unknown completed load Media

[mateon1]

Found with modified domato.

<script>
setTimeout(function(){
 document.createElement("audio").src = "";
 document.writeln();
})
</script>

unknown completed load Media (thread ScriptThread PipelineId { namespace_id: PipelineNamespaceId(0), index: PipelineIndex(NonZeroU32(NonZero(1))) }, at /shared/dev/rust/servo/components/script/document_loader.rs:133)
   1:     0x559bdabae17f - backtrace::capture::{{impl}}::new
                        at /shared/dev/rust/servo/./.cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-0.3.2/src/capture.rs:64
   2:     0x559bd483dcbe - servo::main::{{closure}}
                        at /shared/dev/rust/servo/ports/servo/main.rs:130
   3:     0x559bdaca5756 - std::panicking::rust_panic_with_hook
                        at /checkout/src/libstd/panicking.rs:578
   4:     0x559bdaca55e4 - std::panicking::begin_panic<alloc::string::String>
                        at /checkout/src/libstd/panicking.rs:538
   5:     0x559bdaca54e9 - std::panicking::begin_panic_fmt
                        at /checkout/src/libstd/panicking.rs:522
   6:     0x559bd6df3128 - script::document_loader::{{impl}}::finish_load::{{closure}}
                        at /shared/dev/rust/servo/components/script/document_loader.rs:133
   7:     0x559bd653cfed - core::option::{{impl}}::unwrap_or_else<usize,closure>
                        at /checkout/src/libcore/option.rs:370
   8:     0x559bd6df1b4b - script::document_loader::{{impl}}::finish_load
                        at /shared/dev/rust/servo/components/script/document_loader.rs:133
   9:     0x559bd5609a27 - script::dom::document::{{impl}}::finish_load
                        at /shared/dev/rust/servo/components/script/dom/document.rs:1639
  10:     0x559bd6df0d02 - script::document_loader::{{impl}}::terminate
                        at /shared/dev/rust/servo/components/script/document_loader.rs:64
  11:     0x559bd5708d4e - script::dom::htmlmediaelement::{{impl}}::delay_load_event
                        at /shared/dev/rust/servo/components/script/dom/htmlmediaelement.rs:155
  12:     0x559bd5711cb2 - script::dom::htmlmediaelement::{{impl}}::queue_dedicated_media_source_failure_steps::{{closure}}
                        at /shared/dev/rust/servo/components/script/dom/htmlmediaelement.rs:669
  13:     0x559bd61039af - core::ops::function::FnOnce::call_once<closure,()>
                        at /checkout/src/libcore/ops/function.rs:223
  14:     0x559bd5711a3a - script::dom::htmlmediaelement::{{impl}}::queue_dedicated_media_source_failure_steps::{{impl}}::run_once<closure>
                        at /shared/dev/rust/servo/components/script/task.rs:25
  15:     0x559bd58f3a7f - script::task::{{impl}}::run_once<script::dom::htmlmediaelement::{{impl}}::queue_dedicated_media_source_failure_steps::dedicated_media_source_failure_steps<closure>>
                        at /shared/dev/rust/servo/components/script/task.rs:114
  16:     0x559bd58edc5f - script::task::{{impl}}::run_box<script::task::CancellableTask<script::dom::htmlmediaelement::{{impl}}::queue_dedicated_media_source_failure_steps::dedicated_media_source_failure_steps<closure>>>
                        at /shared/dev/rust/servo/components/script/task.rs:58
  17:     0x559bd58c5876 - script::script_thread::{{impl}}::handle_msg_from_script
                        at /shared/dev/rust/servo/components/script/script_thread.rs:1255
  18:     0x559bd58e11c9 - script::script_thread::{{impl}}::handle_msgs::{{closure}}
                        at /shared/dev/rust/servo/components/script/script_thread.rs:1057
  19:     0x559bd58e16e0 - script::script_thread::{{impl}}::profile_event<closure,core::option::Option<bool>>
                        at /shared/dev/rust/servo/components/script/script_thread.rs:1168
  20:     0x559bd58c21e7 - script::script_thread::{{impl}}::handle_msgs
                        at /shared/dev/rust/servo/components/script/script_thread.rs:1050
  21:     0x559bd58c01d5 - script::script_thread::{{impl}}::start
                        at /shared/dev/rust/servo/components/script/script_thread.rs:885
  22:     0x559bd58de914 - script::script_thread::{{impl}}::create::{{closure}}::{{closure}}
                        at /shared/dev/rust/servo/components/script/script_thread.rs:570
  23:     0x559bd6dda447 - profile_traits::mem::{{impl}}::run_with_memory_reporting<closure,fn(profile_traits::mem::ReportsChan) -> script::script_runtime::CommonScriptMsg,script::script_runtime::CommonScriptMsg,std::sync::mpsc::Sender<script::script_thread::MainThreadScriptMsg>>
                        at /shared/dev/rust/servo/components/profile_traits/mem.rs:63
  24:     0x559bd58deee6 - script::script_thread::{{impl}}::create::{{closure}}
                        at /shared/dev/rust/servo/components/script/script_thread.rs:569
  25:     0x559bd7829f2a - std::sys_common::backtrace::__rust_begin_short_backtrace<closure,()>
                        at /checkout/src/libstd/sys_common/backtrace.rs:134
  26:     0x559bd606e913 - std::thread::{{impl}}::spawn::{{closure}}::{{closure}}<closure,()>
                        at /checkout/src/libstd/thread/mod.rs:400
  27:     0x559bd75b7efa - std::panic::{{impl}}::call_once<(),closure>
                        at /checkout/src/libstd/panic.rs:296
  28:     0x559bd5ccb652 - std::panicking::try::do_call<std::panic::AssertUnwindSafe<closure>,()>
                        at /checkout/src/libstd/panicking.rs:480
  29:     0x559bdacac89c - panic_unwind::__rust_maybe_catch_panic
                        at /checkout/src/libpanic_unwind/lib.rs:99
  30:     0x559bd5c28b5c - std::panicking::try<(),std::panic::AssertUnwindSafe<closure>>
                        at /checkout/src/libstd/panicking.rs:459
  31:     0x559bd7698265 - std::panic::catch_unwind<std::panic::AssertUnwindSafe<closure>,()>
                        at /checkout/src/libstd/panic.rs:361
  32:     0x559bd606d90b - std::thread::{{impl}}::spawn::{{closure}}<closure,()>
                        at /checkout/src/libstd/thread/mod.rs:399
  33:     0x559bd606ef93 - alloc::boxed::{{impl}}::call_box<(),closure>
                        at /checkout/src/liballoc/boxed.rs:762
  34:     0x559bdaca446b - alloc::boxed::{{impl}}::call_once<(),()>
                        at /checkout/src/liballoc/boxed.rs:772
                         - std::sys_common::thread::start_thread
                        at /checkout/src/libstd/sys_common/thread.rs:24
                         - std::sys::imp::thread::{{impl}}::new::thread_start
                        at /checkout/src/libstd/sys/unix/thread.rs:90
  35:     0x7ff20490f493 - start_thread
  36:     0x7ff20443cabe - __clone
  37:                0x0 - <unknown>
ERROR:servo: unknown completed load Media

[jdm]

This testcase demonstrates more clearly what the underlying issue is:

<script>
onload = function() {
 document.createElement("audio").src = "";
 document.open();
};
</script>

Specifically, document.open() causes the page contents to be blown away, and step 25 of Document::Open replaces the DocumentLoader which tracks outstanding page loads. The load for the audio element is not interrupted, though, so when it tries to tell the document that it's complete the document becomes confused.

[jdm]

We can cancel loads now, so that's probably the first thing we should do here.

[NeverHappened]

@jdm Can I take this?

[jdm]

@NeverHappened Absolutely!

[NeverHappened]

Hey @jdm

Investigated this. I guess that problem here is that both Document and HTMLMediaElement
want to be able to cancel fetch request. For now HTMLMediaElement owns
the fetch_canceller through current_fetch_context: HTMLMediaElementFetchContext.

Can you give me some ideas about how to share canceller?
I can see how I can do this with wrapping the FetchCanceller with Arc<Mutex<>>, but this will require changes in DocumentLoader as well

[NeverHappened]

Actually, researched more. This problem starts because there is some time between invoke_resource_selection_algorithm and resource_selection_algorithm_sync (because resource_selection_algorithm_sync run as a microtask) and so even cancel_all_loads() is called a little bit before the resource_selection_algorithm_sync - so it cannot cancel the task, because it haven't started yet

[jdm]

That's an interesting result! One workaround here might be to loosen the restrictions so that we don't panic when we encounter an unknown completed load, and turn that into a warn! instead. It's not totally clear to me what the desired outcome here is - the audio element isn't actually part of the page DOM, so document.open() may not be intended to have any impact on its load. Perhaps the warning is the best outcome in that case.

[NeverHappened]

That's already a warning actually. Somebody changed it to warn! after issue was created