1971660 - Crash in [@ cssparser::tokenizer::Tokenizer::byte_at] on family 6 model 183 stepping 1

Status: NEW

(Core :: CSS Transitions and Animations, defect, P3)

Description

[BugBot [:suhaib / :marco]]

Crash report: https://crash-stats.mozilla.org/report/index/f144aea8-98ff-4156-85ed-96a260250607

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  xul.dll  cssparser::tokenizer::Tokenizer::byte_at  third_party/rust/cssparser/src/tokenizer.rs:384
0  xul.dll  cssparser::tokenizer::Tokenizer::next_byte_unchecked  third_party/rust/cssparser/src/tokenizer.rs:379
0  xul.dll  cssparser::tokenizer::Tokenizer::skip_whitespace  third_party/rust/cssparser/src/tokenizer.rs:475
0  xul.dll  cssparser::parser::Parser::skip_whitespace  third_party/rust/cssparser/src/parser.rs:518
0  xul.dll  cssparser::parser::Parser::next  third_party/rust/cssparser/src/parser.rs:615
1  xul.dll  cssparser::parser::Parser::expect_ident  third_party/rust/cssparser/src/parser.rs:373
1  xul.dll  cssparser::parser::Parser::expect_ident_cloned  third_party/rust/cssparser/src/parser.rs:842
1  xul.dll  enum2$<style::values::specified::color::Color>::parse_internal  servo/components/style/values/specified/color.rs:426
2  xul.dll  style::values::specified::color::impl$4::parse  servo/components/style/values/specified/color.rs:409
2  xul.dll  style::values::specified::color::impl$7::parse_quirky::closure$0  servo/components/style/values/specified/color.rs:625

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2025-04-08
• Process type: Content
• Is startup crash: No
• Has user comments: No
• Is null crash: Yes - 1 out of 5 crashes happened on null or near null memory address
• Is use after free crash: Yes - 1 out of 5 crashes happened on or near an allocator poison value

Comment 1

[Andrew McCreight [:mccr8]]

There's only one crash in the last 6 months on the allocator poison value so I'm just going to unhide it.

Comment 2

[Emilio Cobos Álvarez [:emilio]]

Doesn't seem actionable at a glance.

Comment 3

[Andrew McCreight [:mccr8]]

Looks like a possible CPU bug? About half of the crashes in the last 3 months are on family 6 model 183 stepping 1.