[tor-bugs] #21962 [Applications/Tor Browser]: Segmentation fault with "high" security when changing in about:addons to "Extensions" or "Appearance"

[Tor Bug Tracker & Wiki]

#21962: Segmentation fault with "high" security when changing in about:addons to
"Extensions" or "Appearance"
-------------------------------------------------+-------------------------
 Reporter:  viktorj                              |          Owner:
                                                 |  arthuredelstein
     Type:  defect                               |         Status:
                                                 |  accepted
 Priority:  Very High                            |      Milestone:
Component:  Applications/Tor Browser             |        Version:
 Severity:  Major                                |     Resolution:
 Keywords:  tbb-crash, tbb-usability, ff52-esr,  |  Actual Points:
  tbb-7.0-must-alpha, TorBrowserTeam201704       |
Parent ID:                                       |         Points:
 Reviewer:                                       |        Sponsor:
                                                 |  Sponsor4
-------------------------------------------------+-------------------------

Comment (by gk):

 FWIW: This is not e10s related. We are crashing somewhere in CSS code:
 {{{
 #0  nsAttrValue::Contains (this=this at entry=0xa5a5a5a5a5a5a5a5,
     aValue=0x7fffc869cb80, aCaseSensitive=eCaseMatters)
     at /home/debian/build/tor-browser/dom/base/nsAttrValue.cpp:1163
 #1  0x00007ffff3a0024b in SelectorMatches (aElement=0x7fffc407d600,
     aSelector=0x7fffd708e460, aNodeMatchContext=...,
 aTreeMatchContext=...,
     aSelectorFlags=aSelectorFlags at entry=SelectorMatchesFlags::NONE,
     aDependence=0x0, this=<optimized out>)
     at /home/debian/build/tor-
 browser/layout/style/nsCSSRuleProcessor.cpp:1723
 #2  0x00007ffff3a00d21 in SelectorMatches
 (aElement=aElement at entry=0x7fffc407d600,
     aSelector=aSelector at entry=0x7fffd708e460, aNodeMatchContext=...,
     aTreeMatchContext=...,
     aSelectorFlags=aSelectorFlags at entry=SelectorMatchesFlags::NONE,
     aDependence=aDependence at entry=0x0, this=<optimized out>)
     at /home/debian/build/tor-
 browser/layout/style/nsCSSRuleProcessor.cpp:1670
 #3  0x00007ffff3a00d6c in nsCSSRuleProcessor::RestrictedSelectorMatches (
     aElement=aElement at entry=0x7fffc407d600, aSelector=0x7fffd708e460,
     aTreeMatchContext=...)
     at /home/debian/build/tor-
 browser/layout/style/nsCSSRuleProcessor.cpp:2299
 #4  0x00007ffff3ac3085 in
 mozilla::ElementRestyler::SelectorMatchesForRestyle (
     this=0x7fffffffae20, aElement=0x7fffc407d600)
     at /home/debian/build/tor-browser/layout/base/RestyleManager.cpp:2537
 }}}

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/21962#comment:6>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online