2028900 - Crash in [@ stackoverflow | style::values::specified::calc::impl$10::parse::closure$0::closure$3]

Status: NEW

(Core :: CSS Parsing and Computation, defect, P3)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

129 crashes from 122 installs starting with Firefox 149.

Crash report: https://crash-stats.mozilla.org/report/index/8cfae27a-8678-4cb7-a821-ffada0260402

Reason:

EXCEPTION_STACK_OVERFLOW

Top 10 frames:

0  xul.dll  enum2$<style::values::generics::calc::GenericCalcNode<enum2$<style::values::s...  servo/components/style/values/specified/calc.rs:1044
1  xul.dll  enum2$<style::values::generics::calc::GenericCalcNode<enum2$<style::values::s...  servo/components/style/values/specified/calc.rs:992
2  xul.dll  style::values::specified::calc::impl$10::parse::closure$0::closure$3(style::v...  servo/components/style/values/specified/calc.rs:821
2  xul.dll  core::ops::function::impls::impl$4::call_once(style::values::specified::calc:...  /rustc/1159e78c4747b02ef996e55082b704c09b970588/library/core/src/ops/function.rs:313
2  xul.dll  cssparser::parser::Parser::parse_entirely(style::values::specified::calc::imp...  third_party/rust/cssparser/src/parser.rs:701
2  xul.dll  cssparser::parser::parse_until_before(cssparser::parser::Parser*, cssparser::...  third_party/rust/cssparser/src/parser.rs:1071
2  xul.dll  cssparser::parser::Parser::parse_until_before(cssparser::parser::Delimiters, ...  third_party/rust/cssparser/src/parser.rs:809
2  xul.dll  cssparser::parser::Parser::parse_comma_separated_internal(style::values::spec...  third_party/rust/cssparser/src/parser.rs:760
2  xul.dll  cssparser::parser::Parser::parse_comma_separated(style::values::specified::ca...  third_party/rust/cssparser/src/parser.rs:725
2  xul.dll  style::values::specified::calc::impl$10::parse::closure$0(style::values::spec...  servo/components/style/values/specified/calc.rs:820

Comment 1

[Emilio Cobos Álvarez [:emilio]]

So this is a legit stack overflow in one of the style threads because it's using a massively-nested calc()...

It seems all the URLs have https://www.facebook.com/reel/...

Comment 2

[Emilio Cobos Álvarez [:emilio]]

I pinged Facebook about it.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:alaskanemily, could you have a look please?

For more information, please visit BugBot documentation.

Comment 4

[Emilio Cobos Álvarez [:emilio]]

It's still happening but volume doesn't seem crazy.