display list panic: 'index 26 out of range for slice of length 18'

[paulrouget]

STR:

• launch browserhtml
• load firefox.com
• click on "Privacy" link
• half of the time, panic

thread '<unnamed>' panicked at 'index 19 out of range for slice of length 14', ../src/libcore/slice.rs:527
note: Run with `RUST_BACKTRACE=1` for a backtrace.
thread '<unnamed>' panicked at 'called `Result::unwrap()` on an `Err` value: RecvError', ../src/libcore/result.rs:746
thread 'ImageCacheThread' panicked at 'called `Result::unwrap()` on an `Err` value: Error { repr: Custom(Custom { kind: NotFound, error: StringError("Bogus destination port.") }) }', ../src/libcore/result.rs:746
thread 'LayoutThread PipelineId { namespace_id: PipelineNamespaceId(1), index: PipelineIndex(1) }' panicked at 'called `Result::unwrap()` on an `Err` value: IoError(Error { repr: Custom(Custom { kind: Other, error: StringError("Unknown Mach error: 46") }) })', ../src/libcore/result.rs:746
thread 'PaintThread PipelineId { namespace_id: PipelineNamespaceId(1), index: PipelineIndex(1) }thread '' panicked at 'LayoutWorker worker 1/3called `Result::unwrap()` on an `Err` value: RecvError' panicked at '', called `Result::unwrap()` on an `Err` value: RecvError../src/libcore/result.rs', :../src/libcore/result.rs746:
746
thread 'LayoutWorker worker 2/3' panicked at 'called `Result::unwrap()` on an `Err` value: RecvError', ../src/libcore/result.rs:746
thread 'thread 'PaintWorker' panicked at 'PaintWorkercalled `Result::unwrap()` on an `Err` value: RecvError' panicked at '', called `Result::unwrap()` on an `Err` value: RecvError../src/libcore/result.rs', :../src/libcore/result.rs:746746

thread 'PaintWorker' panicked at 'called `Result::unwrap()` on an `Err` value: RecvError', ../src/libcore/result.rs:746
thread 'Constellation' panicked at 'unable to find pipeline - this is a bug', ../src/libcore/option.rs:704
thread 'LayoutWorker worker 3/3' panicked at 'called `Result::unwrap()` on an `Err` value: RecvError', ../src/libcore/result.rs:746
Render took 17.943536000006134ms & will cause frame drop
thread 'ScriptThread PipelineId { namespace_id: PipelineNamespaceId(1), index: PipelineIndex(1) }' panicked at 'called `Result::unwrap()` on an `Err` value: "SendError(..)"', ../src/libcore/result.rs:746
thread 'LayoutThread PipelineId { namespace_id: PipelineNamespaceId(0), index: PipelineIndex(0) }' panicked at 'called `Result::unwrap()` on an `Err` value: Error { repr: Custom(Custom { kind: NotFound, error: StringError("Bogus destination port.") }) }', ../src/libcore/result.rs:746
thread 'PaintThread PipelineId { namespace_id: PipelineNamespaceId(0), index: PipelineIndex(0) }' panicked at 'called `Result::unwrap()` on an `Err` value: RecvError', ../src/libcore/result.rs:746
thread 'LayoutWorker worker 1/3' panicked at 'called `Result::unwrap()` on an `Err` value: RecvError', ../src/libcore/result.rs:746
thread '<main>' panicked at 'called `Result::unwrap()` on an `Err` value: "SendError(..)"', ../src/libcore/result.rs:746
thread 'LayoutWorker worker 2/3' panicked at 'called `Result::unwrap()` on an `Err` value: RecvError', ../src/libcore/result.rs:746
thread 'LayoutWorker worker 3/3' panicked at 'called `Result::unwrap()` on an `Err` value: RecvError', ../src/libcore/result.rs:746
thread 'ScriptThread PipelineId { namespace_id: PipelineNamespaceId(1), index: PipelineIndex(1) }' panicked at 'assertion failed: *self.stack == mem::transmute(&*self)', /Users/paul/git/servo/.cargo/git/checkouts/rust-mozjs-ebb4917e843c0a11/master/src/rust.rs:334
stack backtrace:
thread 'PaintWorker' panicked at 'called `Result::unwrap()` on an `Err` value: RecvError', ../src/libcore/result.rs:746
thread 'PaintWorker' panicked at 'called `Result::unwrap()` on an `Err` value: RecvError', ../src/libcore/result.rs:746
thread 'PaintWorker' panicked at 'called `Result::unwrap()` on an `Err` value: RecvError', ../src/libcore/result.rs:746
   1:        0x1069fcb28 - sys::backtrace::tracing::imp::write::h3153bab3099b48114Zu
thread 'LayoutThread PipelineId { namespace_id: PipelineNamespaceId(1), index: PipelineIndex(0) }' panicked at 'called `Result::unwrap()` on an `Err` value: RecvError', ../src/libcore/result.rs:746
   2:        0x106a00719 - panicking::default_handler::_$u7b$$u7b$closure$u7d$$u7d$::closure.43920
thread 'PaintThread PipelineId { namespace_id: PipelineNamespaceId(1), index: PipelineIndex(0) }' panicked at 'called `Result::unwrap()` on an `Err` value: RecvError', ../src/libcore/result.rs:746
thread 'LayoutWorker worker 1/3' panicked at 'called `Result::unwrap()` on an `Err` value: RecvError', ../src/libcore/result.rs:746
thread 'LayoutWorker worker 2/3' panicked at 'called `Result::unwrap()` on an `Err` value: RecvError', ../src/libcore/result.rs:746
thread 'LayoutWorker worker 3/3' panicked at 'called `Result::unwrap()` on an `Err` value: RecvError', ../src/libcore/result.rs:746
   3:        0x106a00348 - panicking::default_handler::h1183b2a11c8682560zz
   4:        0x1069eb716 - sys_common::unwind::begin_unwind_inner::h1f97bc9e4cfe0396LZt
   5:        0x1056c2e84 - sys_common::unwind::begin_unwind::h14635163711203565451
   6:        0x1056c4aa4 - js..jsapi_macos_64..Rooted<*mut js..jsapi_macos_64..JSObject>::drop.140632::haa4f5160ae4910f6
thread 'PaintWorker' panicked at 'called `Result::unwrap()` on an `Err` value: RecvError', ../src/libcore/result.rs:746
thread 'PaintWorker' panicked at 'called `Result::unwrap()` on an `Err` value: RecvError', ../src/libcore/result.rs:746
   7:        0x1054cf124 - dom::eventdispatcher::invoke::hc285942dfe69ebe91qV
thread 'PaintWorker' panicked at 'called `Result::unwrap()` on an `Err` value: RecvError', ../src/libcore/result.rs:746
thread '<unnamed>' panicked at 'called `Result::unwrap()` on an `Err` value: "SendError(..)"', ../src/libcore/result.rs:746
   8:        0x1054cfa4c - dom::eventdispatcher::dispatch_event::h200e045ef877e5fcVlV
   9:        0x1054d3e59 - dom::eventtarget::EventTarget::fire_event::h5244eb252ce8ce26YsW
  10:        0x1056af7c9 - task_source::dom_manipulation::DOMManipulationTask::handle_msg::hbb624e3df838261eBqv
  11:        0x10583c9e1 - script_thread::ScriptThread::handle_msg_from_script::hc4b4152ef42bb457Qfu

[paulrouget]

thread '<unnamed>' panicked at 'index 26 out of range for slice of length 18', ../src/libcore/slice.rs:527
stack backtrace:
   1:        0x1088f0b28 - sys::backtrace::tracing::imp::write::h3153bab3099b48114Zu
   2:        0x1088f4719 - panicking::default_handler::_$u7b$$u7b$closure$u7d$$u7d$::closure.43920
   3:        0x1088f4348 - panicking::default_handler::h1183b2a11c8682560zz
   4:        0x1088df716 - sys_common::unwind::begin_unwind_inner::h1f97bc9e4cfe0396LZt
   5:        0x1088e074e - sys_common::unwind::begin_unwind_fmt::hda8646f04aa67d8aRYt
   6:        0x1088efec7 - rust_begin_unwind
   7:        0x10891a320 - panicking::panic_fmt::h40f5ec0cdc3fc429FRL
   8:        0x10891a5a1 - slice::slice_index_len_fail::h4697db0943bde2d0iFP
   9:        0x108877c5e - display_list::AuxiliaryLists::glyph_instances::hbf0f1a582638bf62SZg
  10:        0x1088349d3 - resource_list::AABBTreeNode.BuildRequiredResources::build_resource_list::h5c4e79d4611375eep0p
  11:        0x1087ce896 - F.FnBox::call_box::h5546984044800767656
  12:        0x108882dc9 - sys_common::unwind::try::try_fn::h17420895097428122983
  13:        0x1088efe5b - __rust_try
  14:        0x1088efde3 - sys_common::unwind::inner_try::hdf6affff6fc30ecdNWt
  15:        0x108884d2f - boxed::F.FnBox<A>::call_box::h9125219478194433832
  16:        0x1088f37fc - sys::thread::Thread::new::thread_start::he33a0e5f2597fcdejOy
  17:     0x7fff9675099c - _pthread_body
  18:     0x7fff96750919 - _pthread_start

[Manishearth]

The destination port error is irrelevant, the important one is the slice index one which seems to be in some glyph code.

cc @glennw

[paulrouget]

I need to make sure this happens with master. Edit: happens on master

I have 2 PR applied:

• #10248
• #10159

[paulrouget]

Happens on master.

[pcwalton]

I've seen this sometimes, but only on complex sites. This will be hard to solve without a reduced test case.

[pcwalton]

This is probably a regression from some browser.html P1 optimizations I introduced. By the way, I investigated this before and concluded that the stack trace must be wrong as this doesn't appear in a function that actually performs bounds checks or calls any other function that does. Fun!

[jrasanen]

I run into this bug fairly often, dump: https://gist.github.com/jrasanen/ad4d9b4a439bc9cb5e57063e5296c4b9

Opened servo with browserhtml enabled, pasted "https://v4-alpha.getbootstrap.com/examples/navbar-top-fixed/" into the URL bar and pressed enter -> immediate crash

[pcwalton]

I wonder if the display list data for different iframes is getting mixed up.

[pcwalton]

I'm having trouble reproducing this. I can't after trying each of the URLs here several times, with the latest browser.html.

[paulrouget]

I'm having trouble reproducing this. I can't after trying each of the URLs here several times, with the latest browser.html.

Tried with the very latest browerhtml & servo & webrender versions, still happening.

STR: load firefox.com in bhtml, and click on links. Usually, after the first or second link, it crashes.

I tried @jrasanen's page, but it doesn't crash here.

@pcwalton I'll see if I can find the commit that regressed that.

[paulrouget]

I can't reproduce on my macbook pro, only on my macbook 12.

[jrasanen]

Thing's I have had in common when I get the crash, happened to me again while compiling a project: Higher CPU load, higher memory load (~600M swap used), I see at least one JS error in console, for Bootstrap it was "Bootstrap tooltips require Tether"

[paulrouget]

Regression: 9fcf921

[pcwalton]

Yeah, I have a MacBook Pro, which explains why I'm not seeing it. :( This seems clearly nondeterministic…

[jrasanen]

I get it regularly on MacBook Pro (Early 2015), 8 GB RAM, Intel Iris Graphics 6100.

[paulrouget]

fwiw, still happening with the latest WR.

[paulrouget]

@pcwalton, is there anything I can do to help you figure out what's going here?

[Gozala]

Attempt to load http://elm-lang.org reliably reproduces the issue for me.

[Gozala]

I also noticed that loading just that without browser.html does not seem to cause a crash.

[paulrouget]

It's happening on my macbook pro as well.

[mbrubeck]

From a debug build, the key part of the stack trace:

display_list::BuiltDisplayList::display_list_items::hf879f9d2a619ccedlZf
  at webrender_traits/src/display_list.rs:84
scene::Scene::add_display_list::h1f2b27470cb7b3bcQiq
  at webrender/src/scene.rs:81

[pcwalton]

Oh, it's obvious what's going on now. Working on a fix.