assertion failed: self.is_char_boundary(new_len) in DOMString::strip_leading_and_trailing_ascii_whitespace

[mateon1]

Found with domato.

<input type=url value="#β">

The beta character is encoded as ce b2, so it's weird that an ascii whitespace function tries to split it at a non-char boundary.

Debug backtrace

VMware, Inc.
softpipe
3.3 (Core Profile) Mesa 18.1.0-devel
assertion failed: self.is_char_boundary(new_len) (thread ScriptThread PipelineId { namespace_id: PipelineNamespaceId(1), index: PipelineIndex(1) }, at liballoc/string.rs:1124)
stack backtrace:
   0:     0x55555d570455 - backtrace::backtrace::libunwind::trace::h5a7d69c1dde2f97a
                        at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-0.3.9/src/backtrace/libunwind.rs:53
                         - backtrace::backtrace::trace::h2ff046c6ef6faf17
                        at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-0.3.9/src/backtrace/mod.rs:42
   1:     0x55555d56a92e - backtrace::capture::Backtrace::new_unresolved::h6f5eb002a9e7663c
                        at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-0.3.9/src/capture.rs:88
   2:     0x55555d56a88c - backtrace::capture::Backtrace::new::hd6d9f14f8b25e0cd
                        at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-0.3.9/src/capture.rs:63
   3:     0x555555a4a652 - servo::main::{{closure}}::h0785a7014067d8fa
                        at ports/servo/non_android_main.rs:134
   4:     0x55555d5ad4e3 - std::panicking::rust_panic_with_hook::hd470ff3b3e7a1b18
                        at libstd/panicking.rs:480
   5:     0x55555d5ad049 - std::panicking::continue_panic_fmt::hf0cf39ae1e114602
                        at libstd/panicking.rs:390
   6:     0x55555d5acf45 - rust_begin_unwind
                        at libstd/panicking.rs:325
   7:     0x55555d5ce1eb - core::panicking::panic_fmt::hf53111ba26d35bb0
                        at libcore/panicking.rs:77
   8:     0x55555d5ce11a - core::panicking::panic::h1b11496bce256cfc
                        at libcore/panicking.rs:52
   9:     0x55555677c059 - alloc::string::String::truncate::h4351ec13976caf0f
                        at /shared/dev/rust/servo/<::core::macros::panic macros>:3
  10:     0x5555564da3f9 - script::dom::bindings::str::DOMString::strip_leading_and_trailing_ascii_whitespace::h5b5bdf542c8710b6
                        at components/script/dom/bindings/str.rs:194
  11:     0x55555661ddac - script::dom::htmlinputelement::HTMLInputElement::sanitize_value::h7431cbffa6041cfb
                        at components/script/dom/htmlinputelement.rs:1133
  12:     0x55555661f4b5 - <script::dom::htmlinputelement::HTMLInputElement as script::dom::virtualmethods::VirtualMethods>::attribute_mutated::h36313a9f559da634
                        at components/script/dom/htmlinputelement.rs:1333
  13:     0x55555707de45 - script::dom::element::Element::push_attribute::h9419ad8ac769ea85
                        at components/script/dom/element.rs:1278
  14:     0x55555707d232 - script::dom::element::Element::push_new_attribute::h26b3e8d55c9fa397
                        at components/script/dom/element.rs:1254
  15:     0x55555707e994 - script::dom::element::Element::set_attribute_from_parser::hae96e94af1021f1c
                        at components/script/dom/element.rs:1328
  16:     0x5555564f1165 - script::dom::servoparser::create_element_for_token::h57d26d93251fef85
                        at components/script/dom/servoparser/mod.rs:1127
  17:     0x5555564eeeb1 - <script::dom::servoparser::Sink as markup5ever::interface::tree_builder::TreeSink>::create_element::heaa07117c2844628
                        at components/script/dom/servoparser/mod.rs:903
  18:     0x555556ec198a - markup5ever::interface::tree_builder::create_element::h48dfe666076f4355
                        at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/markup5ever-0.7.1/interface/tree_builder.rs:85
  19:     0x5555568d6e01 - <html5ever::tree_builder::TreeBuilder<Handle, Sink>>::insert_element::h3e56a6e534fb7f1a
                        at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/html5ever-0.22.3/src/tree_builder/mod.rs:1175
  20:     0x5555568f408b - <html5ever::tree_builder::TreeBuilder<Handle, Sink>>::insert_and_pop_element_for::h1cf98aa981bf90aa
                        at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/html5ever-0.22.3/src/tree_builder/mod.rs:1214
  21:     0x55555691a522 - <html5ever::tree_builder::TreeBuilder<Handle, Sink>>::step::h70817928eed389a6
                        at /shared/dev/rust/servo/target/debug/build/html5ever-3f9449eef27e30d3/out/rules.rs:659
  22:     0x5555568eed53 - <html5ever::tree_builder::TreeBuilder<Handle, Sink>>::process_to_completion::hadfe09c68ae96fdf
                        at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/html5ever-0.22.3/src/tree_builder/mod.rs:312
  23:     0x5555568ccc9c - <html5ever::tree_builder::TreeBuilder<Handle, Sink> as html5ever::tokenizer::interface::TokenSink>::process_token::hde94f991438d9741
                        at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/html5ever-0.22.3/src/tree_builder/mod.rs:474
  24:     0x555558256720 - <html5ever::tokenizer::Tokenizer<Sink>>::process_token::h5db34b47a5a1b645
                        at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/html5ever-0.22.3/src/tokenizer/mod.rs:232
  25:     0x5555582588b2 - <html5ever::tokenizer::Tokenizer<Sink>>::emit_current_tag::h38bd1e767693a21d
                        at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/html5ever-0.22.3/src/tokenizer/mod.rs:425
  26:     0x555558262359 - <html5ever::tokenizer::Tokenizer<Sink>>::step::h9b97ad880c50e93a
                        at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/html5ever-0.22.3/src/tokenizer/mod.rs:628
  27:     0x55555825cb0e - <html5ever::tokenizer::Tokenizer<Sink>>::run::h59625012e3150494
                        at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/html5ever-0.22.3/src/tokenizer/mod.rs:361
  28:     0x55555825d4f2 - <html5ever::tokenizer::Tokenizer<Sink>>::feed::habdc3f55ec1f014b
                        at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/html5ever-0.22.3/src/tokenizer/mod.rs:219
  29:     0x5555568b8f89 - script::dom::servoparser::html::Tokenizer::feed::h9e324db59aafaf4e
                        at components/script/dom/servoparser/html.rs:80
  30:     0x5555564eb144 - script::dom::servoparser::Tokenizer::feed::hbd9c0f79386bfb29
                        at components/script/dom/servoparser/mod.rs:607
  31:     0x5555576d6546 - script::dom::servoparser::ServoParser::do_parse_sync::{{closure}}::he0303e414e727f31
                        at components/script/dom/servoparser/mod.rs:485
  32:     0x5555576d6afd - script::dom::servoparser::ServoParser::tokenize::h8a23ff50831af948
                        at components/script/dom/servoparser/mod.rs:523
  33:     0x5555564ea8f6 - script::dom::servoparser::ServoParser::do_parse_sync::h5e44997d49fbc5db
                        at components/script/dom/servoparser/mod.rs:485
  34:     0x5555576d64d0 - script::dom::servoparser::ServoParser::parse_sync::{{closure}}::hbb2c76105baa7ae4
                        at components/script/dom/servoparser/mod.rs:468
  35:     0x5555566402d3 - profile_traits::time::profile::hadd174858a740ca4
                        at /shared/dev/rust/servo/components/profile_traits/time.rs:144
  36:     0x5555564ea623 - script::dom::servoparser::ServoParser::parse_sync::h85dc42812dd1414f
                        at components/script/dom/servoparser/mod.rs:460
  37:     0x5555564eabde - script::dom::servoparser::ServoParser::parse_bytes_chunk::h1c302d4217339c2f
                        at components/script/dom/servoparser/mod.rs:510
  38:     0x5555564edc8b - <script::dom::servoparser::ParserContext as net_traits::FetchResponseListener>::process_response_chunk::h67b293b5afa890e8
                        at components/script/dom/servoparser/mod.rs:783
  39:     0x5555566669cd - script::script_thread::ScriptThread::handle_fetch_chunk::h8f57b39126cce2ed
                        at components/script/script_thread.rs:3083
  40:     0x55555664d959 - script::script_thread::ScriptThread::handle_msg_from_constellation::h1f2edf27f4aec209
                        at components/script/script_thread.rs:1456
  41:     0x5555578ff55a - script::script_thread::ScriptThread::handle_msgs::{{closure}}::hc3aa9243476fb0f2
                        at components/script/script_thread.rs:1240
  42:     0x555557900495 - script::script_thread::ScriptThread::profile_event::h2b5a5bc958b8dc56
                        at components/script/script_thread.rs:1427
  43:     0x555556649c3a - script::script_thread::ScriptThread::handle_msgs::h8be053c9a8660ab6
                        at components/script/script_thread.rs:1234
  44:     0x555556646a77 - script::script_thread::ScriptThread::start::he81fad5c77ea48bd
                        at components/script/script_thread.rs:1085
  45:     0x5555578fc430 - <script::script_thread::ScriptThread as script_traits::ScriptThreadFactory>::create::{{closure}}::{{closure}}::hdea6608b226bc2d5
                        at components/script/script_thread.rs:682
  46:     0x5555566eef89 - profile_traits::mem::ProfilerChan::run_with_memory_reporting::h9073a639e4ad9e52
                        at /shared/dev/rust/servo/components/profile_traits/mem.rs:89
  47:     0x5555578fcb9b - <script::script_thread::ScriptThread as script_traits::ScriptThreadFactory>::create::{{closure}}::hf227da4f2f1833f3
                        at components/script/script_thread.rs:680
  48:     0x55555869ecc4 - std::sys_common::backtrace::__rust_begin_short_backtrace::h87bcc8543b26b323
                        at libstd/sys_common/backtrace.rs:136
  49:     0x5555578297d6 - std::thread::Builder::spawn::{{closure}}::{{closure}}::h1cb888000f0d70f5
                        at libstd/thread/mod.rs:409
  50:     0x5555589a5be6 - <std::panic::AssertUnwindSafe<F> as core::ops::function::FnOnce<()>>::call_once::h81f4f7359de0b03a
                        at libstd/panic.rs:313
  51:     0x555558bd3139 - std::panicking::try::do_call::h4fcc019d6d8abaf6
                        at libstd/panicking.rs:310
  52:     0x55555d5bf359 - __rust_maybe_catch_panic
                        at libpanic_unwind/lib.rs:102
  53:     0x555558a7c9b0 - std::panicking::try::h2625242efbb0ff0b
                        at libstd/panicking.rs:289
  54:     0x555558a10c86 - std::panic::catch_unwind::hefa5e9a90b2b9981
                        at libstd/panic.rs:392
  55:     0x5555578274a2 - std::thread::Builder::spawn::{{closure}}::h03b20afc4f31359d
                        at libstd/thread/mod.rs:408
  56:     0x555557829a83 - <F as alloc::boxed::FnBox<A>>::call_box::h18996c2e8313cffd
                        at liballoc/boxed.rs:672
  57:     0x55555d5aa43a - <alloc::boxed::Box<(dyn alloc::boxed::FnBox<A, Output$u3d$R$GT$$u20$$u2b$$u20$$u27$a$RP$$GT$$u20$as$u20$core..ops..function..FnOnce$LT$A$GT$$GT$::call_once::h9d1cd498499ed135
                        at liballoc/boxed.rs:682
                         - std::sys_common::thread::start_thread::ha4bfe77455e6e434
                        at libstd/sys_common/thread.rs:24
  58:     0x55555d5979b5 - std::sys::unix::thread::Thread::new::thread_start::hebe133da3ea5230a
                        at libstd/sys/unix/thread.rs:90
  59:     0x7ffff7f7ff29 - start_thread
  60:     0x7ffff6b7bede - __clone
  61:                0x0 - <unknown>
ERROR 2018-10-16T16:57:15Z: servo: assertion failed: self.is_char_boundary(new_len)

[jdm]

rfind returns a byte index, and truncate accepts a byte index. We add 1 to the returned index, which does not guarantee that the new index is a character boundary.

[jdm]

We could solve this by calling split_at on the index that is found, and calling char_indices on the second string then using nth(1) to get the byte index that we need to add to the original byte index that is obtained from rfind.

[highfive]

Hi! If you have any questions regarding this issue, feel free to make a comment here, or ask it in the #servo channel in IRC.

If you intend to work on this issue, then add @highfive: assign me to your comment, and I'll assign this to you. 😄

[jdm]

We'll want to add a new testcase to tests/wpt/mozilla/tests/mozilla/ that verifies the value of the value attribute of the HTMLInputElement. This can be run with ./mach test-wpt tests/wpt/mozilla/tests/mozilla/new_test.html if the new test file is called new_test.html

[jimberlage]

Can I take this on?

[jdm]

Please do! Ask questions if anything is unclear!