2028622 - Crash in [@ style::stylist::scope_root_candidates]

Status: RESOLVED FIXED

(Core :: CSS Parsing and Computation, defect)

Description

[andrew]

Crash report: https://crash-stats.mozilla.org/report/index/e6e9a730-235f-45e5-b7e4-45c210260401

Reason:

SIGSEGV / SEGV_ACCERR

Top 10 frames:

0  libxul.so  style::stylist::scope_root_candidates  servo/components/style/stylist.rs:0
1  libxul.so  style::stylist::scope_root_candidates  servo/components/style/stylist.rs:2941
2  libxul.so  style::stylist::scope_root_candidates  servo/components/style/stylist.rs:2941
3  libxul.so  style::stylist::scope_root_candidates  servo/components/style/stylist.rs:2941
4  libxul.so  style::stylist::scope_root_candidates  servo/components/style/stylist.rs:2941
5  libxul.so  style::stylist::scope_root_candidates  servo/components/style/stylist.rs:2941
6  libxul.so  style::stylist::scope_root_candidates  servo/components/style/stylist.rs:2941
7  libxul.so  style::stylist::scope_root_candidates  servo/components/style/stylist.rs:2941
8  libxul.so  style::stylist::scope_root_candidates  servo/components/style/stylist.rs:2941
9  libxul.so  style::stylist::scope_root_candidates  servo/components/style/stylist.rs:2941

Comment 1

[BugBot [:suhaib / :marco]]

The severity field is not set for this bug.
:royang, could you have a look please?

For more information, please visit BugBot documentation.

Comment 2

[Roger Yang [:royang]]

Move to GV to take a look, since this is libxul related.

Comment 3

[Roger Yang [:royang]]

Moving to Core since this is a libxul issue.

Comment 4

[BugBot [:suhaib / :marco]]

The Bugbug bot thinks this bug should belong to the 'Core::CSS Parsing and Computation' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 5

[Jonathan Kew [:jfkthame]]

Looks like scope_root_candidates() is infinitely recursing. (Could there somehow be a condition that is its own parent?)

Comment 6

[David Shin[:dshin]]

(@scope related, re-linking. "Scope" feels overloaded these days...)
... huh, that is weird. Would be really curious what led to this...

Comment 7

[Jonathan Kew [:jfkthame]]

Hah, yeah.... too many scopes, thanks for correcting that.

Knowing nothing about this code, I wondered if we should add a check for condition_ref.parent == id before recursing, or something like that? Maybe with an assertion, and see if the fuzzers can find a way to hit it.

Comment 8

[David Shin[:dshin]]

Attachment: Bug 2028622: Graceful handling of @scope rule overflow/infinite recursion. r=#style

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/254e1f5db2de
https://hg.mozilla.org/integration/autoland/rev/69b41893fe38
Graceful handling of @scope rule overflow/infinite recursion. r=firefox-style-system-reviewers,emilio

Comment 10

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/69b41893fe38