll  selectors::matching::matches_complex_selector_list  servo/components/selectors/matching.rs:453
0  xul.dll  selectors::matching::matches_simple_selector::closure$1  servo/components/selectors/matching.rs:1231
0  xul.dll  selectors::context::MatchingContext<style::gecko::selector_parser::SelectorImpl>::nest  servo/components/selectors/context.rs:352
0  xul.dll  selectors::matching::matches_simple_selector  servo/components/selectors/matching.rs:1230

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2024-12-30
• Process type: Multiple distinct types
• Is startup crash: No
• Has user comments: No
• Is null crash: Yes - 3 out of 4 crashes happened on null or near null memory address

Comment 1

[BugBot [:suhaib / :marco]]

The Bugbug bot thinks this bug should belong to the 'Core::CSS Parsing and Computation' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Daniel Holbert [:dholbert]]

FWIW, of the 37 crashes in the past week, 10 have a nonzero value for "Possible bit flips max confidence" (with the values ranging from 25 to 96).

That includes the crash report linked in comment 0, which has Possible bit flips max confidence: 43%.

Given that and the fact that there are hash tables in the backtrace, I'm guessing this is related to bug 1406996, and we should strongly suspect some form of memory corruption.

--> triaging as S3 though this might not be actionable (and/or might be not-really-a-bug-in-stylo)