SIGSEGV on stack overflow in PreorderFlowTraversal::traverse_absolute_flows

[mateon1]

<style>:root{display:flex;position:fixed}</style>

#0  0x0000555558e63b1e in core::ptr::Shared<alloc::arc::ArcInner<Flow>>::as_ptr<alloc::arc::ArcInner<Flow>> (self=Shared<alloc::arc::ArcInner<Flow>> = {...}) at /checkout/src/libcore/ptr.rs:2412
        self = Shared<alloc::arc::ArcInner<Flow>> = {pointer = NonZero<*const alloc::arc::ArcInner<Flow>> = {0x7fffe2886300}, _marker = PhantomData<alloc::arc::ArcInner<Flow>>}
#1  0x0000555558e640c3 in core::ptr::Shared<alloc::arc::ArcInner<Flow>>::as_ref<alloc::arc::ArcInner<Flow>> (self=0x7fffea814040) at /checkout/src/libcore/ptr.rs:2421
        self = 0x7fffea814040
#2  0x0000555558f35d1d in alloc::arc::Arc<Flow>::inner<Flow> (self=0x7fffea814040) at /checkout/src/liballoc/arc.rs:495
        self = 0x7fffea814040
#3  0x0000555558fb7d0d in alloc::arc::{{impl}}::deref<Flow> (self=0x7fffea814040) at /checkout/src/liballoc/arc.rs:726
        self = 0x7fffea814040
#4  0x000055555900414d in layout::flow_ref::FlowRef::deref_mut (this=0x7fffea814040) at /shared/dev/rust/servo/components/layout/flow_ref.rs:53
        this = 0x7fffea814040
#5  0x0000555558ffef4d in layout::flow::{{impl}}::next::{{closure}} (info=0x7fffea814040) at /shared/dev/rust/servo/components/layout/flow.rs:766
        info = 0x7fffea814040
#6  0x0000555558f40778 in core::option::Option<&mut layout::flow::AbsoluteDescendantInfo>::map<&mut layout::flow::AbsoluteDescendantInfo,&mut Flow,closure> (self=Some = {...}, f=closure)
    at /checkout/src/libcore/option.rs:398
        x = 0x7fffea814040
        self = Some = {0x7fffea814040}
        f = closure
#7  0x0000555558ffef1c in layout::flow::{{impl}}::next (self=0x7fffe2c002a0) at /shared/dev/rust/servo/components/layout/flow.rs:766
        self = 0x7fffe2c002a0
#8  0x0000555558f00521 in layout::traversal::PreorderFlowTraversal::traverse_absolute_flows<layout::block::AbsoluteAssignBSizesTraversal> (self=0x7fffe2dec898, flow=&mut Flow)
    at /shared/dev/rust/servo/components/layout/traversal.rs:129
        __next = &mut Flow
        iter = AbsoluteDescendantIter = {iter = IterMut<layout::flow::AbsoluteDescendantInfo> = {ptr = 0x7fffea814058, end = 0x7fffea814058, _marker = PhantomData<&mut layout::flow::AbsoluteDescendantInfo>}}
        self = 0x7fffe2dec898
        flow = &mut Flow
#9  0x0000555558f0057f in layout::traversal::PreorderFlowTraversal::traverse_absolute_flows<layout::block::AbsoluteAssignBSizesTraversal> (self=0x7fffe2dec898, flow=&mut Flow)
    at /shared/dev/rust/servo/components/layout/traversal.rs:130
        descendant_link = &mut Flow
        __next = &mut Flow
        iter = AbsoluteDescendantIter = {iter = IterMut<layout::flow::AbsoluteDescendantInfo> = {ptr = 0x7fffea814058, end = 0x7fffea814058, _marker = PhantomData<&mut layout::flow::AbsoluteDescendantInfo>}}
        self = 0x7fffe2dec898
        flow = &mut Flow
#10 0x0000555558f0057f in layout::traversal::PreorderFlowTraversal::traverse_absolute_flows<layout::block::AbsoluteAssignBSizesTraversal> (self=0x7fffe2dec898, flow=&mut Flow)
    at /shared/dev/rust/servo/components/layout/traversal.rs:130
        descendant_link = &mut Flow
        __next = &mut Flow
        iter = AbsoluteDescendantIter = {iter = IterMut<layout::flow::AbsoluteDescendantInfo> = {ptr = 0x7fffea814058, end = 0x7fffea814058, _marker = PhantomData<&mut layout::flow::AbsoluteDescendantInfo>}}
        self = 0x7fffe2dec898
        flow = &mut Flow
#11 0x0000555558f0057f in layout::traversal::PreorderFlowTraversal::traverse_absolute_flows<layout::block::AbsoluteAssignBSizesTraversal> (self=0x7fffe2dec898, flow=&mut Flow)
    at /shared/dev/rust/servo/components/layout/traversal.rs:130
        descendant_link = &mut Flow
        __next = &mut Flow
        iter = AbsoluteDescendantIter = {iter = IterMut<layout::flow::AbsoluteDescendantInfo> = {ptr = 0x7fffea814058, end = 0x7fffea814058, _marker = PhantomData<&mut layout::flow::AbsoluteDescendantInfo>}}
        self = 0x7fffe2dec898
        flow = &mut Flow
[50000 lines omitted]
#7410 0x0000555558f0057f in layout::traversal::PreorderFlowTraversal::traverse_absolute_flows<layout::block::AbsoluteAssignBSizesTraversal> (self=0x7fffe2dec898, flow=&mut Flow)
    at /shared/dev/rust/servo/components/layout/traversal.rs:130
#7411 0x0000555558f0057f in layout::traversal::PreorderFlowTraversal::traverse_absolute_flows<layout::block::AbsoluteAssignBSizesTraversal> (self=0x7fffe2dec898, flow=&mut Flow)
    at /shared/dev/rust/servo/components/layout/traversal.rs:130
#7412 0x0000555558f0057f in layout::traversal::PreorderFlowTraversal::traverse_absolute_flows<layout::block::AbsoluteAssignBSizesTraversal> (self=0x7fffe2dec898, flow=&mut Flow)
    at /shared/dev/rust/servo/components/layout/traversal.rs:130
#7413 0x0000555558f0057f in layout::traversal::PreorderFlowTraversal::traverse_absolute_flows<layout::block::AbsoluteAssignBSizesTraversal> (self=0x7fffe2dec898, flow=&mut Flow)
    at /shared/dev/rust/servo/components/layout/traversal.rs:130
#7414 0x0000555558f0057f in layout::traversal::PreorderFlowTraversal::traverse_absolute_flows<layout::block::AbsoluteAssignBSizesTraversal> (self=0x7fffe2dec898, flow=&mut Flow)
    at /shared/dev/rust/servo/components/layout/traversal.rs:130
#7415 0x0000555558f0057f in layout::traversal::PreorderFlowTraversal::traverse_absolute_flows<layout::block::AbsoluteAssignBSizesTraversal> (self=0x7fffe2dec898, flow=&mut Flow)
    at /shared/dev/rust/servo/components/layout/traversal.rs:130
#7416 0x0000555558f0057f in layout::traversal::PreorderFlowTraversal::traverse_absolute_flows<layout::block::AbsoluteAssignBSizesTraversal> (self=0x7fffe2dec898, flow=&mut Flow)
    at /shared/dev/rust/servo/components/layout/traversal.rs:130
#7417 0x0000555558f0057f in layout::traversal::PreorderFlowTraversal::traverse_absolute_flows<layout::block::AbsoluteAssignBSizesTraversal> (self=0x7fffe2dec898, flow=&mut Flow)
    at /shared/dev/rust/servo/components/layout/traversal.rs:130
#7418 0x0000555558f0057f in layout::traversal::PreorderFlowTraversal::traverse_absolute_flows<layout::block::AbsoluteAssignBSizesTraversal> (self=0x7fffe2dec898, flow=&mut Flow)
    at /shared/dev/rust/servo/components/layout/traversal.rs:130
#7419 0x0000555558f0057f in layout::traversal::PreorderFlowTraversal::traverse_absolute_flows<layout::block::AbsoluteAssignBSizesTraversal> (self=0x7fffe2dec898, flow=&mut Flow)
    at /shared/dev/rust/servo/components/layout/traversal.rs:130
#7420 0x0000555558f0057f in layout::traversal::PreorderFlowTraversal::traverse_absolute_flows<layout::block::AbsoluteAssignBSizesTraversal> (self=0x7fffe2dec898, flow=&mut Flow)
    at /shared/dev/rust/servo/components/layout/traversal.rs:130
#7421 0x0000555558ff9690 in layout::flex::{{impl}}::assign_block_size (self=0x7fffe2886310, layout_context=0x7fffe2def350) at /shared/dev/rust/servo/components/layout/flex.rs:959
#7422 0x0000555559024545 in layout::traversal::{{impl}}::process (self=0x7fffe2ded818, flow=&mut Flow) at /shared/dev/rust/servo/components/layout/traversal.rs:277
#7423 0x000055555901819d in layout::sequential::reflow::doit (flow=&mut Flow, assign_inline_sizes=AssignISizes = {...}, assign_block_sizes=AssignBSizes = {...}, 
    relayout_mode=layout::incremental::RelayoutMode::Incremental) at /shared/dev/rust/servo/components/layout/sequential.rs:48
#7424 0x0000555559017e6c in layout::sequential::reflow (root=&mut Flow, layout_context=0x7fffe2def350, relayout_mode=layout::incremental::RelayoutMode::Incremental)
    at /shared/dev/rust/servo/components/layout/sequential.rs:66
#7425 0x000055555639e773 in layout_thread::LayoutThread::solve_constraints (layout_root=&mut Flow, layout_context=0x7fffe2def350) at /shared/dev/rust/servo/components/layout_thread/lib.rs:921
#7426 0x00005555563a6f85 in layout_thread::{{impl}}::perform_post_style_recalc_layout_passes::{{closure}} () at /shared/dev/rust/servo/components/layout_thread/lib.rs:1598
#7427 0x000055555623d4c4 in profile_traits::time::profile<(),closure> (category=profile_traits::time::ProfilerCategory::LayoutMain, meta=Some = {...}, profiler_chan=ProfilerChan = {...}, 
    callback=closure = {...}) at /shared/dev/rust/servo/components/profile_traits/time.rs:124
#7428 0x00005555563a6922 in layout_thread::LayoutThread::perform_post_style_recalc_layout_passes (self=0x7fffe2df2de0, root_flow=0x7fffe2defae0, data=0x7fffe2df06e0, query_type=Some = {...}, 
    document=Some = {...}, rw_data=0x7fffe28151e0, context=0x7fffe2def350) at /shared/dev/rust/servo/components/layout_thread/lib.rs:1583
#7429 0x00005555563a3431 in layout_thread::LayoutThread::handle_reflow (self=0x7fffe2df2de0, data=0x7fffe2df0698, possibly_locked_rw_data=0x7fffe2df3eb8)
---Type <return> to continue, or q <return> to quit---
    at /shared/dev/rust/servo/components/layout_thread/lib.rs:1326
#7430 0x000055555639ccfe in layout_thread::{{impl}}::handle_request_helper::{{closure}} () at /shared/dev/rust/servo/components/layout_thread/lib.rs:700
#7431 0x000055555623c044 in profile_traits::time::profile<(),closure> (category=profile_traits::time::ProfilerCategory::LayoutPerform, meta=Some = {...}, profiler_chan=ProfilerChan = {...}, 
    callback=closure = {...}) at /shared/dev/rust/servo/components/profile_traits/time.rs:124
#7432 0x000055555639b8ff in layout_thread::LayoutThread::handle_request_helper (self=0x7fffe2df2de0, request=Reflow = {...}, possibly_locked_rw_data=0x7fffe2df3eb8)
    at /shared/dev/rust/servo/components/layout_thread/lib.rs:697
#7433 0x000055555639a69c in layout_thread::LayoutThread::handle_request (self=0x7fffe2df2de0, possibly_locked_rw_data=0x7fffe2df3eb8) at /shared/dev/rust/servo/components/layout_thread/lib.rs:644
#7434 0x00005555563999b4 in layout_thread::LayoutThread::start (self=LayoutThread = {...}) at /shared/dev/rust/servo/components/layout_thread/lib.rs:557
#7435 0x000055555644735a in layout_thread::{{impl}}::create::{{closure}}::{{closure}} () at /shared/dev/rust/servo/components/layout_thread/lib.rs:316
#7436 0x00005555563be835 in profile_traits::mem::ProfilerChan::run_with_memory_reporting<closure,fn(profile_traits::mem::ReportsChan) -> script_layout_interface::message::Msg,script_layout_interface::message::Msg,std::sync::mpsc::Sender<script_layout_interface::message::Msg>> (self=0x7fffe2df9550, f=closure = {...}, reporter_name="layout-reporter-(0,1)", 
    channel_for_reporter=Sender<script_layout_interface::message::Msg> = {...}, msg=0x55555af77594 <core::num::{{impl}}::is_power_of_two+36>) at /shared/dev/rust/servo/components/profile_traits/mem.rs:63
#7437 0x000055555669c724 in layout_thread::{{impl}}::create::{{closure}} () at /shared/dev/rust/servo/components/layout_thread/lib.rs:315
#7438 0x00005555565dd34b in std::sys_common::backtrace::__rust_begin_short_backtrace<closure,()> (f=closure = {...}) at /checkout/src/libstd/sys_common/backtrace.rs:136
#7439 0x00005555565df0c4 in std::thread::{{impl}}::spawn::{{closure}}::{{closure}}<closure,()> () at /checkout/src/libstd/thread/mod.rs:394
#7440 0x0000555556583b5b in std::panic::{{impl}}::call_once<(),closure> (self=AssertUnwindSafe<closure> = {...}, _args=()) at /checkout/src/libstd/panic.rs:296
#7441 0x0000555556276463 in std::panicking::try::do_call<std::panic::AssertUnwindSafe<closure>,()> (data=0x7fffe2dfd9d8 "\002\000") at /checkout/src/libstd/panicking.rs:480
#7442 0x000055555c768b9d in panic_unwind::__rust_maybe_catch_panic () at /checkout/src/libpanic_unwind/lib.rs:99
#7443 0x000055555627547d in std::panicking::try<(),std::panic::AssertUnwindSafe<closure>> (f=AssertUnwindSafe<closure> = {...}) at /checkout/src/libstd/panicking.rs:459
#7444 0x00005555565de406 in std::panic::catch_unwind<std::panic::AssertUnwindSafe<closure>,()> (f=AssertUnwindSafe<closure> = {...}) at /checkout/src/libstd/panic.rs:361
#7445 0x00005555565deeec in std::thread::{{impl}}::spawn::{{closure}}<closure,()> () at /checkout/src/libstd/thread/mod.rs:393
#7446 0x0000555556620084 in alloc::boxed::{{impl}}::call_box<(),closure> (self=0x7fffe4e0e280, args=()) at /checkout/src/liballoc/boxed.rs:728
#7447 0x000055555c76068c in alloc::boxed::{{impl}}::call_once<(),()> () at /checkout/src/liballoc/boxed.rs:738
#7448 std::sys_common::thread::start_thread () at /checkout/src/libstd/sys_common/thread.rs:24
#7449 std::sys::imp::thread::{{impl}}::new::thread_start () at /checkout/src/libstd/sys/unix/thread.rs:90
#7450 0x00007ffff597f494 in start_thread (arg=0x7fffe2dff700) at pthread_create.c:333
#7451 0x00007ffff54acabf in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:97

[emilio]

@mateon1 kindly noted that this doesn't happen (at least with the reduced test-case), with other display values that aren't flex or -webkit-flex

[nox]

This still happens. Of course it still happens, this was filed yesterday smh…

[dralley]

Still reproducable

[dralley]

It seems like it might be the same issue as #21962

[jdm]

Agreed.