Panic with window.close() while loading

[Ms2ger]

<script>window.close()</script>

yields

task 'ScriptTask' panicked at 'DOMRefCell<T> already mutably borrowed', dom/bindings/cell.rs:114
stack backtrace:
   1:     0x7f1c609b94b0 - rt::backtrace::imp::write::hcd80980f0951bf03BOx
   2:     0x7f1c609bc530 - failure::on_fail::h0784b2f3b5063f7b1fy
   3:     0x7f1c609ca1e0 - unwind::begin_unwind_inner::hbb866c9343c337b3CJc
   4:     0x7f1c5f9a3d90 - unwind::begin_unwind::h1946920992721505390
   5:     0x7f1c5ff30530 - dom::bindings::cell::DOMRefCell<T>::borrow::h6647382296015569052
   6:     0x7f1c5ff302a0 - dom::bindings::cell::DOMRefCell<T>.JSTraceable::trace::h12291188692538380500
   7:     0x7f1c5fe246f0 - page::Page...dom..bindings..trace..JSTraceable::trace::h079587a93c6de55fv9z
   8:     0x7f1c5fe24670 - dom::bindings::trace::Rc<T>.JSTraceable::trace::h13647790880912478626
   9:     0x7f1c5fcc8330 - dom::window::Window...dom..bindings..trace..JSTraceable::trace::h573bc2a9db567289F6v
  10:     0x7f1c5fcc82d0 - dom::bindings::codegen::Bindings::WindowBinding::_trace::__rust_abi
  11:     0x7f1c5fcc8280 - dom::bindings::codegen::Bindings::WindowBinding::_trace::h7979c23eb8c53aa7wDP
  12:     0x7f1c60127090 - _ZN2js8GCMarker14drainMarkStackERNS_11SliceBudgetE
  13:     0x7f1c6000a970 - _ZL23IncrementalCollectSliceP9JSRuntimelN2js8gcreason6ReasonENS1_18JSGCInvocationKindE
  14:     0x7f1c6000c9b0 - _ZL7GCCycleP9JSRuntimeblN2js18JSGCInvocationKindENS1_8gcreason6ReasonE
  15:     0x7f1c6000cdc0 - _ZL7CollectP9JSRuntimeblN2js18JSGCInvocationKindENS1_8gcreason6ReasonE
  16:     0x7f1c600bc2d0 - _ZN2js14DestroyContextEP9JSContextNS_18DestroyContextModeE
  17:     0x7f1c5fffc050 - rust::Cx.Drop::drop::had5fc4f17f5ef9e8THc
  18:     0x7f1c5facb1c0 - js..rust..Cx::glue_drop.73193::hfc7292ab8f2eeece
  19:     0x7f1c5facae10 - rc::Rc<T>.Drop::drop::h1122422698880205348
  20:     0x7f1c5facade0 - alloc..rc..Rc<js..rust..Cx>::glue_drop.73190::hd18b0ee059869eb7
  21:     0x7f1c5fbe5aa0 - page..JSPageInfo::glue_drop.77461::h697468fcdd7b7ab4
  22:     0x7f1c5fbe5a30 - core..option..Option<page..JSPageInfo>::glue_drop.77458::hbe1cdcb2ea0bbce2
  23:     0x7f1c5ffac010 - script_task::shut_down_layout::h243cd83a7ef6f496y5B
  24:     0x7f1c5ffa3730 - script_task::ScriptTask::handle_exit_pipeline_msg::h7c0a51703d28a88e0oB
  25:     0x7f1c5ff7ffc0 - script_task::ScriptTask::handle_msgs::h6c1c333160890298Y4A
  26:     0x7f1c5ff7ff70 - script_task::ScriptTask::start::h338fddbb07fdf5d1N4A
  27:     0x7f1c5f3909d0 - script_task::ScriptTask.ScriptTaskFactory::create::closure.9888
  28:     0x7f1c5f38d240 - task::spawn_named_with_send_on_failure::closure.9803
  29:     0x7f1c5f382a30 - task::TaskBuilder::try_future::closure.9633
  30:     0x7f1c609c8510 - task::Task::spawn::closure.5731
  31:     0x7f1c609cad80 - rust_try_inner
  32:     0x7f1c609cad70 - rust_try
  33:     0x7f1c609c85e0 - unwind::try::hf0141b63ff6a0a11Tyc
  34:     0x7f1c609c83b0 - task::Task::run::hcbcff3a8c16a161bfKb
  35:     0x7f1c609c7fa0 - task::Task::spawn::closure.5707
  36:     0x7f1c609c94b0 - thread::thread_start::h5cd59b116a732721w1b
  37:     0x7f1c5d62fdc0 - start_thread
  38:                0x0 - <unknown>
task 'ScriptTask' panicked at 'DOMRefCell<T> already borrowed', dom/bindings/cell.rs:131
stack backtrace:
   1:     0x7f1c609b94b0 - rt::backtrace::imp::write::hcd80980f0951bf03BOx
   2:     0x7f1c609bc530 - failure::on_fail::h0784b2f3b5063f7b1fy
   3:     0x7f1c609ca1e0 - unwind::begin_unwind_inner::hbb866c9343c337b3CJc
   4:     0x7f1c5f9a3d90 - unwind::begin_unwind::h1946920992721505390
   5:     0x7f1c5ff401a0 - dom::bindings::cell::DOMRefCell<T>::borrow_mut::h15351844905379172782
   6:     0x7f1c5ff40140 - page::Page::mut_js_info::h4520b2e335d29dfdjmA
   7:     0x7f1c5ff51160 - script_task::ScriptMemoryFailsafe<'a>.Drop::drop::h15f545aa0c01875feUA
   8:     0x7f1c5f3af600 - script..script_task..ScriptMemoryFailsafe<'_>::glue_drop.10747::h0bb4ca882d36ad02
   9:     0x7f1c5f3909d0 - script_task::ScriptTask.ScriptTaskFactory::create::closure.9888
  10:     0x7f1c5f38d240 - task::spawn_named_with_send_on_failure::closure.9803
  11:     0x7f1c5f382a30 - task::TaskBuilder::try_future::closure.9633
  12:     0x7f1c609c8510 - task::Task::spawn::closure.5731
  13:     0x7f1c609cad80 - rust_try_inner
  14:     0x7f1c609cad70 - rust_try
  15:     0x7f1c609c85e0 - unwind::try::hf0141b63ff6a0a11Tyc
  16:     0x7f1c609c83b0 - task::Task::run::hcbcff3a8c16a161bfKb
  17:     0x7f1c609c7fa0 - task::Task::spawn::closure.5707
  18:     0x7f1c609c94b0 - thread::thread_start::h5cd59b116a732721w1b
  19:     0x7f1c5d62fdc0 - start_thread
  20:                0x0 - <unknown>
task failed during unwinding. aborting.

[jdm]

This looks what @saneyuki described in #4540.

[jdm]

Specifically, in this comment.

[mskrzypkows]

Checked that this crash occurs only if "window.close()" is called after startup. If we close window by clicking on button with "onclick="window.close()", window closes properly.

Stack trace from gdb:
#0 0x0000555556dd2a53 in unwind::begin_unwind_inner::hbb866c9343c337b3CJc ()
#1 0x0000555555d9935d in unwind::begin_unwind::h8978254201450840882 ()
#2 0x000055555632f46f in script::dom::bindings::cell::DOMRefCell::borrow_mut (self=0x7fffa78390a8) at :8
#3 0x000055555632f388 in script::page::Page::mut_js_info (self=0x7fffa7839000) at page.rs:270
#4 0x000055555634055f in script::script_task::ScriptMemoryFailsafe<'a>.Drop::drop (self=0x7fffee8147f0) at script_task.rs:251
#5 0x00005555557aa9f6 in script..script_task..ScriptMemoryFailsafe$LT$$x27_$GT$::glue_drop.10689::h6bd310ec80060d1c ()
#6 0x000055555578c948 in script_task::ScriptTask.ScriptTaskFactory::create::closure.9841 ()
#7 0x0000555555788d54 in task::spawn_named_with_send_on_failure::closure.9757 ()
#8 0x000055555577e3b6 in task::TaskBuilder::try_future::closure.9583 ()
#9 0x0000555556dd0c22 in task::Task::spawn::closure.5731 ()
#10 0x0000555556dd342c in rust_try_inner ()
#11 0x0000555556dd3416 in rust_try ()
#12 0x0000555556dd0cc3 in unwind::try::hf0141b63ff6a0a11Tyc ()
#13 0x0000555556dd0acc in task::Task::run::hcbcff3a8c16a161bfKb ()
#14 0x0000555556dd0718 in task::Task::spawn::closure.5707 ()
#15 0x0000555556dd1bd5 in thread::thread_start::h5cd59b116a732721w1b ()
#16 0x00007ffff6a27182 in start_thread (arg=0x7fffee815700) at pthread_create.c:312
#17 0x00007ffff750300d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111

[jdm]

@dmarcos Oooh, we found a way to reproduce the failure :D

[jdm]

The double-borrow should be avoided by #4692.

[dmarcos]

@jdm I added a window.close() to my test page:

https://dl.dropboxusercontent.com/u/4710867/v3brainstorming/template/index.html

I'm definitely seeing "DOMRefCell already mutably borrowed...". Below the log I'm getting after running ./mach run https://dl.dropboxusercontent.com/u/4710867/v3brainstorming/template/index.html:

http://pastebin.mozilla.org/8384167

They don't seem to come from the destructor though. One of them points to the borrow_mut call here:

https://github.com/servo/servo/blob/master/components/script/page.rs#L270

[jdm]

I disagree; look at the second failure in those logs - it contains a frame with script_task::ScriptMemoryFailsafe<'a>.Drop::drop::h3802fa624db994f6mUA.

[jdm]

Nevermind, see #4692.

[Ms2ger]

No longer reproduces. I don't think we can easily test for it, sadly.

[jdm]

For what it's worth, an empty WPT test (ie. the default template for create-wpt) panics for me.

[sviter]

Is it still actual issue? I can't reproduce it

[jdm]

It is not.