Intermittent crash of /_mozilla/mozilla/mozbrowser/mozbrowserlocationchange_event.html and /html/browsers/browsing-the-web/navigating-across-documents/javascript-url-return-value-handling.html and /html/semantics/document-metadata/the-meta-element/pragma-directives/attr-meta-http-equiv-refresh/allow-scripts-flag-changing-2.html

[KiChjang]

Tests with unexpected results:
  ▶ CRASH [expected OK] /_mozilla/mozilla/mozbrowser/mozbrowserlocationchange_event.html
  │ 
  │ VMware, Inc.
  │ Gallium 0.4 on softpipe
  │ 3.3 (Core Profile) Mesa 12.0.1
  │ index 8 out of range for slice of length 1 (thread <unnamed>, at ../src/libcore/slice.rs:541)
  │ stack backtrace:
  │    0:        0x10b56286e - backtrace::backtrace::trace::h16372ee7bf1517e5
  │    1:        0x10b562b5c - backtrace::capture::Backtrace::new::hcc43c50c4b11c693
  │    2:        0x10b21c3e4 - servo::main::_{{closure}}::h676c9ac4cd08a542
  │    3:        0x10cc29a23 - std::panicking::rust_panic_with_hook::h00b81bb3dcbd51f2
  │    4:        0x10cc298f4 - std::panicking::begin_panic::ha6a0d553db9869ff
  │    5:        0x10cc29812 - std::panicking::begin_panic_fmt::h24d113aee3ee4081
  │    6:        0x10cc29777 - rust_begin_unwind
  │    7:        0x10cc56540 - core::panicking::panic_fmt::he441b2ea2036b98a
  │    8:        0x10cc56619 - core::slice::slice_index_len_fail::h2803edbc63880acd
  │    9:        0x10ca9fd9e - webrender_traits::display_list::_<impl webrender_traits..AuxiliaryLists>::glyph_instances::h9e1d92df2f521394
  │   10:        0x10b613100 - webrender::tiling::FrameBuilder::build::h7c06f52b5bc4d5dc
  │   11:        0x10b602426 - webrender::render_backend::RenderBackend::render::hd39c18f315e7fdcc
  │   12:        0x10b5fada1 - webrender::render_backend::RenderBackend::run::h5a5f7231522053b6
  │   13:        0x10b5c0dd3 - std::panicking::try::do_call::h32ae11f1292d9ad8
  │   14:        0x10cc2aa4a - __rust_maybe_catch_panic
  │   15:        0x10b5cc746 - _<F as alloc..boxed..FnBox<A>>::call_box::h8df20a89dddfedaa
  │   16:        0x10cc288d4 - std::sys::thread::Thread::new::thread_start::h9fa66f6812e81e10
  │   17:     0x7fff97f2c059 - _pthread_body
  │   18:     0x7fff97f2bfd6 - _pthread_start
  │ ERROR:servo: index 8 out of range for slice of length 1
  │ called `Result::unwrap()` on an `Err` value: IoError(Error { repr: Custom(Custom { kind: Other, error: StringError("Unknown Mach error: 46") }) }) (thread main, at ../src/libcore/result.rs:837)
  │ stack backtrace:
  │    0:        0x10b56286e - backtrace::backtrace::trace::h16372ee7bf1517e5
  │    1:        0x10b562b5c - backtrace::capture::Backtrace::new::hcc43c50c4b11c693
  │    2:        0x10b21c3e4 - servo::main::_{{closure}}::h676c9ac4cd08a542
  │    3:        0x10cc29a23 - std::panicking::rust_panic_with_hook::h00b81bb3dcbd51f2
  │    4:        0x10cc298f4 - std::panicking::begin_panic::ha6a0d553db9869ff
  │    5:        0x10cc29812 - std::panicking::begin_panic_fmt::h24d113aee3ee4081
  │    6:        0x10cc29777 - rust_begin_unwind
  │    7:        0x10cc56540 - core::panicking::panic_fmt::he441b2ea2036b98a
  │    8:        0x10ca99352 - core::result::unwrap_failed::h97cf4d1c2597280e
  │    9:        0x10ca9b886 - webrender_traits::api::RenderApi::get_scroll_layer_state::h0045dd09d6e6c535
  │   10:        0x10b20e869 - _<compositing..compositor..IOCompositor<Window>>::send_viewport_rects::h8cbde2e6a3facaa7
  │   11:        0x10b21128b - _<compositing..compositor..IOCompositor<Window>>::handle_browser_message::h8bc174761230c80f
  │   12:        0x10b1ff2bb - _<servo..Browser<Window>>::handle_events::h7e1f4dfdfffefb7e
  │   13:        0x10b21b435 - servo::main::h3deab6e3626759a3
  │   14:        0x10cc2aa4a - __rust_maybe_catch_panic
  │   15:        0x10cc28d66 - std::rt::lang_start::h74b3afbdd8daef1c
  │ ERROR:servo: called `Result::unwrap()` on an `Err` value: IoError(Error { repr: Custom(Custom { kind: Other, error: StringError("Unknown Mach error: 46") }) })

[jdm]

  ▶ CRASH [expected OK] /html/browsers/browsing-the-web/navigating-across-documents/javascript-url-return-value-handling.html
  │ 
  │ VMware, Inc.
  │ Gallium 0.4 on softpipe
  │ 3.3 (Core Profile) Mesa 12.0.1
  │ index 4 out of range for slice of length 1 (thread <unnamed>, at ../src/libcore/slice.rs:541)
  │ stack backtrace:
  │    0:        0x106d72b3e - backtrace::backtrace::trace::h16372ee7bf1517e5
  │    1:        0x106d72e2c - backtrace::capture::Backtrace::new::hcc43c50c4b11c693
  │    2:        0x106a4d134 - servo::main::_{{closure}}::he01100fc53982b46
  │    3:        0x108447d13 - std::panicking::rust_panic_with_hook::h00b81bb3dcbd51f2
  │    4:        0x108447be4 - std::panicking::begin_panic::ha6a0d553db9869ff
  │    5:        0x108447b02 - std::panicking::begin_panic_fmt::h24d113aee3ee4081
  │    6:        0x108447a67 - rust_begin_unwind
  │    7:        0x108474830 - core::panicking::panic_fmt::he441b2ea2036b98a
  │    8:        0x108474909 - core::slice::slice_index_len_fail::h2803edbc63880acd
  │    9:        0x1082bf6fe - webrender_traits::display_list::_<impl webrender_traits..AuxiliaryLists>::glyph_instances::he03269555a586912
  │   10:        0x106e275db - webrender::tiling::FrameBuilder::build::h7561a3b2f383e223
  │   11:        0x106e14768 - webrender::render_backend::RenderBackend::render::hf2927acab8007ab9
  │   12:        0x106e0ca33 - webrender::render_backend::RenderBackend::run::h7801248ca43cb17b
  │   13:        0x106dd0f1f - std::panicking::try::do_call::he6418abe467fb90a
  │   14:        0x108448d3a - __rust_maybe_catch_panic
  │   15:        0x106ddd806 - _<F as alloc..boxed..FnBox<A>>::call_box::hd3ec0ac822d835b1
  │   16:        0x108446bc4 - std::sys::thread::Thread::new::thread_start::h9fa66f6812e81e10
  │   17:     0x7fff95aed059 - _pthread_body
  │   18:     0x7fff95aecfd6 - _pthread_start
  │ ERROR:servo: index 4 out of range for slice of length 1
  │ Pipeline failed in hard-fail mode.  Crashing!
  └ thread panicked while processing panic. aborting.

[jdm]

cc @glennw

[jdm]

Probably similar to #14378 but the symptoms are slightly different.

[mrobinson]

At #14603, I see a crash in /html/semantics/document-metadata/the-meta-element/pragma-directives/attr-meta-http-equiv-refresh/allow-scripts-flag-changing-1.html. Perhaps related?

[mrobinson]

Sorry, I was wrong. The problem in that bug appears to be #14323.