2058181 - www.cerave.pt - Tab crashes during navigation across product pages

Status: RESOLVED FIXED

(Core :: Layout: Grid, defect, P2)

Description

[Bernadett Farkas]

Environment:
Operating system: Windows 10
Firefox version: Firefox 153.0 / Firefox Nightly 155.0a1 (2026-07-27)

Steps to reproduce:

1. Access: https://www.cerave.pt/
2. Select different products
3. Scroll down the page to view the product information
4. Observe the page

Expected Behavior:
The product pages load accordingly

Actual Behavior:
Tab crashes during navigation across product pages

Notes:

• Reproduces regardless of the status of ETP
• Reproduces in firefox-nightly, and firefox-release
• Does not reproduce in chrome

Created from https://github.com/webcompat/web-bugs/issues/229678

Comment 1

[Bernadett Farkas]

Attachment: Crash Nightly vs Chrome

Comment 2

[BugBot [:suhaib / :marco]]

Since nightly and release are affected, beta will likely be affected too.
For more information, please visit BugBot documentation.

Comment 3

[Sky Schubert [:skyschub]]

Bernadett, I can't reproduce this, and what you show in the screen recording looks like a severe performance issue. Can you capture a profile?

Comment 4

[Alice0775 White]

Crash with Firefox 154.0b3
bp-08ef59df-abfa-4a7c-a244-fc38a0260728

Comment 5

[Alice0775 White]

Crash bp-6e176b91-b589-46bb-8521-2673a0260728
about:logging https://share.firefox.dev/3RiVoJf

Comment 6

[Bernadett Farkas]

Hi Sky,
https://share.firefox.dev/4hFEYFe

Comment 7

[Sky Schubert [:skyschub]]

The crashes look like OOM'ing in layout, so let's have the layout team have a look. I can't reproduce this?

Comment 8

[Daniel Holbert [:dholbert]]

FWIW I can't reproduce either.

Alice0775's crash reports show us OOM'ing in ExpandNonRepeatAutoTracks which is here:
https://searchfox.org/firefox-main/rev/2c35ff84ed7d1ca088a41f830bfab0be50868536/layout/generic/nsGridContainerFrame.cpp#1849-1851

// Store mTrackListValues into mExpandedTracks with `repeat(INTEGER, ...)`
// tracks expanded.
void ExpandNonRepeatAutoTracks() {

Based on that, it seems like this would happen if the site were asking for an absurd number of repeated grid tracks, and we're explicitly allocating space for them, when instead we could be collapsing them into a compact representation as proposed in bug 1752237. So for now I'm triaging as dependent on that platform bug.

(bp-08ef59df-abfa-4a7c-a244-fc38a0260728 shows OOM Allocation Size: 2,208,301,056 bytes (2.21 GB) which I think means that's how much space we thought we needed for this array-of-tracks, which would be a massive number of tracks...)

Perusing the site's CSS for repeat() expressions, I'm not finding any cases with an absurd number of repeated tracks, though - everything looks like it's single-digits number of repeats. I wonder if this was a brief mistake that the site has corrected. Alice0775 & Bernadett, can you still reproduce? If so, I wonder if you're able to come up with a reduced testcase that reliably triggers the crash, maybe starting with the SingleFile extension in Chrome to produce a standalone html testcase that might crash in Firefox and can be chipped away at to reduce it?

Comment 9

[Alice0775 White]

I can reproduce the crash on Nightly156.0a1 Build ID 20260825090428.
bp-8937adea-4f49-41d8-87bb-ab4390260825
bp-dfdb78e5-8379-469c-9e42-aecc20260825

Comment 10

[Alice0775 White]

STR:

1. Open https://www.cerave.pt/todos-os-produtos/locao-facial-hidratante
2. Click Aceitar todos os cookies if any
3. Click x button of SUBSCREVA A NOSSA NEWSLETTER!
4. Mouse hover navigation menu such as PRODUTOS SOBRE CERAVE ...

Regression window:
https://hg-edge.mozilla.org/integration/autoland/pushloghtml?fromchange=55931b4d2f4bfbe49194a948c289262bd9221e4c&tochange=75a370cf4d9816ef738c4397c52cda04c19ed838

Comment 11

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 2038512

Comment 12

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 2038512

Comment 13

[Emilio Cobos Álvarez [:emilio]]

Style of the crashing grid:

  Rules(None):
    [--columns: 1, --rows: 2147483647] - CascadePriority { cascade_level: CascadeLevel(3), flags: RuleCascadeFlags(0x0), layer_order: LayerOrder(65535) }
    [display: grid, grid-template-columns: repeat(var(--columns),auto), grid-template-rows: repeat(var(--rows),auto), align-content: flex-start, text-align: left, row-gap: 0px, column-gap: 3.125rem] - CascadePriority { cascade_level: CascadeLevel(3), flags: RuleCascadeFlags(0x0), layer_order: LayerOrder(65534) }
    [--columns: 2, --rows: 6] - CascadePriority { cascade_level: CascadeLevel(3), flags: RuleCascadeFlags(0x0), layer_order: LayerOrder(65534) }
    [margin-top: 0px, margin-right: 0px, margin-bottom: 0px, margin-left: 0px] - CascadePriority { cascade_level: CascadeLevel(3), flags: RuleCascadeFlags(0x0), layer_order: LayerOrder(65534) }
    [padding-top: 0px, padding-right: 0px, padding-bottom: 0px, padding-left: 0px] - CascadePriority { cascade_level: CascadeLevel(3), flags: RuleCascadeFlags(0x0), layer_order: LayerOrder(65534) }
    [list-style-position: outside, list-style-image: none, list-style-type: none, margin-top: 0px, margin-right: 0px, margin-bottom: 0px, margin-left: 0px] - CascadePriority { cascade_level: CascadeLevel(3), flags: RuleCascadeFlags(0x0), layer_order: LayerOrder(65534) }
    [box-sizing: border-box] - CascadePriority { cascade_level: CascadeLevel(3), flags: RuleCascadeFlags(0x0), layer_order: LayerOrder(65534) }
    [list-style-type: circle] - CascadePriority { cascade_level: CascadeLevel(0), flags: RuleCascadeFlags(0x0), layer_order: LayerOrder(65534) }
    [margin-block-start: 0px, margin-block-end: 0px] - CascadePriority { cascade_level: CascadeLevel(0), flags: RuleCascadeFlags(0x0), layer_order: LayerOrder(65534) }
    [counter-reset: list-item 0] - CascadePriority { cascade_level: CascadeLevel(0), flags: RuleCascadeFlags(0x0), layer_order: LayerOrder(65534) }
    [display: block, list-style-type: disc, margin-block-start: 1em, margin-block-end: 1em, padding-inline-start: 40px] - CascadePriority { cascade_level: CascadeLevel(0), flags: RuleCascadeFlags(0x0), layer_order: LayerOrder(65534) }
    [unicode-bidi: isolate] - CascadePriority { cascade_level: CascadeLevel(0), flags: RuleCascadeFlags(0x0), layer_order: LayerOrder(65534) }

I think fix should be trivial-ish.

Comment 14

[BMO Github Automation]

Attachment: [mozilla-firefox/firefox] Bug 2058181 - More carefully clamp grid tracks. r=#layout (#352)

Comment 15

[Emilio Cobos Álvarez [:emilio]]

Attachment: Bug 2058181 - More carefully clamp grid tracks. r=#layout

Comment 16

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/a7bca7e4b37e
https://hg.mozilla.org/integration/autoland/rev/e1119d476478
More carefully clamp grid tracks. r=dshin

Comment 17

[amarc]

Backed out for causing mass failures

• Backout link
• Push with failures
• Failure Log
• Failure Log 2

Comment 18

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/705acae078ed
https://hg.mozilla.org/mozilla-central/rev/bcb199ce9ddc
Revert "Bug 2058181 - More carefully clamp grid tracks. r=dshin" for causing mass failures

Comment 19

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/80f2e18d380e
https://hg.mozilla.org/integration/autoland/rev/f899a8c67c31
More carefully clamp grid tracks. r=dshin,dholbert

Comment 20

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/09e5fdd55c6d
https://hg.mozilla.org/integration/autoland/rev/d7dd07ee2ce2
Fix repeat auto edge case handling.

Comment 21

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/f899a8c67c31
https://hg.mozilla.org/mozilla-central/rev/d7dd07ee2ce2

Comment 22

[BugBot [:suhaib / :marco]]

The patch landed in nightly and beta is affected, along with ESR.
:emilio, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta and ESR approvals.
  • See https://wiki.mozilla.org/Release_Management/Requesting_an_Uplift for documentation on how to request an uplift.
• If no, please set status-firefox156 and the ESR status flag(s) to wontfix.

For more information, please visit BugBot documentation.

Comment 23

[Emilio Cobos Álvarez [:emilio]]

Attachment: Bug 2058181 - More carefully clamp grid tracks.

Comment 24

[Phabricator Automation]

firefox-beta Uplift Approval Request

• User impact if declined/Reason for urgency: OOM crash reachable from website
• Code covered by automated testing?: yes
• Fix verified in Nightly?: yes
• Needs manual QE testing?: yes
• Steps to reproduce for manual QE testing: comment 10
• Risk associated with taking this patch: low
• Explanation of risk level: relatively well tested codepath, and edge case behavior anyway.
• String changes made/needed?: none
• Is Android affected?: yes

Comment 25

[Phabricator Automation]

firefox-esr153 Uplift Approval Request

• User impact if declined/Reason for urgency: OOM crash reachable from website
• Code covered by automated testing?: yes
• Fix verified in Nightly?: yes
• Needs manual QE testing?: yes
• Steps to reproduce for manual QE testing: comment 10
• Risk associated with taking this patch: low
• Explanation of risk level: relatively well tested codepath, and edge case behavior anyway.
• String changes made/needed?: none
• Is Android affected?: yes

Comment 26

[Emilio Cobos Álvarez [:emilio]]

Attachment: Bug 2058181 - More carefully clamp grid tracks.

Comment 27

[Monica Chiorean]

I was able to reproduce the crash(https://crash-stats.mozilla.org/report/index/3ae905fd-4144-4362-beee-ff5720260902) on Win11x64 using Firefox build 154.0b1(20260722090302).
Verified as fixed on Win11x64/Mac 15.5 using Firefox build 157.0a1. Waiting for beta.

Comment 28

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/62396 for changes under testing/web-platform/tests

Comment 29

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/42002f7b66c9
https://hg.mozilla.org/releases/mozilla-beta/rev/574e908c8e59

Comment 30

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr153/rev/6540ac7f1948

Comment 31

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot