1999159 - Crash in [@ mozilla::StyleOwnedSlice<T>::AsSpan]

Status: NEW

(Core :: CSS Parsing and Computation, defect)

Description

[BugBot [:suhaib / :marco/ :calixte]]

Crash report: https://crash-stats.mozilla.org/report/index/7768427d-1e5f-41cd-ae27-0e6c30251105

MOZ_CRASH Reason: MOZ_RELEASE_ASSERT((!elements && extentSize == 0) || (elements && extentSize != dynamic_extent))

Top 10 frames of crashing thread:

0  xul.dll  AnnotateMozCrashReason  mfbt/Assertions.h:58
0  xul.dll  mozilla::Span<const mozilla::StyleGenericBoxShadow<mozilla::StyleGenericColor<mozilla::StylePercentage>, mozilla::StyleCSSPixelLength, mozilla::StyleCSSPixelLength, mozilla::StyleCSSPixelLength>, 4294967295>::storage_type<mozilla::span_details::extent_type<4294967295> >::storage_type  mfbt/Span.h:851
0  xul.dll  mozilla::Span<const mozilla::StyleGenericBoxShadow<mozilla::StyleGenericColor<mozilla::StylePercentage>, mozilla::StyleCSSPixelLength, mozilla::StyleCSSPixelLength, mozilla::StyleCSSPixelLength>, 4294967295>::Span  mfbt/Span.h:409
0  xul.dll  mozilla::StyleOwnedSlice<mozilla::StyleGenericBoxShadow<mozilla::StyleGenericColor<mozilla::StylePercentage>, mozilla::StyleCSSPixelLength, mozilla::StyleCSSPixelLength, mozilla::StyleCSSPixelLength> >::AsSpan const  layout/style/ServoStyleConsts.h:2886
0  xul.dll  nsStyleEffects::HasBoxShadowWithInset const  layout/style/nsStyleStruct.h:2327
0  xul.dll  nsIFrame::DisplayInsetBoxShadowUnconditional  layout/generic/nsIFrame.cpp:2592
0  xul.dll  nsIFrame::DisplayBorderBackgroundOutline  layout/generic/nsIFrame.cpp:2692
0  xul.dll  nsFlexContainerFrame::BuildDisplayList  layout/generic/nsFlexContainerFrame.cpp:2982
0  xul.dll  nsIFrame::BuildDisplayListForChild  layout/generic/nsIFrame.cpp:4509
1  xul.dll  nsFlexContainerFrame::BuildDisplayList  layout/generic/nsFlexContainerFrame.cpp:3004

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2025-11-05
• Process type: Content
• Is startup crash: No
• Has user comments: No
• Is null crash: No

Comment 1

[Daniel Holbert [:dholbert]]

Triaging as S3, given that it's a release assert and hence seems like we're crashing safely at least.

(Roughly 1/10th of the crash reports have a nonzero "Possible bit flips max confidence", so at least some of this may be explainable by bad hardware, too...)