Servo crash in script::dom::htmlanchorelement::HTMLAnchorElement::update_href

[paulrouget]

It's a very recent regression. Bisecting…

(lldb) target create "./servo"
Current executable set to './servo' (x86_64).
(lldb) run -w http://reddit.com
Process 5820 launched: './servo' (x86_64)
fatal runtime error: Could not unwind stack, error = 5
Process 5820 stopped
* thread #34: tid = 0x4c31a, 0x00000001018e37fd servo`rust_panic + 333, stop reason = EXC_BAD_INSTRUCTION (code=EXC_I386_INVOP, subcode=0x0)
    frame #0:  servo`rust_panic
servo`rust_panic:
->  0x1018e37fd <+333>: ud2
    0x1018e37ff <+335>: movq   %rax, %r15
    0x1018e3802 <+338>: cmpq   %rbx, %r12
    0x1018e3805 <+341>: je     0x1018e3822               ; <+370>
(lldb) bt
* thread #34: tid = 0x4c31a, 0x00000001018e37fd servo`rust_panic + 333, stop reason = EXC_BAD_INSTRUCTION (code=EXC_I386_INVOP, subcode=0x0)
  * frame #0:  servo`rust_panic
    frame #1:  servo`std::sys_common::unwind::begin_unwind_inner::h30e12d15ce2b2e25
    frame #2:  servo`std::sys_common::unwind::begin_unwind_fmt::hb2de8a9968d38523
    frame #3:  servo`rust_begin_unwind
    frame #4:  servo`core::panicking::panic_fmt::h257ceb0aa351d801
    frame #5:  servo`core::option::expect_failed::h2d57a5644f345e0b
    frame #6:  servo`_$LT$dom..bindings..cell..DOMRefCell$LT$T$GT$$GT$::borrow::ha59c80147194c0c4
    frame #7:  servo`script::dom::htmlanchorelement::HTMLAnchorElement::update_href::h6ec818b1e73649e5
    frame #8:  servo`_$LT$dom..htmlanchorelement..HTMLAnchorElement$u20$as$u20$dom..bindings..codegen..Bindings..HTMLAnchorElementBinding..HTMLAnchorElementMethods$GT$::SetHash::h4baab285676fffc4
    frame #9:  servo`script::dom::bindings::codegen::Bindings::HTMLAnchorElementBinding::set_hash::h2dab0550dcd309d9
    frame #10:  servo`CallJitSetterOp
    frame #11:  servo`script::dom::bindings::utils::call_setter::ha151a4b89edb07d2
    frame #12:  servo`script::dom::bindings::utils::generic_call::h04712f3953e74aad
    frame #13:  servo`js::jit::Bailout(js::jit::BailoutStack*, js::jit::BaselineBailoutInfo**)
    frame #14:  servo`js::jit::BailoutIonToBaseline(JSContext*, js::jit::JitActivation*, js::jit::JitFrameIterator&, bool, js::jit::BaselineBailoutInfo**, js::jit::ExceptionBailoutInfo const*) [inlined] BaselineStackBuilder::BaselineStackBuilder(js::jit::JitFrameIterator&, unsigned long)

[jdm]

I suspect #11182.

[paulrouget]

@jdm yes.

Reverting #11182 solves the crash.

[KiChjang]

How did our tests not catch this?

[KiChjang]

In any case, I'm currently working on this.

[KiChjang]

#10903 should have a test that tests this, but it was passing in #11182.

[KiChjang]

Also, I can't seem to find any borrowing happening in update_href at the current tip of master; where does the the .borrow() call for DOMRefCell come from?