Skip to content

/ servo

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Insertion failed: HierarchyRequest with nested table captions #20220

Open
mateon1 opened this issue Mar 6, 2018 · 5 comments
Open

Insertion failed: HierarchyRequest with nested table captions #20220

mateon1 opened this issue Mar 6, 2018 · 5 comments
Labels
A-content/dom C-has-manual-testcase E-candidate-for-mentoring I-panic

Comments

@mateon1
Copy link
Contributor

@mateon1 mateon1 commented Mar 6, 2018

Found fuzzing with domato.

<table>
<caption id="c">
<table id="t">
<script>document.getElementById("t").caption = document.getElementById("c")</script>
VMware, Inc.
softpipe
3.3 (Core Profile) Mesa 17.3.0-devel
Insertion failed: HierarchyRequest (thread ScriptThread PipelineId { namespace_id: PipelineNamespaceId(0), index: PipelineIndex(NonZero(NonZero(1))) }, at libcore/result.rs:916)
stack backtrace:
   0:     0x55555bcfa704 - backtrace::backtrace::libunwind::trace::h79984cabe80721dc
                        at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-0.3.2/src/backtrace/libunwind.rs:53
                         - backtrace::backtrace::trace::h10c59b076f73358b
                        at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-0.3.2/src/backtrace/mod.rs:42
   1:     0x55555bcf1e8c - backtrace::capture::Backtrace::new::haef9cefb7535bc7c
                        at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-0.3.2/src/capture.rs:64
   2:     0x55555597aa16 - servo::main::{{closure}}::hf0fa8cccddc0cbc3
                        at ports/servo/main.rs:146
   3:     0x55555bd0db45 - std::panicking::rust_panic_with_hook::haa00f5a9417cd684
                        at libstd/panicking.rs:577
   4:     0x55555bd0d9ce - std::panicking::begin_panic::ha956683198499384
                        at libstd/panicking.rs:537
   5:     0x55555bd0d8ca - std::panicking::begin_panic_fmt::h587e116719f14631
                        at libstd/panicking.rs:521
   6:     0x55555bd0d862 - rust_begin_unwind
                        at libstd/panicking.rs:497
   7:     0x55555bd42050 - core::panicking::panic_fmt::h1d64949939b0af2f
                        at libcore/panicking.rs:71
   8:     0x555557e159f7 - core::result::unwrap_failed::h3c523c1bc1568770
                        at /checkout/src/libcore/macros.rs:23
   9:     0x555557dc2651 - <core::result::Result<T, E>>::expect::hce9d974700f58f4d
                        at /checkout/src/libcore/result.rs:809
  10:     0x55555730732f - <script::dom::htmltableelement::HTMLTableElement as script::dom::bindings::codegen::Bindings::HTMLTableElementBinding::HTMLTableElementBinding::HTMLTableElementMethods>::SetCaption::h32c3011de7921911
                        at components/script/dom/htmltableelement.rs:170
  11:     0x555557a70877 - script::dom::bindings::codegen::Bindings::HTMLTableElementBinding::HTMLTableElementBinding::set_caption::{{closure}}::hb1c754820f54445f
                        at /shared/dev/rust/servo/target/debug/build/script-c42abaa61a41d086/out/Bindings/HTMLTableElementBinding.rs:526
  12:     0x55555642876c - core::ops::function::FnOnce::call_once::h186735897b2025a5
                        at /checkout/src/libcore/ops/function.rs:223
  13:     0x55555719ca9a - <std::panic::AssertUnwindSafe<F> as core::ops::function::FnOnce<()>>::call_once::hbb4f7205feb471c0
                        at /checkout/src/libstd/panic.rs:293
  14:     0x555556cbd004 - std::panicking::try::do_call::h4d1a9a56dcae61dd
                        at /checkout/src/libstd/panicking.rs:479
  15:     0x55555bd3689e - __rust_maybe_catch_panic
                        at libpanic_unwind/lib.rs:102
  16:     0x555556c176b5 - std::panicking::try::h92d9b7a45a45ee1a
                        at /checkout/src/libstd/panicking.rs:458
  17:     0x5555571f2c81 - std::panic::catch_unwind::hf71463dd3ebcc204
                        at /checkout/src/libstd/panic.rs:358
  18:     0x5555565a1f0e - mozjs::panic::wrap_panic::h4c004bcd5a8ff123
                        at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/mozjs-0.1.11/src/panic.rs:22
  19:     0x555556410ecd - script::dom::bindings::codegen::Bindings::HTMLTableElementBinding::HTMLTableElementBinding::set_caption::h59b1814bfdd9b46c
                        at /shared/dev/rust/servo/target/debug/build/script-c42abaa61a41d086/out/Bindings/HTMLTableElementBinding.rs:505
  20:     0x55555afc86dc - CallJitSetterOp
                        at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/mozjs-0.1.11/src/jsglue.cpp:507
  21:     0x555556d8ad89 - script::dom::bindings::utils::call_setter::h66a3ab659084904e
                        at components/script/dom/bindings/utils.rs:484
  22:     0x555556d8abd2 - script::dom::bindings::utils::generic_call::hd6e59bcf9f7cf856
                        at components/script/dom/bindings/utils.rs:450
  23:     0x555556d8aeab - script::dom::bindings::utils::generic_setter::ha4c819f943d380bf
                        at components/script/dom/bindings/utils.rs:496
  24:     0x55555b64470b - _ZN2js12CallJSNativeEP9JSContextPFbS1_jPN2JS5ValueEERKNS2_8CallArgsE
                        at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/mozjs_sys-0.50.0/mozjs/js/src/jscntxtinlines.h:232
  25:     0x55555b612b63 - _ZN2js23InternalCallOrConstructEP9JSContextRKN2JS8CallArgsENS_14MaybeConstructE
                        at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/mozjs_sys-0.50.0/mozjs/js/src/vm/Interpreter.cpp:453
  26:     0x55555b612e8a - InternalCall
                        at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/mozjs_sys-0.50.0/mozjs/js/src/vm/Interpreter.cpp:498
  27:     0x55555b612f1c - _ZN2js4CallEP9JSContextN2JS6HandleINS2_5ValueEEES5_RKNS_13AnyInvokeArgsENS2_13MutableHandleIS4_EE
                        at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/mozjs_sys-0.50.0/mozjs/js/src/vm/Interpreter.cpp:517
  28:     0x55555b613893 - _ZN2js10CallSetterEP9JSContextN2JS6HandleINS2_5ValueEEES5_S5_
                        at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/mozjs_sys-0.50.0/mozjs/js/src/vm/Interpreter.cpp:644
  29:     0x55555b6386e4 - SetExistingProperty
                        at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/mozjs_sys-0.50.0/mozjs/js/src/vm/NativeObject.cpp:2364
  30:     0x55555b638985 - _ZN2js17NativeSetPropertyEP9JSContextN2JS6HandleIPNS_12NativeObjectEEENS3_I4jsidEENS3_INS2_5ValueEEESA_NS_13QualifiedBoolERNS2_14ObjectOpResultE
                        at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/mozjs_sys-0.50.0/mozjs/js/src/vm/NativeObject.cpp:2399
  31:     0x55555b01e25d - _ZN2js11SetPropertyEP9JSContextN2JS6HandleIP8JSObjectEENS3_I4jsidEENS3_INS2_5ValueEEESA_RNS2_14ObjectOpResultE
                        at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/mozjs_sys-0.50.0/mozjs/js/src/vm/NativeObject.h:1498
  32:     0x55555b611c9a - SetPropertyOperation
                        at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/mozjs_sys-0.50.0/mozjs/js/src/vm/Interpreter.cpp:256
  33:     0x55555b61e642 - Interpret
                        at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/mozjs_sys-0.50.0/mozjs/js/src/vm/Interpreter.cpp:2666
  34:     0x55555b6127e5 - _ZN2js9RunScriptEP9JSContextRNS_8RunStateE
                        at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/mozjs_sys-0.50.0/mozjs/js/src/vm/Interpreter.cpp:399
  35:     0x55555b613ba8 - _ZN2js13ExecuteKernelEP9JSContextN2JS6HandleIP8JSScriptEER8JSObjectRKNS2_5ValueENS_16AbstractFramePtrEPS9_
                        at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/mozjs_sys-0.50.0/mozjs/js/src/vm/Interpreter.cpp:679
  36:     0x55555b613e68 - _ZN2js7ExecuteEP9JSContextN2JS6HandleIP8JSScriptEER8JSObjectPNS2_5ValueE
                        at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/mozjs_sys-0.50.0/mozjs/js/src/vm/Interpreter.cpp:712
  37:     0x55555b383575 - Evaluate
                        at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/mozjs_sys-0.50.0/mozjs/js/src/jsapi.cpp:4407
  38:     0x55555b3838b0 - Evaluate
                        at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/mozjs_sys-0.50.0/mozjs/js/src/jsapi.cpp:4443
  39:     0x55555b383e30 - _ZN2JS8EvaluateEP9JSContextRKNS_22ReadOnlyCompileOptionsEPKDsmNS_13MutableHandleINS_5ValueEEE
                        at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/mozjs_sys-0.50.0/mozjs/js/src/jsapi.cpp:4501
  40:     0x555557e706dd - script::dom::globalscope::GlobalScope::evaluate_script_on_global_with_result::{{closure}}::h7bf2bb0929e0e25d
                        at components/script/dom/globalscope.rs:436
  41:     0x555557450010 - profile_traits::time::profile::hbf6dcf1d93804b47
                        at /shared/dev/rust/servo/components/profile_traits/time.rs:125
  42:     0x55555730f16f - script::dom::globalscope::GlobalScope::evaluate_script_on_global_with_result::hd1911ebacd270539
                        at components/script/dom/globalscope.rs:420
  43:     0x555557e5bd36 - script::dom::htmlscriptelement::HTMLScriptElement::run_a_classic_script::h3b334b667fd07e79
                        at components/script/dom/htmlscriptelement.rs:569
  44:     0x555557e5b6a5 - script::dom::htmlscriptelement::HTMLScriptElement::execute::h27de2be985b6d380
                        at components/script/dom/htmlscriptelement.rs:539
  45:     0x555557e599ce - script::dom::htmlscriptelement::HTMLScriptElement::prepare::h0bf9aaefbde948b9
                        at components/script/dom/htmlscriptelement.rs:452
  46:     0x555557836ced - script::dom::servoparser::ServoParser::tokenize::h31a9365128961658
                        at components/script/dom/servoparser/mod.rs:473
  47:     0x555556ea6aa7 - script::dom::servoparser::ServoParser::do_parse_sync::h50d2ab5721caeba0
                        at components/script/dom/servoparser/mod.rs:428
  48:     0x5555578369df - script::dom::servoparser::ServoParser::parse_sync::{{closure}}::h1462cf09a60d4c29
                        at components/script/dom/servoparser/mod.rs:414
  49:     0x55555744f26c - profile_traits::time::profile::h3ee38b43bfd66da8
                        at /shared/dev/rust/servo/components/profile_traits/time.rs:125
  50:     0x555556ea680e - script::dom::servoparser::ServoParser::parse_sync::hbfdd1ab20871bc24
                        at components/script/dom/servoparser/mod.rs:411
  51:     0x555556ea6d5d - script::dom::servoparser::ServoParser::parse_bytes_chunk::h16e8fbfb7dd3c5b1
                        at components/script/dom/servoparser/mod.rs:453
  52:     0x555556ea9763 - <script::dom::servoparser::ParserContext as net_traits::FetchResponseListener>::process_response_chunk::hd39bc0737ace4c74
                        at components/script/dom/servoparser/mod.rs:720
  53:     0x55555716227f - script::script_thread::ScriptThread::handle_fetch_chunk::he3a3109d5a4602f5
                        at components/script/script_thread.rs:2542
  54:     0x55555714d2e3 - script::script_thread::ScriptThread::handle_msg_from_constellation::h9dc40d80a0c2fb5a
                        at components/script/script_thread.rs:1269
  55:     0x5555573298bc - script::script_thread::ScriptThread::handle_msgs::{{closure}}::hadc6814adf9864cb
                        at components/script/script_thread.rs:1074
  56:     0x55555732be55 - script::script_thread::ScriptThread::profile_event::hdaa78467182b37a8
                        at components/script/script_thread.rs:1247
  57:     0x55555714a10d - script::script_thread::ScriptThread::handle_msgs::he274484626a8c86d
                        at components/script/script_thread.rs:1068
  58:     0x555557147dfb - script::script_thread::ScriptThread::start::h64c6368a6c1c1b4b
                        at components/script/script_thread.rs:900
  59:     0x55555732706c - <script::script_thread::ScriptThread as script_traits::ScriptThreadFactory>::create::{{closure}}::{{closure}}::h07852e545a49cf41
                        at components/script/script_thread.rs:581
  60:     0x555557c58d44 - profile_traits::mem::ProfilerChan::run_with_memory_reporting::hc6605068ad7df8fb
                        at /shared/dev/rust/servo/components/profile_traits/mem.rs:63
  61:     0x555557327633 - <script::script_thread::ScriptThread as script_traits::ScriptThreadFactory>::create::{{closure}}::h781e4f44138bb56a
                        at components/script/script_thread.rs:580
  62:     0x55555863e0f4 - std::sys_common::backtrace::__rust_begin_short_backtrace::h43c7dd6ba30580c1
                        at /checkout/src/libstd/sys_common/backtrace.rs:133
  63:     0x55555824325b - std::thread::Builder::spawn::{{closure}}::{{closure}}::h01e3a1603aad539e
                        at /checkout/src/libstd/thread/mod.rs:406
  64:     0x5555571abf74 - <std::panic::AssertUnwindSafe<F> as core::ops::function::FnOnce<()>>::call_once::hf399303cba3a63fc
                        at /checkout/src/libstd/panic.rs:293
  65:     0x555556cde684 - std::panicking::try::do_call::h939bd3fa9280fd7e
                        at /checkout/src/libstd/panicking.rs:479
  66:     0x55555bd3689e - __rust_maybe_catch_panic
                        at libpanic_unwind/lib.rs:102
  67:     0x555556c51bdc - std::panicking::try::hc37830de544179f7
                        at /checkout/src/libstd/panicking.rs:458
  68:     0x5555571c358c - std::panic::catch_unwind::h4c51de2d7de9c711
                        at /checkout/src/libstd/panic.rs:358
  69:     0x555558242ba8 - std::thread::Builder::spawn::{{closure}}::hcf0e50747d57cf40
                        at /checkout/src/libstd/thread/mod.rs:405
  70:     0x555558243945 - <F as alloc::boxed::FnBox<A>>::call_box::hd0c845f7b3061ed8
                        at /checkout/src/liballoc/boxed.rs:788
  71:     0x55555bd215db - <alloc::boxed::Box<alloc::boxed::FnBox<A, Output$u3d$R$GT$$u20$$u2b$$u20$$u27$a$GT$$u20$as$u20$core..ops..function..FnOnce$LT$A$GT$$GT$::call_once::h13f1b0bf377a9f5b
                        at /checkout/src/liballoc/boxed.rs:798
                         - std::sys_common::thread::start_thread::hb5b6e0447b9691dc
                        at libstd/sys_common/thread.rs:24
                         - std::sys::unix::thread::Thread::new::thread_start::hcaff0bef1a01c624
                        at libstd/sys/unix/thread.rs:90
  72:     0x7ffff6eb0493 - start_thread
  73:     0x7ffff5479abe - __clone
  74:                0x0 - <unknown>
ERROR:servo: Insertion failed: HierarchyRequest
Pipeline failed in hard-fail mode.  Crashing!
Servo exited with return value 1
@jdm
Copy link
Member

@jdm jdm commented Mar 6, 2018

@ShreyKumar This may be a more approachable issue if you'd like to investigate it.
@jooh-kim
Copy link

@jooh-kim jooh-kim commented Mar 10, 2018

@jdm hi can I try this if @ShreyKumar is not working on it
@ShreyKumar
Copy link

@ShreyKumar ShreyKumar commented Mar 10, 2018

@kjhyung Didn't get the chance to look at it as of yet, but I should have a solution by the end of the week. If I don't, I'll let you know and your can feel free to take over it.

Apologies for the delay!
@jdm
Copy link
Member

@jdm jdm commented Mar 25, 2018

@ShreyKumar Have you made any progress on this task?
@dralley
Copy link
Contributor

@dralley dralley commented Mar 25, 2020

This test snippet is still failing
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
A-content/dom C-has-manual-testcase E-candidate-for-mentoring I-panic
Projects
None yet
Milestone
No milestone
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
5 participants
@jdm @mateon1 @dralley @jooh-kim @ShreyKumar
You can’t perform that action at this time.