called Result::unwrap() on an Err value: RecvError

[sophiajt]

This occurred when opening reddit.com, resizing the right hand side, and then moving my mouse to click on a link.

called Result::unwrap() on an Err value: RecvError

URL:

about:failure

Servo Version:

Servo 0.0.1-4ec2e8b-dirty

Backtrace:

WARNING: <Constellation>: creating replacement pipeline for about:failure
WARNING: <ScriptThread PipelineId { namespace_id: PipelineNamespaceId(3), index: PipelineIndex(9) }>: layout thread unreachable - leaking layout data
WARNING: <ScriptThread PipelineId { namespace_id: PipelineNamespaceId(3), index: PipelineIndex(9) }>: layout thread unreachable - leaking layout data
WARNING: <ScriptThread PipelineId { namespace_id: PipelineNamespaceId(3), index: PipelineIndex(9) }>: layout thread unreachable - leaking layout data
WARNING: <ScriptThread PipelineId { namespace_id: PipelineNamespaceId(3), index: PipelineIndex(9) }>: layout thread unreachable - leaking layout data
WARNING: <ScriptThread PipelineId { namespace_id: PipelineNamespaceId(3), index: PipelineIndex(9) }>: layout thread unreachable - leaking layout data
WARNING: <ScriptThread PipelineId { namespace_id: PipelineNamespaceId(3), index: PipelineIndex(9) }>: layout thread unreachable - leaking layout data
WARNING: <ScriptThread PipelineId { namespace_id: PipelineNamespaceId(3), index: PipelineIndex(9) }>: layout thread unreachable - leaking layout data
WARNING: <ScriptThread PipelineId { namespace_id: PipelineNamespaceId(3), index: PipelineIndex(9) }>: layout thread unreachable - leaking layout data
WARNING: <ScriptThread PipelineId { namespace_id: PipelineNamespaceId(3), index: PipelineIndex(9) }>: layout thread unreachable - leaking layout data
WARNING: <ScriptThread PipelineId { namespace_id: PipelineNamespaceId(3), index: PipelineIndex(9) }>: layout thread unreachable - leaking layout data
WARNING: <ScriptThread PipelineId { namespace_id: PipelineNamespaceId(3), index: PipelineIndex(9) }>: layout thread unreachable - leaking layout data
WARNING: <ScriptThread PipelineId { namespace_id: PipelineNamespaceId(3), index: PipelineIndex(9) }>: layout thread unreachable - leaking layout data
WARNING: <ScriptThread PipelineId { namespace_id: PipelineNamespaceId(3), index: PipelineIndex(9) }>: layout thread unreachable - leaking layout data
WARNING: <ScriptThread PipelineId { namespace_id: PipelineNamespaceId(3), index: PipelineIndex(9) }>: layout thread unreachable - leaking layout data
WARNING: <ScriptThread PipelineId { namespace_id: PipelineNamespaceId(1), index: PipelineIndex(6) }>: Mozbrowser event after iframe (1,6)/(1,4) closed.
WARNING: <ScriptThread PipelineId { namespace_id: PipelineNamespaceId(0), index: PipelineIndex(2) }>: Resuming an already resumed timer.
WARNING: <ScriptThread PipelineId { namespace_id: PipelineNamespaceId(0), index: PipelineIndex(2) }>: stop_parsing not implemented, full speed ahead!
WARNING: <ScriptThread PipelineId { namespace_id: PipelineNamespaceId(1), index: PipelineIndex(6) }>: Panic hook called.
ERROR: called `Result::unwrap()` on an `Err` value: RecvError

stack backtrace:
   0:        0x10b2b023e - backtrace::backtrace::trace::h08d974acf6c993fa
   1:        0x10b2b03cc - backtrace::capture::Backtrace::new::h23089c033eded8f0
   2:        0x10a6ca176 - constellation::constellation::log_entry::hc38536932d8f4b67
   3:        0x10a6c9182 - _$LT$constellation..constellation..FromCompositorLogger$u20$as$u20$log..Log$GT$::log::haa78c0ec76871a1e
   4:        0x10c1fb31e - log::__log::h1789875773ba06ea
   5:        0x10a570d10 - servo::main::_$u7b$$u7b$closure$u7d$$u7d$::h4c2d26f91da4e346
   6:        0x10c22a6d6 - std::panicking::rust_panic_with_hook::h2bd2f0b446f0face
   7:        0x10c22a534 - std::panicking::begin_panic::h1732f61ecaaa434e
   8:        0x10c22a4a2 - std::panicking::begin_panic_fmt::h2948dd4668f99175
   9:        0x10c22a407 - rust_begin_unwind
  10:        0x10c2528d0 - core::panicking::panic_fmt::hb2e726f3b579b19d
  11:        0x10abc2a7b - core::result::unwrap_failed::h11dca5a185c96788
  12:        0x10ae85113 - script::dom::window::Window::force_reflow::h46d6a40611c761fe
  13:        0x10ae890ed - script::dom::window::Window::reflow::h37046221bd58f32e
  14:        0x10ad02a9f - script::dom::document::Document::handle_mouse_move_event::h526fffcd5f10e4ec
  15:        0x10aef307a - script::script_thread::ScriptThread::handle_event::had32fab6aeb88539
  16:        0x10aeda34d - script::script_thread::ScriptThread::handle_msg_from_constellation::h3f0a76722a1c5f38
  17:        0x10aed937d - script::script_thread::ScriptThread::handle_msgs::_$u7b$$u7b$closure$u7d$$u7d$::h91a09fcc36982a89
  18:        0x10aed4d4b - script::script_thread::ScriptThread::handle_msgs::h04db148f778e8d65
  19:        0x10a9ec407 - std::sys_common::backtrace::__rust_begin_short_backtrace::h2f2f9f3f8b10f5ee
  20:        0x10aa2278d - std::panicking::try::do_call::h2121432bafd09c6f
  21:        0x10c22b7aa - __rust_maybe_catch_panic
  22:        0x10abc6b16 - _$LT$F$u20$as$u20$alloc..boxed..FnBox$LT$A$GT$$GT$::call_box::hd2e81a5c0b0bbe25
  23:        0x10c2272e5 - std::sys::imp::thread::Thread::new::thread_start::h5852519f9f48a1f2
  24:     0x7fffa695993a - _pthread_body
  25:     0x7fffa6959886 - _pthread_start

This report was generated by the browser.html issue reporter.

[jdm]

I couldn't reproduce in a debug build, but a release build in a debugger got me this:

ERROR:servo: called `Option::unwrap()` on a `None` value
(lldb) bt
* thread #31, stop reason = breakpoint 1.1
  * frame #0: 0x00000001024572e4 servo`std::panicking::rust_panic at panicking.rs:580 [opt]
    frame #1: 0x00000001024572a4 servo`std::panicking::rust_panic_with_hook at panicking.rs:565 [opt]
    frame #2: 0x0000000102457095 servo`std::panicking::begin_panic<collections::string::String> at panicking.rs:511 [opt]
    frame #3: 0x0000000102457003 servo`std::panicking::begin_panic_fmt at panicking.rs:495 [opt]
    frame #4: 0x0000000102456f68 servo`std::panicking::rust_begin_panic at panicking.rs:471 [opt]
    frame #5: 0x000000010247f431 servo`core::panicking::panic_fmt at panicking.rs:69 [opt]
    frame #6: 0x000000010247f335 servo`core::panicking::panic at panicking.rs:49 [opt]
    frame #7: 0x000000010029a912 servo`layout::display_list_builder::DisplayListBuildState::create_base_display_item::hab932539c905de2d + 1794
    frame #8: 0x000000010029fd55 servo`_$LT$layout..fragment..Fragment$u20$as$u20$layout..display_list_builder..FragmentDisplayListBuilding$GT$::build_display_list_for_background_if_applicable::h8672b366ea7c297a + 1205
    frame #9: 0x00000001002a5099 servo`_$LT$layout..fragment..Fragment$u20$as$u20$layout..display_list_builder..FragmentDisplayListBuilding$GT$::build_display_list::he41c8191779d66c7 + 777
    frame #10: 0x00000001002ac3aa servo`_$LT$layout..block..BlockFlow$u20$as$u20$layout..display_list_builder..BlockFlowDisplayListBuilding$GT$::build_display_list_for_block::hab7d2f6e5bac7f4b + 186
    frame #11: 0x0000000100291e59 servo`_$LT$layout..block..BlockFlow$u20$as$u20$layout..flow..Flow$GT$::build_display_list::h63e298aad3064c03 + 25
    frame #12: 0x00000001002ef61f servo`layout::traversal::BuildDisplayList::traverse::h53b9483d348bbb1e + 159
    frame #13: 0x00000001002ef673 servo`layout::traversal::BuildDisplayList::traverse::h53b9483d348bbb1e + 243
    frame #14: 0x00000001002ef673 servo`layout::traversal::BuildDisplayList::traverse::h53b9483d348bbb1e + 243
    frame #15: 0x00000001002ef673 servo`layout::traversal::BuildDisplayList::traverse::h53b9483d348bbb1e + 243
    frame #16: 0x00000001002ef673 servo`layout::traversal::BuildDisplayList::traverse::h53b9483d348bbb1e + 243
    frame #17: 0x00000001002ef673 servo`layout::traversal::BuildDisplayList::traverse::h53b9483d348bbb1e + 243
    frame #18: 0x00000001002ef673 servo`layout::traversal::BuildDisplayList::traverse::h53b9483d348bbb1e + 243
    frame #19: 0x00000001002ef673 servo`layout::traversal::BuildDisplayList::traverse::h53b9483d348bbb1e + 243
    frame #20: 0x00000001002ef673 servo`layout::traversal::BuildDisplayList::traverse::h53b9483d348bbb1e + 243
    frame #21: 0x00000001002ef673 servo`layout::traversal::BuildDisplayList::traverse::h53b9483d348bbb1e + 243
    frame #22: 0x00000001002d7993 servo`layout::sequential::build_display_list_for_subtree::hafab44c91b5b82a4 + 99
    frame #23: 0x000000010024156c servo`layout_thread::LayoutThread::perform_post_style_recalc_layout_passes::hbd1305868c8494d5 + 3500
    frame #24: 0x000000010023c4ad servo`layout_thread::LayoutThread::handle_reflow::h8b25857f71e1d684 + 15933
    frame #25: 0x000000010023315e servo`layout_thread::LayoutThread::handle_request_helper::h50166bb0493c67ac + 1342
    frame #26: 0x0000000100230855 servo`layout_thread::LayoutThread::handle_request::h783a7fb1ffa992d7 + 3445
    frame #27: 0x00000001001c516b servo`std::sys_common::backtrace::__rust_begin_short_backtrace::hf2ffe40803523d32 + 1195
    frame #28: 0x00000001001c6b28 servo`std::panicking::try::do_call::h9857e4624415cf79 + 40
    frame #29: 0x000000010245830b servo`panic_unwind::__rust_maybe_catch_panic at lib.rs:98 [opt]
    frame #30: 0x00000001001e2855 servo`_$LT$F$u20$as$u20$alloc..boxed..FnBox$LT$A$GT$$GT$::call_box::hbdaa3927d684c2c9 + 165
    frame #31: 0x0000000102453e46 servo`std::sys::imp::thread::{{impl}}::new::thread_start [inlined] alloc::boxed::{{impl}}::call_once<(),()> at boxed.rs:658 [opt]
    frame #32: 0x0000000102453e43 servo`std::sys::imp::thread::{{impl}}::new::thread_start [inlined] std::sys_common::thread::start_thread at thread.rs:21 [opt]
    frame #33: 0x0000000102453dd0 servo`std::sys::imp::thread::{{impl}}::new::thread_start at thread.rs:84 [opt]
    frame #34: 0x000000010615f93b libsystem_pthread.dylib`_pthread_body + 180
    frame #35: 0x000000010615f887 libsystem_pthread.dylib`_pthread_start + 286
    frame #36: 0x000000010615f08d libsystem_pthread.dylib`thread_start + 13

[jdm]

I strongly suspect this code.

[jdm]

Confirmed:

frame #8: 0x000000010029b406 servo`layout::display_list_builder::{{impl}}::create_base_display_item at display_list_builder.rs:246 [opt]
   243 	        }
   244
   245 	        debug_assert!(self.scroll_root_parents.contains_key(&scroll_root_id));
-> 246 	        *self.scroll_root_parents.get(&scroll_root_id).unwrap()
   247 	    }
   248
   249 	    fn create_base_display_item(&self,

[jdm]

cc @mrobinson

[jdm]

Same error as #17176.

[mrobinson]

Sorry for the delay. I'll try to take a look at this in the next couple days.

[mrobinson]

Okay. It took me longer to get to this than I expected. I was able to make a fix, but not to reduced test case. I'm still entirely sure why blocks are children of inline elements (without being inline blocks or inline absolutes).

[mrobinson]

Perhaps one of you would be willing to confirm that the change fixes the issue for you? I believe that it does for me, but I'm also seeing a strange deadlock on reddit.

[sophiajt]

@mrobinson - checking

[sophiajt]

@mrobinson - still repros for me using your branch

[mrobinson]

@jonathandturner I'm wondering if this is two different bugs then. I'm not able to reproduce the issue with create_base_display_item after my change.

[sophiajt]

@mrobinson - this is what I see with your patch (on macOS), following the repro steps for polygon.com:

Node was being treated as inline, but it has an associated fragment! (thread LayoutThread PipelineId { namespace_id: PipelineNamespaceId(1), index: PipelineIndex(6) }, at /Users/jturner/Source/servo/components/layout/query.rs:541)
stack backtrace:
   0:        0x10baa5dfe - backtrace::backtrace::trace::h68b0252f9f90821b
   1:        0x10baa5f9c - backtrace::capture::Backtrace::new::hde1afc496271e12d
   2:        0x10a313c32 - servo::main::_$u7b$$u7b$closure$u7d$$u7d$::h3eb9c088b479c914
   3:        0x10c2537d9 - std::panicking::rust_panic_with_hook::h07a59b4ad630aa5c
   4:        0x10bc4fc44 - std::panicking::begin_panic::h7fa4375397df7fc3
   5:        0x10bcd5d85 - _$LT$layout..query..ParentOffsetBorderBoxIterator$u20$as$u20$layout..fragment..FragmentBorderBoxIterator$GT$::process::hac7b573348d0070f
   6:        0x10bc90ee3 - _$LT$layout..block..BlockFlow$u20$as$u20$layout..flow..Flow$GT$::iterate_through_fragment_border_boxes::ha636e3e27b93f924
   7:        0x10bcd635c - layout::sequential::iterate_through_flow_tree_fragment_border_boxes::doit::h3232ebc58df08eca
   8:        0x10bcd63e8 - layout::sequential::iterate_through_flow_tree_fragment_border_boxes::doit::h3232ebc58df08eca
   9:        0x10bcd63e8 - layout::sequential::iterate_through_flow_tree_fragment_border_boxes::doit::h3232ebc58df08eca
  10:        0x10bcd63e8 - layout::sequential::iterate_through_flow_tree_fragment_border_boxes::doit::h3232ebc58df08eca
  11:        0x10bcd63e8 - layout::sequential::iterate_through_flow_tree_fragment_border_boxes::doit::h3232ebc58df08eca
  12:        0x10bcd63e8 - layout::sequential::iterate_through_flow_tree_fragment_border_boxes::doit::h3232ebc58df08eca
  13:        0x10bcd63e8 - layout::sequential::iterate_through_flow_tree_fragment_border_boxes::doit::h3232ebc58df08eca
  14:        0x10bcd63e8 - layout::sequential::iterate_through_flow_tree_fragment_border_boxes::doit::h3232ebc58df08eca
  15:        0x10bcd63e8 - layout::sequential::iterate_through_flow_tree_fragment_border_boxes::doit::h3232ebc58df08eca
  16:        0x10bcd6313 - layout::sequential::iterate_through_flow_tree_fragment_border_boxes::h6c2e06403af64d2c
  17:        0x10a4927b8 - layout_thread::LayoutThread::handle_reflow::h5fe156a7e682385a
  18:        0x10a488eba - layout_thread::LayoutThread::handle_request_helper::h1da08c86168f4be3
  19:        0x10a483dbf - _$LT$layout_thread..LayoutThread$u20$as$u20$layout_traits..LayoutThreadFactory$GT$::create::_$u7b$$u7b$closure$u7d$$u7d$::he760b985031a67b5
  20:        0x10a405af7 - std::sys_common::backtrace::__rust_begin_short_backtrace::h9c32c49f8e77762f
  21:        0x10a4072f7 - std::panicking::try::do_call::h723f74ce99d75c2a
  22:        0x10c25497c - __rust_maybe_catch_panic
  23:        0x10a4345d3 - _$LT$F$u20$as$u20$alloc..boxed..FnBox$LT$A$GT$$GT$::call_box::hcc999d94a18abdd4
  24:        0x10c2507eb - std::sys::imp::thread::Thread::new::thread_start::h6bff5ab797159c9b
  25:     0x7fffe24b993a - _pthread_body
  26:     0x7fffe24b9886 - _pthread_start
ERROR:servo: Node was being treated as inline, but it has an associated fragment!
called `Result::unwrap()` on an `Err` value: "PoisonError { inner: .. }" (thread ScriptThread PipelineId { namespace_id: PipelineNamespaceId(1), index: PipelineIndex(6) }, at src/libcore/result.rs:860)
stack backtrace:
   0:        0x10baa5dfe - backtrace::backtrace::trace::h68b0252f9f90821b
   1:        0x10baa5f9c - backtrace::capture::Backtrace::new::hde1afc496271e12d
   2:        0x10a313c32 - servo::main::_$u7b$$u7b$closure$u7d$$u7d$::h3eb9c088b479c914
   3:        0x10c2537d9 - std::panicking::rust_panic_with_hook::h07a59b4ad630aa5c
   4:        0x10c253634 - std::panicking::begin_panic::h0ec41b127908cfb8
   5:        0x10c2535b2 - std::panicking::begin_panic_fmt::ha268370d12baa79c
   6:        0x10c253517 - rust_begin_unwind
   7:        0x10c27e2e0 - core::panicking::panic_fmt::hd120ccda11abebf7
   8:        0x10bc65316 - core::result::unwrap_failed::h9ed4de85940a30ff
   9:        0x10bcd486b - _$LT$layout..query..LayoutRPCImpl$u20$as$u20$script_layout_interface..rpc..LayoutRPC$GT$::offset_parent::h0457d8ef414b02eb
  10:        0x10ab72d96 - script::dom::window::Window::offset_parent_query::h4bd8a95883b42f4b
  11:        0x10aa572eb - _$LT$script..dom..htmlelement..HTMLElement$u20$as$u20$script..dom..bindings..codegen..Bindings..HTMLElementBinding..HTMLElementBinding..HTMLElementMethods$GT$::OffsetLeft::h4d808e7a8930589e
  12:        0x10a6475e8 - std::panicking::try::do_call::h6f292980adcf56a5
  13:        0x10c25497c - __rust_maybe_catch_panic
  14:        0x10ad37038 - script::dom::bindings::codegen::Bindings::HTMLElementBinding::HTMLElementBinding::get_offsetLeft::h1bb993a1da583fdc
  15:        0x10a988035 - script::dom::bindings::utils::generic_call::h131bc4ccc909e872
  16:        0x10b3f89d4 - js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)
  17:        0x10b41bafb - CallGetter(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<js::Shape*>, JS::MutableHandle<JS::Value>)
  18:        0x10b3fc3d7 - js::GetProperty(JSContext*, JS::Handle<JS::Value>, JS::Handle<js::PropertyName*>, JS::MutableHandle<JS::Value>)
  19:        0x10b3edf87 - Interpret(JSContext*, js::RunState&)
  20:        0x10b3e72e3 - js::RunScript(JSContext*, js::RunState&)
  21:        0x10b3f8af2 - js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)
  22:        0x10b3f8e25 - js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>)
  23:        0x10b32ac58 - js::fun_apply(JSContext*, unsigned int, JS::Value*)
  24:        0x10b3f89d4 - js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)
  25:        0x10b09cc95 - js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICCall_Fallback*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>)
ERROR:servo: called `Result::unwrap()` on an `Err` value: "PoisonError { inner: .. }"
ERROR:constellation::constellation: about:failure failed

[mrobinson]

The bug here seems to be in the way that the flows are generated based on @stshine's comment on my now-abandoned PR (#17622).

Is it possible for InlineFlow to have normal block children?

Sounds like a bug to me.