2013351 - Hit MOZ_CRASH(index out of bounds: the len is 0 but the index is 0) at servo/components/style/invalidation/element/relative_selector.rs:387

Status: VERIFIED FIXED

(Core :: CSS Parsing and Computation, defect, P2)

Description

[Tyson Smith [:tsmith]]

Found with m-c 20260121-13d523d99ce5 (--enable-debug)

This was found by visiting a live website with a debug build.

STR:

• Launch browser and visit site

This issue was triggered by visiting https://www.sanko.ac.jp/sapporo-med/. A Pernosco session is available here: https://pernos.co/debug/BU1qelWcb7al2frqwL6SXg/index.html

Hit MOZ_CRASH(index out of bounds: the len is 0 but the index is 0) at servo/components/style/invalidation/element/relative_selector.rs:387

#0 0x7bffeee214f3 in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:237:3
#1 0x7bffeee214f3 in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:375:3
#2 0x7bffeee214f3 in RustMozCrash /builds/worker/checkouts/gecko/mozglue/static/rust/wrappers.cpp:18:3
#3 0x7bffebd4719f in mozglue_static::panic_hook::h568fcecec6100e1d /builds/worker/checkouts/gecko/mozglue/static/rust/lib.rs:99:9
#4 0x7bffebd46e85 in core::ops::function::Fn::call::h58d5c417aaf1e6ad /builds/worker/fetches/rust/library/core/src/ops/function.rs:80:5
#5 0x7bffec7b62f8 in std::panicking::rust_panic_with_hook::hb6a926246a3acc54 gkrust.6fa666699f2712df-cgu.0:0:0
#6 0x7bffec7ae957 in std::panicking::begin_panic_handler::_$u7b$$u7b$closure$u7d$$u7d$::haab11a240686a18f gkrust.6fa666699f2712df-cgu.0:0:0
#7 0x7bffec7ae8b8 in std::sys::backtrace::__rust_end_short_backtrace::h53ef5088042ca5e5 gkrust.6fa666699f2712df-cgu.0:0:0
#8 0x7bffec7b5b6b in __rustc::rust_begin_unwind gkrust.6fa666699f2712df-cgu.0:0:0
#9 0x7bffea3cb08e in core::panicking::panic_fmt::h1aef4e0b7c131909 gkrust.6fa666699f2712df-cgu.0:0:0
#10 0x7bffea3cb6cf in core::panicking::panic_bounds_check::h33b254976b458dc1 gkrust.6fa666699f2712df-cgu.0:0:0
#11 0x7bffecde9b0d in style::invalidation::element::relative_selector::invalidation_can_collapse::h1195ef75d316c799 /builds/worker/checkouts/gecko/servo/components/style/invalidation/element/relative_selector.rs:0:0
#12 0x7bffeb39c8c9 in style::invalidation::element::relative_selector::RelativeSelectorDependencyCollector$LT$E$GT$::insert_invalidation::_$u7b$$u7b$closure$u7d$$u7d$::h9bfbc3244b64a65e /builds/worker/checkouts/gecko/servo/components/style/invalidation/element/relative_selector.rs:455:13
#13 0x7bffeb39c8c9 in _$LT$core..slice..iter..IterMut$LT$T$GT$$u20$as$u20$core..iter..traits..iterator..Iterator$GT$::find::h5a141c560950e317 /builds/worker/fetches/rust/library/core/src/slice/iter/macros.rs:325:24
#14 0x7bffeb39c8c9 in style::invalidation::element::relative_selector::RelativeSelectorDependencyCollector$LT$E$GT$::insert_invalidation::hd7da6d5c2146a6eb /builds/worker/checkouts/gecko/servo/components/style/invalidation/element/relative_selector.rs:448:60
#15 0x7bffeb39c8c9 in style::invalidation::element::relative_selector::RelativeSelectorDependencyCollector$LT$E$GT$::add_dependency::h7dedcdbc0fd0fd3a /builds/worker/checkouts/gecko/servo/components/style/invalidation/element/relative_selector.rs:507:22
#16 0x7bffeb3b0613 in style::invalidation::element::relative_selector::RelativeSelectorDependencyCollector$LT$E$GT$::collect_all_dependencies_for_element::hc65756553f5f56c3 /builds/worker/checkouts/gecko/servo/components/style/invalidation/element/relative_selector.rs:718:18
#17 0x7bffeb3aa3d0 in style::invalidation::element::relative_selector::RelativeSelectorInvalidator$LT$E$GT$::invalidate_relative_selectors_for_dom_mutation::_$u7b$$u7b$closure$u7d$$u7d$::h1bc6cfe643fd0282 /builds/worker/checkouts/gecko/servo/components/style/invalidation/element/relative_selector.rs:796:23
#18 0x7bffeb3aa3d0 in style::stylist::Stylist::for_each_cascade_data_with_scope::hae86361d1cbd3543 /builds/worker/checkouts/gecko/servo/components/style/stylist.rs:1180:9
#19 0x7bffeb3aa3d0 in style::invalidation::element::relative_selector::RelativeSelectorInvalidator$LT$E$GT$::invalidate_relative_selectors_for_dom_mutation::h44f6d112aa396765 /builds/worker/checkouts/gecko/servo/components/style/invalidation/element/relative_selector.rs:789:17
#20 0x7bffeb59b382 in Servo_StyleSet_MaybeInvalidateRelativeSelectorForAppend /builds/worker/checkouts/gecko/servo/ports/geckolib/glue.rs:8307:21
#21 0x7bffe6109b1c in MaybeInvalidateForElementAppend /builds/worker/checkouts/gecko/layout/style/ServoStyleSet.cpp:1521:3
#22 0x7bffe6109b1c in mozilla::RestyleManager::ContentAppended(nsIContent*) /builds/worker/checkouts/gecko/layout/style/RestyleManager.cpp:103:15
#23 0x7bffe6297ea3 in mozilla::PresShell::ContentAppended(nsIContent*, ContentAppendInfo const&) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:4654:35
#24 0x7bffdf548b99 in operator() /builds/worker/checkouts/gecko/dom/base/MutationObservers.cpp:167:22
#25 0x7bffdf548b99 in Notify<(NotifyPresShell)2, (lambda at /builds/worker/checkouts/gecko/dom/base/MutationObservers.cpp:167:22)> /builds/worker/checkouts/gecko/dom/base/MutationObservers.cpp:99:7
#26 0x7bffdf548b99 in mozilla::dom::MutationObservers::NotifyContentAppended(nsIContent*, nsIContent*, ContentAppendInfo const&) /builds/worker/checkouts/gecko/dom/base/MutationObservers.cpp:167:3
#27 0x7bffdf75846d in nsINode::ReplaceOrInsertBefore(bool, nsINode*, nsINode*, MutationEffectOnScript, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/nsINode.cpp:3134:7
#28 0x7bffdff35152 in InsertBeforeInternal /builds/worker/checkouts/gecko/dom/base/nsINode.h:2397:12
#29 0x7bffdff35152 in AppendChildInternal /builds/worker/checkouts/gecko/dom/base/nsINode.h:2411:12
#30 0x7bffdff35152 in AppendChild /builds/worker/checkouts/gecko/dom/base/nsINode.h:2405:12
#31 0x7bffdff35152 in mozilla::dom::Node_Binding::appendChild(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/./NodeBinding.cpp:950:60
#32 0x7bffe12520a0 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3306:13
#33 0x7bffe926badd in CallJSNative /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:490:13
#34 0x7bffe926badd in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:586:12
#35 0x7bffe9288a8f in InternalCall /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:653:10
#36 0x7bffe9288a8f in CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:658:10
#37 0x7bffe9288a8f in js::Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3272:16
#38 0x7bffe926a8f6 in MaybeEnterInterpreterTrampoline /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:384:10
#39 0x7bffe926a8f6 in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:460:13
#40 0x7bffe926bc57 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:618:13
#41 0x7bffe926d764 in InternalCall /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:653:10
#42 0x7bffe926d764 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:685:8
#43 0x7bffe96b4ad4 in js::fun_call(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/js/src/vm/JSFunction.cpp:1105:10
#44 0x7bffe926badd in CallJSNative /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:490:13
#45 0x7bffe926badd in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:586:12
#46 0x7bffe9288a8f in InternalCall /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:653:10
#47 0x7bffe9288a8f in CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:658:10
#48 0x7bffe9288a8f in js::Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3272:16
#49 0x7bffe926a8f6 in MaybeEnterInterpreterTrampoline /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:384:10
#50 0x7bffe926a8f6 in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:460:13
#51 0x7bffe926fabc in js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JS::Handle<JSObject*>, js::AbstractFramePtr, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:850:10
#52 0x7bffe95cc911 in JS_ExecuteScript(JSContext*, JS::Handle<JSScript*>) /builds/worker/checkouts/gecko/js/src/vm/CompilationAndEvaluation.cpp:572:10
#53 0x7bffe55e1bea in ExecuteCompiledScript /builds/worker/checkouts/gecko/dom/script/ScriptLoader.cpp:2985:8
#54 0x7bffe55e1bea in mozilla::dom::ScriptLoader::EvaluateScript(nsIGlobalObject*, JS::loader::ScriptLoadRequest*) /builds/worker/checkouts/gecko/dom/script/ScriptLoader.cpp:3573:5
#55 0x7bffe55e0396 in mozilla::dom::ScriptLoader::EvaluateScriptElement(JS::loader::ScriptLoadRequest*) /builds/worker/checkouts/gecko/dom/script/ScriptLoader.cpp:3089:10
#56 0x7bffe55d974f in mozilla::dom::ScriptLoader::ProcessRequest(JS::loader::ScriptLoadRequest*) /builds/worker/checkouts/gecko/dom/script/ScriptLoader.cpp:2514:17
#57 0x7bffe55daf5d in mozilla::dom::ScriptLoader::CompileOffThreadOrProcessRequest(JS::loader::ScriptLoadRequest*) /builds/worker/checkouts/gecko/dom/script/ScriptLoader.cpp:1938:10
#58 0x7bffe55b41fa in mozilla::dom::ScriptLoader::ProcessPendingRequests(bool) /builds/worker/checkouts/gecko/dom/script/ScriptLoader.cpp:3979:7
#59 0x7bffe55df8b6 in mozilla::dom::ScriptLoader::ProcessOffThreadRequest(JS::loader::ScriptLoadRequest*) /builds/worker/checkouts/gecko/dom/script/ScriptLoader.cpp:2456:3
#60 0x7bffe55f891b in mozilla::dom::(anonymous namespace)::OffThreadCompilationCompleteTask::Run() /builds/worker/checkouts/gecko/dom/script/ScriptLoader.cpp:1991:20
#61 0x7bffdb7ed31b in mozilla::TaskController::RunTask(mozilla::Task*) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:196:19
#62 0x7bffdb7f461d in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:1325:20
#63 0x7bffdb7f20f8 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:1148:15
#64 0x7bffdb7f2aae in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:641:36
#65 0x7bffdb80c264 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:336:37
#66 0x7bffdb80c264 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_1>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:549:5
#67 0x7bffdb82d9ca in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1164:16
#68 0x7bffdb838898 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:461:10
#69 0x7bffdcd665f6 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:107:5
#70 0x7bffdcc6f444 in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:368:10
#71 0x7bffdcc6f444 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:361:3
#72 0x7bffdcc6f444 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:343:3
#73 0x7bffe5a6f686 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:152:27
#74 0x7bffe5c506cb in nsAppShell::Run() /builds/worker/checkouts/gecko/widget/gtk/nsAppShell.cpp:555:33
#75 0x7bffe7c49aad in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:656:20
#76 0x7bffdcc6f444 in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:368:10
#77 0x7bffdcc6f444 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:361:3
#78 0x7bffdcc6f444 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:343:3
#79 0x7bffe7c48a58 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:594:34
#80 0x5555556fa979 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:465:22

Comment 1

[Emilio Cobos Álvarez [:emilio]]

Scope / relative selector invalidation, crashes on release builds... Can you take a look David?

Comment 2

[David Shin[:dshin]]

Attachment: Bug 2013351: Don't crash trying to collapse :has() invalidations in @scope with empty rules. r=#style

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/bab4a2cae152
https://hg.mozilla.org/integration/autoland/rev/4b3bff586d94
Don't crash trying to collapse :has() invalidations in @scope with empty rules. r=firefox-style-system-reviewers,emilio

Comment 4

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/57634 for changes under testing/web-platform/tests

Comment 5

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/4b3bff586d94

Comment 6

[Donal Meehan [:dmeehan]]

:dshin, do you want to consider a beta uplift request for Fx148, or should this ride the train with Fx149?

Comment 7

[David Shin[:dshin]]

Given that it causes crash on release build, yes. Uplift request filed.

Comment 8

[Phabricator Automation]

firefox-beta Uplift Approval Request

• User impact if declined: In-the-wild website crash.
• Code covered by automated testing: yes
• Fix verified in Nightly: no
• Needs manual QE test: yes
• Steps to reproduce for manual QE testing: (Today's Nightly isn't available yet, it seems, but verified on local build)
  Visit https://www.sanko.ac.jp/sapporo-med, ensure no crash.
• Risk associated with taking this patch: low
• Explanation of risk level: Small fix handling a specific case
• String changes made/needed: No
• Is Android affected?: yes

Comment 9

[David Shin[:dshin]]

Attachment: Bug 2013351: Don't crash trying to collapse :has() invalidations in @scope with empty rules.

Original Revision: https://phabricator.services.mozilla.com/D282213

Comment 10

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/cecb23ccecb5
https://hg.mozilla.org/releases/mozilla-beta/rev/54fc010e1ede

Comment 11

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot

Comment 12

[Monica Chiorean]

I was able to reproduce the issue on Win11x64 using Firefox builds: 148.0b11/148.0b12 and 147.0.3, I got the crash(https://crash-stats.mozilla.org/report/index/aee03d00-35d2-4e7b-ba8a-5c4440260209) when accessing link https://www.sanko.ac.jp/sapporo-med/.
Verified as fixed on Win11x64 using Firefox build 149.0a1(20260209095905).
Waiting for next beta to confirm the fix.

Comment 13

[Monica Chiorean]

Verified as fixed on Win11x64 using Firefox build 148.0b13.