Crash in dom/nodes/Element-matches.html

[pshaughn]

This test has a lot of code in common with #25123 so could share a crash cause. This time, however, I was able to get it to crash while gdb was on.

Thread 22 "Constellation" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffa75ff700 (LWP 2389)]
__strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:62
62	../sysdeps/x86_64/multiarch/strlen-avx2.S: No such file or directory.
(gdb) bt
#0  __strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:62
#1  0x000055555e49a048 in backtrace::symbolize::libbacktrace::Symbol::name::{{closure}} (
    ptr=0x7fff95e21fc1 <error: Cannot access memory at address 0x7fff95e21fc1>)
    at /home/pshaughn/.cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-0.3.38/src/symbolize/libbacktrace.rs:67
#2  0x000055555e499ece in backtrace::symbolize::libbacktrace::Symbol::name (
    self=0x7fffa75f0330)
    at /home/pshaughn/.cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-0.3.38/src/symbolize/libbacktrace.rs:76
#3  0x000055555e49c52e in backtrace::symbolize::Symbol::name (
    self=0x7fffa75f0330)
    at /home/pshaughn/.cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-0.3.38/src/symbolize/mod.rs:208
#4  0x000055555e452c71 in background_hang_monitor::sampler::NativeStack::to_hangprofile::{{closure}} (symbol=0x7fffa75f0330)
    at components/background_hang_monitor/sampler.rs:85
#5  0x000055555e49a89e in backtrace::symbolize::libbacktrace::resolve::{{closure}} (sym=0x7fffa75f0330)
    at /home/pshaughn/.cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-0.3.38/src/symbolize/libbacktrace.rs:448
#6  0x000055555e49a505 in backtrace::symbolize::libbacktrace::syminfo_cb (
    data=0x7fffa75f04b0, pc=93825078898084, 
---Type <return> to continue, or q <return> to quit---
    symname=0x7fff95e21fc1 <error: Cannot access memory at address 0x7fff95e21fc1>, _symval=93825078896944, _symsize=1496)
    at /home/pshaughn/.cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-0.3.38/src/symbolize/libbacktrace.rs:197
#7  0x000055555e4a96a5 in elf_syminfo (state=0x7fffa80bb330, 
    addr=93825078898084, 
    callback=0x55555e49a3e0 <backtrace::symbolize::libbacktrace::syminfo_cb>, 
    error_callback=0x55555e49a3c0 <backtrace::symbolize::libbacktrace::error_cb>, data=0x7fffa75f04b0) at src/libbacktrace/elf.c:760
#8  0x000055555e4a751a in __rbt_backtrace_syminfo (state=0x7fffa80bb330, 
    pc=93825078898084, 
    callback=0x55555e49a3e0 <backtrace::symbolize::libbacktrace::syminfo_cb>, 
    error_callback=0x55555e49a3c0 <backtrace::symbolize::libbacktrace::error_cb>, data=0x7fffa75f04b0) at src/libbacktrace/fileline.c:199
#9  0x000055555e49a7f9 in backtrace::symbolize::libbacktrace::resolve (
    what=..., cb=...)
    at /home/pshaughn/.cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-0.3.38/src/symbolize/libbacktrace.rs:451
#10 0x000055555e4235d0 in backtrace::symbolize::resolve_unsynchronized (addr=
    0x55555a7fada5 <js::jit::EnterBaselineAtBranch(JSContext*, js::InterpreterFrame*, unsigned char*)+1141>, cb=...)
    at /home/pshaughn/.cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-0.3.38/src/symbolize/mod.rs:162
---Type <return> to continue, or q <return> to quit---
#11 0x000055555e423660 in backtrace::symbolize::resolve (warning: (Internal error: pc 0x55555e41a3fb in read in psymtab, but not in symtab.)

warning: (Internal error: pc 0x55555e41a240 in read in psymtab, but not in symtab.)

warning: (Internal error: pc 0x55555e41a3fb in read in psymtab, but not in symtab.)

warning: (Internal error: pc 0x55555e41a3fb in read in psymtab, but not in symtab.)


addr=0x55555a7fada5 <js::jit::EnterBaselineAtBranch(JSContext*, js::InterpreterFrame*, unsigned char*)+1141>, warning: (Internal error: pc 0x55555e41a3fb in read in psymtab, but not in symtab.)

cb=...)
    at /home/pshaughn/.cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-0.3.38/src/symbolize/mod.rs:63
warning: (Internal error: pc 0x55555e41a3fb in read in psymtab, but not in symtab.)

warning: (Internal error: pc 0x55555e41a3fb in read in psymtab, but not in symtab.)

#12 0x000055555e41a3fc in background_hang_monitor::sampler::NativeStack::to_hangprofile (warning: (Internal error: pc 0x55555e41a3fb in read in psymtab, but not in symtab.)

warning: (Internal error: pc 0x55555e41a3fb in read in psymtab, but not in symtab.)

self=0x7fffa75f4790)
    at components/background_hang_monitor/sampler.rs:83
#13 0x000055555e3f098c in background_hang_monitor::background_hang_monitor::BackgroundHangMonitorWorker::perform_a_hang_monitor_checkpoint (
    self=0x7fffa75f94f0)
    at components/background_hang_monitor/background_hang_monitor.rs:363
#14 0x000055555e3ef9f2 in background_hang_monitor::background_hang_monitor::BackgroundHangMonitorWorker::run (self=0x7fffa75f94f0)
    at components/background_hang_monitor/background_hang_monitor.rs:286
#15 0x000055555e44fa01 in background_hang_monitor::background_hang_monitor::HangMonitorRegister::init::{{closure}} ()
    at components/background_hang_monitor/background_hang_monitor.rs:34
#16 0x000055555e441841 in std::sys_common::backtrace::__rust_begin_short_backtrace (f=...)
    at /rustc/6d77e45f01079fe3d40180b3e256e414ab379f63/src/libstd/sys_common/backtrace.rs:136
#17 0x000055555e41d582 in std::thread::Builder::spawn_unchecked::{{closure}}::{{---Type <return> to continue, or q <return> to quit---
closure}} ()
    at /rustc/6d77e45f01079fe3d40180b3e256e414ab379f63/src/libstd/thread/mod.rs:469
#18 0x000055555e427652 in <std::panic::AssertUnwindSafe<F> as core::ops::function::FnOnce<()>>::call_once (self=..., _args=())
    at /rustc/6d77e45f01079fe3d40180b3e256e414ab379f63/src/libstd/panic.rs:318
#19 0x000055555e458641 in std::panicking::try::do_call (
    data=0x7fffa75f9790 "\340N\023\357\377\177")
    at /rustc/6d77e45f01079fe3d40180b3e256e414ab379f63/src/libstd/panicking.rs:292
#20 0x000055555f1099da in __rust_maybe_catch_panic ()
    at src/libpanic_unwind/lib.rs:78
#21 0x000055555e458537 in std::panicking::try (f=...)
    at /rustc/6d77e45f01079fe3d40180b3e256e414ab379f63/src/libstd/panicking.rs:270
#22 0x000055555e427692 in std::panic::catch_unwind (f=...)
    at /rustc/6d77e45f01079fe3d40180b3e256e414ab379f63/src/libstd/panic.rs:394
#23 0x000055555e41d366 in std::thread::Builder::spawn_unchecked::{{closure}} ()
    at /rustc/6d77e45f01079fe3d40180b3e256e414ab379f63/src/libstd/thread/mod.rs:468
#24 0x000055555e423704 in core::ops::function::FnOnce::call_once{{vtable-shim}}
    ()
    at /rustc/6d77e45f01079fe3d40180b3e256e414ab379f63/src/libcore/ops/function.---Type <return> to continue, or q <return> to quit---
rs:232
#25 0x000055555f0ee49f in <alloc::boxed::Box<F> as core::ops::function::FnOnce<A>>::call_once ()
    at /rustc/6d77e45f01079fe3d40180b3e256e414ab379f63/src/liballoc/boxed.rs:969
#26 0x000055555f108aa0 in <alloc::boxed::Box<F> as core::ops::function::FnOnce<A>>::call_once ()
    at /rustc/6d77e45f01079fe3d40180b3e256e414ab379f63/src/liballoc/boxed.rs:969
#27 std::sys_common::thread::start_thread ()
    at src/libstd/sys_common/thread.rs:13
#28 std::sys::unix::thread::Thread::new::thread_start ()
    at src/libstd/sys/unix/thread.rs:80
#29 0x00007ffff51a76db in start_thread (arg=0x7fffa75ff700)
    at pthread_create.c:463
#30 0x00007ffff36e288f in clone ()
    at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

[pshaughn]

This seems to be the same hang-monitor/backtrace crash as #24984, although the underlying reason it ended up in the hang monitor presumably differs (and is hidden by backtrace crashing).

[MeFisto94]

With my fix to the backtrace crash I get:

 ./mach test-wpt tests/wpt/web-platform-tests/dom/nodes/Element-matches.html
 0:01.35 INFO Using 8 client processes
 0:01.38 INFO Starting http server on 127.0.0.1:8000
 0:01.39 INFO Starting http server on 127.0.0.1:8001
 0:01.41 INFO Starting https server on 127.0.0.1:8443
 0:01.90 SUITE_START: web-platform-test - running 1 tests
 0:01.90 INFO Running reftest tests
 0:01.90 INFO No reftest tests to run
 0:01.91 INFO Running wdspec tests
 0:01.91 INFO No wdspec tests to run
 0:01.91 INFO Running testharness tests
 0:01.92 INFO Starting runner
 0:01.94 INFO No more tests
 0:01.95 INFO No more tests
 0:01.95 INFO No more tests
 0:01.95 INFO No more tests
 0:01.95 TEST_START: /dom/nodes/Element-matches.html
 0:01.95 INFO No more tests
 0:01.96 WARNING Got command init_succeeded in state running
 0:01.96 INFO No more tests
 0:01.96 INFO No more tests
 0:21.29 INFO Pausing until the browser exits
 0:21.32 TEST_END: Test OK. Subtests passed 669/669. Unexpected 0
 0:21.32 INFO Pausing until the browser exits
 0:21.32 INFO No more tests
 0:21.33 INFO Closing logging queue
 0:21.33 INFO queue closed
 0:21.33 INFO Got 0 unexpected results
 0:21.33 SUITE_END

web-platform-test
~~~~~~~~~~~~~~~~~
Ran 670 checks (669 subtests, 1 tests)
Expected results: 670
Unexpected results: 0
OK
 0:21.36 INFO Closing logging queue
 0:21.36 INFO queue closed

So this might be working now, however in one launch I got a "harness timeout" as well.
I'll try to make a dev-hotfix available for the backtrace crash so that people can start testing again and successfully have the hangmonitor and panics work.

[pshaughn]

The underlying crash cause is almost definitely that the test is so slow on my hardware that Servo's hang-monitor kicks in and shuts things down; if your patch is doing it cleanly to give a harness timeout, then that's probably as much of a "fix" as there can be without refactoring the test into multiple smaller test files.

[pshaughn]

Not reproducing; #25248 has probably taken care of it. Still times out as a slow test for me if I'm running the entire dom/nodes tree, but there's no crash to report.