Join GitHub today
GitHub is home to over 50 million developers working together to host and review code, manage projects, and build software together.
Sign upIntermittent CRASH in /custom-elements/parser/parser-sets-attributes-and-children.html #19917
Assignees
Comments
|
We could work around this by fixing the crash: |
|
I suspect we're not in a compartment and dereferencing a null pointer as a result. |
|
Indeed: diff --git a/components/script/dom/customelementregistry.rs b/components/script/dom/customelementregistry.rs
index a208f99def..8513274572 100644
--- a/components/script/dom/customelementregistry.rs
+++ b/components/script/dom/customelementregistry.rs
@@ -721,6 +721,7 @@ impl CustomElementReactionStack {
}
let cx = element.global().get_cx();
+ let _ac = JSAutoCompartment::new(cx, element.global().reflector().get_jsobject().get());
let local_name = DOMString::from(&*local_name);
rooted!(in(cx) let mut name_value = UndefinedValue());This fixes the crash. |
nox
changed the title
|
AFAICT this now intermittently crashes 100% of the time. EDIT: on Linux. |
nox
changed the title
asajeffrey
changed the title
|
Seems to crash 100% of the time now. Here's a reduced example if that helps: <script>
class MyCustomElement extends HTMLElement {
constructor() {
super();
}
attributeChangedCallback() {}
static get observedAttributes() {
return ['id'];
}
};
customElements.define('my-custom-element', MyCustomElement);
</script>
<my-custom-element id="custom-element-id">hello world</my-custom-element>Debug backtraceVMware, Inc.
llvmpipe (LLVM 7.0, 256 bits)
3.3 (Core Profile) Mesa 18.3.4
Stack trace for thread "ScriptThread PipelineId { namespace_id: PipelineNamespaceId(1), index: PipelineIndex(1) }"
stack backtrace:
0: 0x55555d084ed6 - backtrace::backtrace::libunwind::trace::h8af3b710f1a5e12e
at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-0.3.9/src/backtrace/libunwind.rs:53
- backtrace::backtrace::trace::h2a1223234ae0346f
at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-0.3.9/src/backtrace/mod.rs:42
1: 0x55555d07f4e3 - backtrace::capture::Backtrace::new_unresolved::h2dd57ce7b77a7435
at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-0.3.9/src/capture.rs:88
2: 0x55555d07f43d - backtrace::capture::Backtrace::new::h8c6b161078e28d12
at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-0.3.9/src/capture.rs:63
3: 0x5555560a48a3 - servo::install_crash_handler::handler::hd8d0ff2fab0e4053
at ports/servo/non_android_main.rs:54
4: 0x55555dc1fc20 - WasmFaultHandler
at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/mozjs_sys-0.61.6/mozjs/js/src/wasm/WasmSignalHandlers.cpp:1494
5: 0x7ffff6f7c72f - <unknown>
6: 0x55555d6c31a6 - _ZNK13JSCompartment18isAtomsCompartmentEv
at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/mozjs_sys-0.61.6/mozjs/js/src/vm/JSCompartment.h:604
7: 0x55555d6ca17d - _ZN17JSFatInlineString4new_ILN2js7AllowGCE1EEEPS_P9JSContext
at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/mozjs_sys-0.61.6/mozjs/js/src/vm/StringType-inl.h:280
8: 0x55555d9d391f - AllocateInlineString<(js::AllowGC)1, unsigned char>
at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/mozjs_sys-0.61.6/mozjs/js/src/vm/StringType-inl.h:38
9: 0x55555d9cf693 - NewInlineStringDeflated<(js::AllowGC)1>
at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/mozjs_sys-0.61.6/mozjs/js/src/vm/StringType.cpp:1387
10: 0x55555d9d405e - NewStringDeflated<(js::AllowGC)1>
at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/mozjs_sys-0.61.6/mozjs/js/src/vm/StringType.cpp:1425
11: 0x55555d9dc87c - _ZN2js14NewStringCopyNILNS_7AllowGCE1EDsEEP12JSFlatStringP9JSContextPKT0_m
at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/mozjs_sys-0.61.6/mozjs/js/src/vm/StringType.cpp:1575
12: 0x55555d651437 - _Z19JS_NewUCStringCopyNP9JSContextPKDsm
at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/mozjs_sys-0.61.6/mozjs/js/src/jsapi.cpp:5899
13: 0x5555588afa4f - <str as mozjs::conversions::ToJSValConvertible>::to_jsval::h35083c2f93f76d6c
at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/mozjs-0.10.0/src/conversions.rs:475
14: 0x555556f23d6d - script::dom::bindings::conversions::<impl mozjs::conversions::ToJSValConvertible for script::dom::bindings::str::DOMString>::to_jsval::h9ea25700c25b9a51
at components/script/dom/bindings/conversions.rs:192
15: 0x555557c7471c - script::dom::customelementregistry::CustomElementReactionStack::enqueue_callback_reaction::h0cbb7cd09f259b3d
at components/script/dom/customelementregistry.rs:859
16: 0x5555576827a1 - script::script_thread::ScriptThread::enqueue_callback_reaction::{{closure}}::h1ef869d4034392b5
at components/script/script_thread.rs:1030
17: 0x555557f87fa5 - <std::thread::local::LocalKey<T>>::try_with::h91ef062313f70b9c
at /rustc/0ea22717a1e01fa535534b85a5347a7e49fc79de/src/libstd/thread/local.rs:300
18: 0x555557d4bc2f - <std::thread::local::LocalKey<T>>::with::hd638be8a9aab5a86
at /rustc/0ea22717a1e01fa535534b85a5347a7e49fc79de/src/libstd/thread/local.rs:246
19: 0x555557aa6869 - script::script_thread::ScriptThread::enqueue_callback_reaction::h0bae2c88f944ad2f
at components/script/script_thread.rs:1027
20: 0x555558b16d1e - script::dom::element::Element::push_attribute::h5fc9b8df46b97252
at components/script/dom/element.rs:1292
21: 0x555558b1636e - script::dom::element::Element::push_new_attribute::hc9b4787883aa8d90
at components/script/dom/element.rs:1275
22: 0x555558b17c01 - script::dom::element::Element::set_attribute_from_parser::h01dbb5d3267d10ad
at components/script/dom/element.rs:1349
23: 0x555557a4b281 - script::dom::servoparser::create_element_for_token::hdadb4880ba5cd253
at components/script/dom/servoparser/mod.rs:1171
24: 0x555557a48e41 - <script::dom::servoparser::Sink as markup5ever::interface::tree_builder::TreeSink>::create_element::h031118d883f9ae00
at components/script/dom/servoparser/mod.rs:947
25: 0x555559591a00 - markup5ever::interface::tree_builder::create_element::h822aecb439d34f82
at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/markup5ever-0.7.5/interface/tree_builder.rs:125
26: 0x55555890878b - <html5ever::tree_builder::TreeBuilder<Handle, Sink>>::insert_element::h1fd0d24785aa1518
at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/html5ever-0.22.5/src/tree_builder/mod.rs:1177
27: 0x5555589152bc - <html5ever::tree_builder::TreeBuilder<Handle, Sink>>::insert_element_for::h0c4431c6695d0eaf
at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/html5ever-0.22.5/src/tree_builder/mod.rs:1212
28: 0x55555894e40f - <html5ever::tree_builder::TreeBuilder<Handle, Sink>>::step::h746cec9efabd7983
at /shared/dev/rust/servo/target/debug/build/html5ever-0993f86a4eaa0b22/out/rules.rs:768
29: 0x555558920527 - <html5ever::tree_builder::TreeBuilder<Handle, Sink>>::process_to_completion::h1141a9f73757f2ab
at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/html5ever-0.22.5/src/tree_builder/mod.rs:314
30: 0x5555588fdeb8 - <html5ever::tree_builder::TreeBuilder<Handle, Sink> as html5ever::tokenizer::interface::TokenSink>::process_token::h0a637b5c66456230
at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/html5ever-0.22.5/src/tree_builder/mod.rs:476
31: 0x55555962e702 - <html5ever::tokenizer::Tokenizer<Sink>>::process_token::hc1496545433348ee
at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/html5ever-0.22.5/src/tokenizer/mod.rs:232
32: 0x555559630516 - <html5ever::tokenizer::Tokenizer<Sink>>::emit_current_tag::h776a6648a5e146b0
at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/html5ever-0.22.5/src/tokenizer/mod.rs:425
33: 0x55555964238b - <html5ever::tokenizer::Tokenizer<Sink>>::step::h4c3a17b9d0afff00
at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/html5ever-0.22.5/src/tokenizer/mod.rs:627
34: 0x555559634848 - <html5ever::tokenizer::Tokenizer<Sink>>::run::h058719af3dcfacc0
at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/html5ever-0.22.5/src/tokenizer/mod.rs:361
35: 0x555559635233 - <html5ever::tokenizer::Tokenizer<Sink>>::feed::hc6dbce21d8f56b00
at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/html5ever-0.22.5/src/tokenizer/mod.rs:219
36: 0x555557a4cb4a - script::dom::servoparser::html::Tokenizer::feed::ha2c609330c5730ea
at components/script/dom/servoparser/html.rs:80
37: 0x555557a448a4 - script::dom::servoparser::Tokenizer::feed::h33451dc2fc6f9963
at components/script/dom/servoparser/mod.rs:599
38: 0x55555975012e - script::dom::servoparser::ServoParser::do_parse_sync::{{closure}}::hdc45f23b463af9e3
at components/script/dom/servoparser/mod.rs:477
39: 0x55555975075f - script::dom::servoparser::ServoParser::tokenize::hc34f265ed333336a
at components/script/dom/servoparser/mod.rs:515
40: 0x555557a43ed2 - script::dom::servoparser::ServoParser::do_parse_sync::h7f492b818a7f5ef6
at components/script/dom/servoparser/mod.rs:477
41: 0x5555597500b0 - script::dom::servoparser::ServoParser::parse_sync::{{closure}}::h15a5817d492f65d2
at components/script/dom/servoparser/mod.rs:459
42: 0x55555828519c - profile_traits::time::profile::h55be3e7b995ae95d
at /shared/dev/rust/servo/components/profile_traits/time.rs:142
43: 0x555557a43ab4 - script::dom::servoparser::ServoParser::parse_sync::hccbc9a86aae4ad66
at components/script/dom/servoparser/mod.rs:451
44: 0x555557a41b58 - script::dom::servoparser::ServoParser::resume_with_pending_parsing_blocking_script::h694419b6ab409ec3
at components/script/dom/servoparser/mod.rs:296
45: 0x555558aa9c58 - script::dom::document::Document::process_pending_parsing_blocking_script::h9cfb8cf3ed52a1b8
at components/script/dom/document.rs:2092
46: 0x555558aa98a2 - script::dom::document::Document::pending_parsing_blocking_script_loaded::h0bca38b1a5423c07
at components/script/dom/document.rs:2078
47: 0x555557c475e1 - <script::dom::htmlscriptelement::ScriptContext as net_traits::FetchResponseListener>::process_response_eof::hd746e7f11044a6ea
at components/script/dom/htmlscriptelement.rs:242
48: 0x555558cdd97a - <net_traits::FetchResponseMsg as net_traits::Action<T>>::process::h5fba9fa4b20edf5a
at /shared/dev/rust/servo/components/net_traits/lib.rs:271
49: 0x555559054c49 - <script::network_listener::ListenerTask<A, Listener> as script::task::TaskOnce>::run_once::h9e3a1d21f3429766
at components/script/network_listener.rs:105
50: 0x555557c60443 - <script::task::CancellableTask<T> as script::task::TaskOnce>::run_once::hc2a5b42eb1198235
at components/script/task.rs:122
51: 0x555557c55358 - <T as script::task::TaskBox>::run_box::h97b906a285339a15
at components/script/task.rs:64
52: 0x555557ab0556 - script::script_thread::ScriptThread::handle_msg_from_script::h15d002ec5aef5d9d
at components/script/script_thread.rs:1745
53: 0x555557683579 - script::script_thread::ScriptThread::handle_msgs::{{closure}}::h9f46a3c0a7bb7f95
at components/script/script_thread.rs:1348
54: 0x55555768665e - script::script_thread::ScriptThread::profile_event::he7baa525ee50e51f
at components/script/script_thread.rs:1583
55: 0x555557aab84e - script::script_thread::ScriptThread::handle_msgs::hd718a0404a74804d
at components/script/script_thread.rs:1341
56: 0x555557aa8957 - script::script_thread::ScriptThread::start::h9d2b2f4b40ef17fd
at components/script/script_thread.rs:1178
57: 0x55555767fd51 - <script::script_thread::ScriptThread as script_traits::ScriptThreadFactory>::create::{{closure}}::{{closure}}::h3d2e50a51a59531c
at components/script/script_thread.rs:731
58: 0x555558da5298 - profile_traits::mem::ProfilerChan::run_with_memory_reporting::h9a6fb4b77584b283
at /shared/dev/rust/servo/components/profile_traits/mem.rs:88
59: 0x5555576804ed - <script::script_thread::ScriptThread as script_traits::ScriptThreadFactory>::create::{{closure}}::hec71b1d6b339dd35
at components/script/script_thread.rs:729
60: 0x5555599037f4 - std::sys_common::backtrace::__rust_begin_short_backtrace::h70010f71bf1d628c
at /rustc/0ea22717a1e01fa535534b85a5347a7e49fc79de/src/libstd/sys_common/backtrace.rs:136
61: 0x55555885a503 - std::thread::Builder::spawn_unchecked::{{closure}}::{{closure}}::hea3251b085d70f10
at /rustc/0ea22717a1e01fa535534b85a5347a7e49fc79de/src/libstd/thread/mod.rs:469
62: 0x555558d21fd3 - <std::panic::AssertUnwindSafe<F> as core::ops::function::FnOnce<()>>::call_once::hbd8938e17c48a216
at /rustc/0ea22717a1e01fa535534b85a5347a7e49fc79de/src/libstd/panic.rs:309
63: 0x555558fd0a49 - std::panicking::try::do_call::hd59da0280ee94513
at /rustc/0ea22717a1e01fa535534b85a5347a7e49fc79de/src/libstd/panicking.rs:297
64: 0x55555f17d5f9 - __rust_maybe_catch_panic
at src/libpanic_unwind/lib.rs:87
65: 0x555558ea2a9f - std::panicking::try::h96247a5f4e51c63e
at /rustc/0ea22717a1e01fa535534b85a5347a7e49fc79de/src/libstd/panicking.rs:276
66: 0x555558d72cd5 - std::panic::catch_unwind::hc4559b7cad69ef45
at /rustc/0ea22717a1e01fa535534b85a5347a7e49fc79de/src/libstd/panic.rs:388
67: 0x55555885808f - std::thread::Builder::spawn_unchecked::{{closure}}::h66879e6d1707cb6d
at /rustc/0ea22717a1e01fa535534b85a5347a7e49fc79de/src/libstd/thread/mod.rs:468
68: 0x55555885b1f8 - <F as alloc::boxed::FnBox<A>>::call_box::h87e072e6468861a9
at /rustc/0ea22717a1e01fa535534b85a5347a7e49fc79de/src/liballoc/boxed.rs:749
69: 0x55555f17c93d - call_once<(),()>
at /rustc/0ea22717a1e01fa535534b85a5347a7e49fc79de/src/liballoc/boxed.rs:759
- start_thread
at src/libstd/sys_common/thread.rs:14
- thread_start
at src/libstd/sys/unix/thread.rs:80
70: 0x7ffff6f71fa2 - start_thread
71: 0x7ffff6e8682e - clone
72: 0x0 - <unknown> |
|
It makes sense that we're not in a realm here, since it's happening from HTML parsing instead of necessarily during Javascript execution. Is there a reason not to always enter a realm, like #19917 (comment) has it? |
|
No reason. We should really submit a pull request with that change. |
This was referenced Feb 12, 2020
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
This is another instance of the problem where wptrunner sometimes treats a crashing test as one that is merely timing out.