2085217 - Hit MOZ_CRASH(Trying to collect rules for a detached pseudo-element) at servo/components/style/dom.rs:799

Status: VERIFIED FIXED

(Core :: CSS Parsing and Computation, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found with m-c 20261022-da9645630220 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Hit MOZ_CRASH(Trying to collect rules for a detached pseudo-element) at servo/components/style/dom.rs:799

#0 0x76fdc78408a8 in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:261:3
#1 0x76fdc78408a8 in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:402:3
#2 0x76fdc78408a8 in RustMozCrash /builds/worker/checkouts/gecko/mozglue/static/rust/wrappers.cpp:17:3
#3 0x76fdc783fe2b in mozglue_static::panic_hook /builds/worker/checkouts/gecko/mozglue/static/rust/lib.rs:99:9
#4 0x76fdc7840805 in <mozglue_static::panic_hook as core::ops::function::Fn<(&std::panic::PanicHookInfo,)>>::call /builds/worker/fetches/rust/library/core/src/ops/function.rs:79:5
#5 0x76fdcbfe5281 in std::panicking::panic_with_hook std.8af3bd109c3ae499-cgu.0:0:0
#6 0x76fdcbfd0ec7 in std::panicking::panic_handler::{closure#0} std.8af3bd109c3ae499-cgu.0:0:0
#7 0x76fdcbfc8428 in std::sys::backtrace::__rust_end_short_backtrace::<std::panicking::panic_handler::{closure#0}, !> std.8af3bd109c3ae499-cgu.0:0:0
#8 0x76fdcbfd1b0c in __rustc::rust_begin_unwind std.8af3bd109c3ae499-cgu.0:0:0
#9 0x76fdcc008d5b in core::panicking::panic_fmt core.7ee0c8296a1d0ca5-cgu.0:0:0
#10 0x76fdcc008ab3 in core::option::expect_failed core.7ee0c8296a1d0ca5-cgu.0:0:0
#11 0x76fdcac7dcd0 in <core::option::Option<style::gecko::wrapper::GeckoElement>>::expect /builds/worker/fetches/rust/library/core/src/option.rs:971:21
#12 0x76fdcac7dcd0 in <style::gecko::wrapper::GeckoElement as style::dom::TElement>::ultimate_originating_element /builds/worker/checkouts/gecko/servo/components/style/dom.rs:799:18
#13 0x76fdca7bd73d in <style::gecko::wrapper::GeckoElement as style::dom::TElement>::each_applicable_non_document_style_rule_data::<<style::stylist::Stylist>::for_each_cascade_data_with_scope<style::gecko::wrapper::GeckoElement, <style::invalidation::element::relative_selector::RelativeSelectorInvalidator<style::gecko::wrapper::GeckoElement>>::invalidate_relative_selectors_for_this<geckoservo::glue::process_relative_selector_invalidations::{closure#0}>::{closure#0}>::{closure#0}> /builds/worker/checkouts/gecko/servo/components/style/dom.rs:821:27
#14 0x76fdca7bd73d in <style::stylist::Stylist>::for_each_cascade_data_with_scope::<style::gecko::wrapper::GeckoElement, <style::invalidation::element::relative_selector::RelativeSelectorInvalidator<style::gecko::wrapper::GeckoElement>>::invalidate_relative_selectors_for_this<geckoservo::glue::process_relative_selector_invalidations::{closure#0}>::{closure#0}> /builds/worker/checkouts/gecko/servo/components/style/stylist.rs:1229:17
#15 0x76fdca7bd73d in <style::invalidation::element::relative_selector::RelativeSelectorInvalidator<style::gecko::wrapper::GeckoElement>>::invalidate_relative_selectors_for_this::<geckoservo::glue::process_relative_selector_invalidations::{closure#0}> /builds/worker/checkouts/gecko/servo/components/style/invalidation/element/relative_selector.rs:741:17
#16 0x76fdca715abb in geckoservo::glue::process_relative_selector_invalidations /builds/worker/checkouts/gecko/servo/ports/geckolib/glue.rs:9305:17
#17 0x76fdca715abb in Servo_ProcessInvalidations /builds/worker/checkouts/gecko/servo/ports/geckolib/glue.rs:9373:5
#18 0x76fdbda250fb in mozilla::RestyleManager::ProcessAllPendingAttributeAndStateInvalidations() /builds/worker/workspace/obj-build/layout/style/./../../../../checkouts/gecko/layout/style/RestyleManager.cpp:3435:7
#19 0x76fdbda7a886 in ElementNeedsRestyle(mozilla::dom::Element*, mozilla::PseudoStyleRequest const&, bool) /builds/worker/workspace/obj-build/layout/style/./../../../../checkouts/gecko/layout/style/nsComputedDOMStyle.cpp:139:19
#20 0x76fdbda7a415 in nsComputedDOMStyle::NeedsToFlushStyle(NonCustomCSSPropertyId) const /builds/worker/workspace/obj-build/layout/style/./../../../../checkouts/gecko/layout/style/nsComputedDOMStyle.cpp:858:7
#21 0x76fdbda77f14 in nsComputedDOMStyle::UpdateCurrentStyleSources(NonCustomCSSPropertyId) /builds/worker/workspace/obj-build/layout/style/./../../../../checkouts/gecko/layout/style/nsComputedDOMStyle.cpp:1058:7
#22 0x76fdbda76d3a in nsComputedDOMStyle::GetPropertyValue(NonCustomCSSPropertyId, nsTSubstring<char> const&, nsTSubstring<char>&) /builds/worker/workspace/obj-build/layout/style/./../../../../checkouts/gecko/layout/style/nsComputedDOMStyle.cpp:438:3
#23 0x76fdb7673256 in mozilla::dom::CSSStyleDeclaration_Binding::getPropertyValue(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/./CSSStyleDeclarationBinding.cpp:331:24
#24 0x76fdb7d4669d in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/obj-build/dom/bindings/./../../../../checkouts/gecko/dom/bindings/BindingUtils.cpp:3212:13
#25 0x76fdc1787cda in CallJSNative /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:539:13
#26 0x76fdc1787cda in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:637:12
#27 0x76fdc17a4953 in InternalCall /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:704:10
#28 0x76fdc17a4953 in CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:709:10
#29 0x76fdc17a4953 in js::Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3292:16
#30 0x76fdc1786bd4 in MaybeEnterInterpreterTrampoline /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:422:10
#31 0x76fdc1786bd4 in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:501:13
#32 0x76fdc178bcbc in js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JS::Handle<JSObject*>, js::AbstractFramePtr, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:902:10
#33 0x76fdc1b08338 in ExecuteScript(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSScript*>, JS::MutableHandle<JS::Value>) /builds/worker/workspace/obj-build/js/src/vm/./../../../../../checkouts/gecko/js/src/vm/CompilationAndEvaluation.cpp:544:10
#34 0x76fdc1b08631 in JS_ExecuteScript(JSContext*, JS::Handle<JSScript*>) /builds/worker/workspace/obj-build/js/src/vm/./../../../../../checkouts/gecko/js/src/vm/CompilationAndEvaluation.cpp:568:10
#35 0x76fdbcde6ac1 in ExecuteCompiledScript /builds/worker/workspace/obj-build/dom/script/./../../../../checkouts/gecko/dom/script/ScriptLoader.cpp:3564:8
#36 0x76fdbcde6ac1 in mozilla::dom::ScriptLoader::EvaluateScript(nsIGlobalObject*, JS::loader::ScriptLoadRequest*) /builds/worker/workspace/obj-build/dom/script/./../../../../checkouts/gecko/dom/script/ScriptLoader.cpp:4265:5
#37 0x76fdbcde51eb in mozilla::dom::ScriptLoader::EvaluateScriptElement(JS::loader::ScriptLoadRequest*) /builds/worker/workspace/obj-build/dom/script/./../../../../checkouts/gecko/dom/script/ScriptLoader.cpp:3673:10
#38 0x76fdbcddb9df in mozilla::dom::ScriptLoader::ProcessRequest(JS::loader::ScriptLoadRequest*) /builds/worker/workspace/obj-build/dom/script/./../../../../checkouts/gecko/dom/script/ScriptLoader.cpp:3019:17
#39 0x76fdbcdd833b in mozilla::dom::ScriptLoader::ProcessInlineScript(nsIScriptElement*, JS::loader::ScriptKind, nsTSubstring<char16_t> const&) /builds/worker/workspace/obj-build/dom/script/./../../../../checkouts/gecko/dom/script/ScriptLoader.cpp:2085:10
#40 0x76fdbcdba9b5 in mozilla::dom::ScriptLoader::ProcessScriptElement(nsIScriptElement*, nsTSubstring<char16_t> const&) /builds/worker/workspace/obj-build/dom/script/./../../../../checkouts/gecko/dom/script/ScriptLoader.cpp:1535:10
#41 0x76fdbcdb9dcd in mozilla::dom::ScriptElement::MaybeProcessScript(nsTSubstring<char16_t> const&) /builds/worker/workspace/obj-build/dom/script/./../../../../checkouts/gecko/dom/script/ScriptElement.cpp:328:18
#42 0x76fdbcdb8fb6 in mozilla::dom::ScriptElement::MaybeProcessScript(nsCOMPtr<nsIParser>) /builds/worker/workspace/obj-build/dom/script/./../../../../checkouts/gecko/dom/script/ScriptElement.cpp:196:18
#43 0x76fdbcdfcdea in nsIScriptElement::AttemptToExecute(nsCOMPtr<nsIParser>) /builds/worker/workspace/obj-build/dom/script/./../../../../checkouts/gecko/dom/script/nsIScriptElement.cpp:75:16
#44 0x76fdb35eff38 in nsHtml5TreeOpExecutor::RunScript(nsIContent*, bool) /builds/worker/workspace/obj-build/parser/html/./../../../../checkouts/gecko/parser/html/nsHtml5TreeOpExecutor.cpp:1011:22
#45 0x76fdb35ea14c in nsHtml5TreeOpExecutor::RunFlushLoop() /builds/worker/workspace/obj-build/parser/html/./../../../../checkouts/gecko/parser/html/nsHtml5TreeOpExecutor.cpp:786:7
#46 0x76fdb35f5849 in nsHtml5ExecutorFlusher::Run() /builds/worker/workspace/obj-build/parser/html/./../../../../checkouts/gecko/parser/html/nsHtml5StreamParser.cpp:170:18
#47 0x76fdb2a8d0da in mozilla::RunnableTask::Run() /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:756:16
#48 0x76fdb2a6bdb0 in mozilla::TaskController::RunTask(mozilla::Task*) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:211:19
#49 0x76fdb2a7338d in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:1401:20
#50 0x76fdb2a70df5 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:1221:15
#51 0x76fdb2a713f6 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:692:36
#52 0x76fdb2a8b4d1 in operator() /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:380:37
#53 0x76fdb2a8b4d1 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:535:5
#54 0x76fdb2ab2d20 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/nsThread.cpp:1319:16
#55 0x76fdb2abcd99 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:471:32
#56 0x76fdb2cfad4e in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessagePump.cpp:83:21
#57 0x76fdb2bd0974 in RunInternal /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:378:10
#58 0x76fdb2bd0974 in RunHandler /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:371:3
#59 0x76fdb2bd0974 in MessageLoop::Run() /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:353:3
#60 0x76fdbd2e2bb6 in nsBaseAppShell::Run() /builds/worker/workspace/obj-build/widget/./../../../checkouts/gecko/widget/nsBaseAppShell.cpp:151:27
#61 0x76fdbd5088ab in nsAppShell::Run() /builds/worker/workspace/obj-build/widget/gtk/./../../../../checkouts/gecko/widget/gtk/nsAppShell.cpp:581:33
#62 0x76fdbf7f42dd in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:644:20
#63 0x76fdb2bd0974 in RunInternal /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:378:10
#64 0x76fdb2bd0974 in RunHandler /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:371:3
#65 0x76fdb2bd0974 in MessageLoop::Run() /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:353:3
#66 0x76fdbf7f30c3 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:582:34
#67 0x59b42a71373d in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:469:22

Comment 1

[Boris Chiou [:boris]]

The test uses :has(*) so I guess it may be related to it.

Comment 2

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20261023040917-f1c11bab7850.
The bug appears to have been introduced in the following build range:

Start: 1c2078da721b13d43a61dee1f43b0ce05065340a (20260515142707)
End: faf458b597380a1ad140f607d5581577ed11327f (20260515164314)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=1c2078da721b13d43a61dee1f43b0ce05065340a&tochange=faf458b597380a1ad140f607d5581577ed11327f

Comment 3

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 2039857

:emilio, since you are the author of the regressor, bug 2039857, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 4

[Emilio Cobos Álvarez [:emilio]]

The minimized / commented test-case was amazing Tyson, thanks!

Comment 5

[Emilio Cobos Álvarez [:emilio]]

Attachment: Bug 2085217 - Clear snapshot flags in the unbind path. r=#style

This matches GeckoElement::clear_data.

In the past (before :has) these flags wouldn't be set at all on elements
that have no data.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/aed653c37863
https://hg.mozilla.org/integration/autoland/rev/9f0db15915bc
Clear snapshot flags in the unbind path. r=firefox-style-system-reviewers,dshin

Comment 7

[Atila Butkovits]

https://hg.mozilla.org/mozilla-central/rev/9f0db15915bc

Comment 8

[BugBot [:suhaib / :marco]]

The patch landed in nightly and ESR is affected.

:emilio, please make an uplift decision for ESR:

• For ESR, nominate the patch for the appropriate ESR uplift approval if the fix should be included in ESR, or set the ESR status flag(s) to wontfix if an uplift isn't needed. Each affected ESR release needs a decision.

See Requesting an Uplift for documentation on how to request an uplift.

For more information, please visit BugBot documentation.

Comment 9

[Emilio Cobos Álvarez [:emilio]]

I don't think current crash volume justifies uplift.

Comment 10

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20261027091753-d707487029a4.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 11

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/64282 for changes under testing/web-platform/tests

Comment 12

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot