2039572 - Crash in [@ ServoComputedData::StyleDisplay]

Status: RESOLVED DUPLICATE of bug 2040170

(Core :: DOM: Animation, defect)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Not a new crash signature and relatively low volume: 30-60 crashes per release cycle but 74 crashes from 47 installs of Firefox 152.0a1.

Boris: Any insight why this is much more frequent for 152.0a1?

Crash report: https://crash-stats.mozilla.org/report/index/649c9a2e-6da0-4bf9-886b-fe0c80260514

Reason:

EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames:

0  xul.dll  ServoComputedData::StyleDisplay() const  layout/style/ServoComputedData.h:73
0  xul.dll  mozilla::ComputedStyle::StyleDisplay() const  layout/style/ComputedStyle.h:272
0  xul.dll  mozilla::dom::ScrollTimeline::FindNearestScroller(mozilla::dom::Element*, moz...  dom/animation/ScrollTimeline.cpp:139
1  xul.dll  mozilla::dom::ScrollTimeline::ScrollerInfo::Source() const  dom/animation/ScrollTimeline.cpp:419
2  xul.dll  mozilla::dom::ScrollTimeline::GetState() const  dom/animation/ScrollTimeline.h:212
3  xul.dll  mozilla::dom::KeyframeEffect::IsMatchForCompositor(nsCSSPropertyIDSet const&,...  dom/animation/KeyframeEffect.cpp:1984
4  xul.dll  mozilla::dom::KeyframeEffect::GetPropertiesForCompositor(mozilla::EffectSet&,...  dom/animation/KeyframeEffect.cpp:365
5  xul.dll  nsLayoutUtils::GetAnimationPropertiesForCompositor(nsIFrame const*)  layout/base/nsLayoutUtils.cpp:331
5  xul.dll  mozilla::RestyleManager::AddLayerChangesForAnimation::<lambda_19>::operator()...  layout/style/RestyleManager.cpp:1994
5  xul.dll  mozilla::FunctionRef<bool (const mozilla::Maybe<unsigned long long>&, Display...  mfbt/FunctionRef.h:179

Comment 1

[Hiroyuki Ikezoe (:hiro)]

In bug 2040170 FindNearestScroller is re-written in a way thatthe styleDisplay is not used. I hope it will fix this crash.

Comment 2

[Boris Chiou [:boris]]

We expect bug 2040170 will move this code. Let's wait for its landing.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:boris, could you have a look please?

For more information, please visit BugBot documentation.

Comment 4

[Boris Chiou [:boris]]

This should have been fixed together by Bug 2040170.

Comment 5

[Hiroyuki Ikezoe (:hiro)]

There's no crash report including FindNearestScroller since buildid: 20260519160612 : https://crash-stats.mozilla.org/search/?proto_signature=~FindNearestScroller&date=%3E%3D2026-04-26T22%3A05%3A00.000Z&date=%3C2026-05-26T22%3A05%3A00.000Z&_facets=signature&_sort=build_id&_sort=-date&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#crash-reports

Newer crash reports including StyleDisplay is unrelated to scroll driven animation, it's rather related content visibility stuff (and IntersectionObserver?).