Panic at 'This element should be in registered.'

[jruderman]

This testcase reduced from DOMFuzz output:

<script>

var x1 = document.createElement("div");
x1.id = "x";

var x2 = document.createElement("div");
x2.id = "x";

document.cloneNode(false).appendChild(x1);
x1.appendChild(x2);
x1.innerHTML = "";

</script>

gives me a double panic:

thread 'ScriptTask PipelineId(0)' panicked at 'This element should be in registered.', src/libcore/option.rs:330
thread 'ScriptTask PipelineId(0)' panicked at 'assertion failed: *self.stack == mem::transmute(&*self)', /Users/jruderman/code/servo/.cargo/git/checkouts/rust-mozjs-ebb4917e843c0a11/master/src/rust.rs:286
stack backtrace:
   1:        0x10533e3b5 - sys::backtrace::write::he3deb85ec8e4ed0bVns
   2:        0x105341b23 - panicking::on_panic::h21c33173ec16d38c2Fw
   3:        0x10532f4e2 - rt::unwind::begin_unwind_inner::h31480c30be70e77aeow
   4:        0x1036718ac - rt::unwind::begin_unwind::h12621217613621779145
   5:        0x1036ed965 - rust::Rooted<T>.Drop::drop::h11257467317822946514
   6:        0x1036ed8a1 - js..jsapi..Rooted<js..jsapi..Value>::drop.99065::h656ecb8cd2a92d17
   7:        0x103d1d451 - dom::htmlscriptelement::_&'a HTMLScriptElement.HTMLScriptElementHelpers::execute::h3be4634aa2464021b5G
   8:        0x103d201fd - dom::htmlscriptelement::_&'a HTMLScriptElement.HTMLScriptElementHelpers::prepare::hd6e101d78a5186d4DWG
   9:        0x103d9ca2d - parse::html::servohtmlparser..Sink.TreeSink::complete_script::h18035588cf8d3c43x5W
  10:        0x103d8155e - tree_builder::rules::super..TreeBuilder<Handle, Sink>.TreeBuilderStep::step::h17008305531552599251
  11:        0x103d6a46e - tree_builder::TreeBuilder<Handle, Sink>::process_to_completion::h8223998176049926096
  12:        0x103d65359 - tree_builder::TreeBuilder<Handle, Sink>.TokenSink::process_token::h2524722075684777927
  13:        0x103d64380 - tokenizer::Tokenizer<Sink>::process_token::h12129904937690610194
  14:        0x103db01f5 - tokenizer::Tokenizer<Sink>::emit_current_tag::h11768916041307476234
  15:        0x103da74e6 - tokenizer::Tokenizer<Sink>::step::h2312843459721656747
  16:        0x103da42d5 - tokenizer::Tokenizer<Sink>::run::h9932678488722589748
  17:        0x103dc84f7 - tokenizer::Tokenizer<Sink>::feed::h14317537553574973601
  18:        0x103d5e93b - dom::servohtmlparser::_&'a ServoHTMLParser.PrivateServoHTMLParserHelpers::parse_sync::hbebd302c98563a53bWO
  19:        0x103d5f46d - dom::servohtmlparser::_&'a ServoHTMLParser.Parser::parse_chunk::ha19ae84ee39b2be1bPO
  20:        0x103d5ecdc - dom::servohtmlparser::ParserContext.AsyncResponseListener::data_available::h3fa1c63634eac9dfKJO
  21:        0x104c70c0f - ResponseAction::process::hb9808a856199b4a8iya
  22:        0x103f12efe - network_listener::ListenerRunnable<T>.Runnable::handler::h3000608204475126608
  23:        0x103ec394f - script_task::ScriptTask::handle_msg_from_script::h314bac6bfa6e4b21yjY
  24:        0x103ec9754 - script_task::ScriptTask::handle_msgs::hfe2a35eb90743ef2o7X
  25:        0x103ec7bb1 - script_task::ScriptTask::start::hf9508e3515bf07c0e7X
  26:        0x102ccec5b - script_task::ScriptTask.ScriptTaskFactory::create::closure.17846
  27:        0x102cce334 - task::spawn_named_with_send_on_failure::closure.17840
  28:        0x102cce254 - boxed::F.FnBox<A>::call_box::h5713626361034408555
  29:        0x102bf5c30 - boxed::Box<FnBox<A, Output $u3d$$u20$R$GT$$u2b$$u20$Send$u20$$u2b$$u20$$u27$a$GT$.FnOnce$LT$A$GT$::call_once::h1261975696106313034
  30:        0x102bf56a2 - thread::Builder::spawn_inner::closure.11162
  31:        0x102bf561e - rt::unwind::try::try_fn::__rust_abi::h6715557702776406330
  32:        0x102bf55b9 - rt::unwind::try::try_fn::h6715557702776406330
  33:        0x1053432d8 - rust_try_inner
  34:        0x1053432c5 - rust_try
  35:        0x10533c955 - rt::unwind::try::inner_try::h25d204b9a867a7067jw
  36:        0x102bf5518 - rt::unwind::try::h9676544153665438131
  37:        0x102bf5351 - thread::Builder::spawn_inner::closure.11111
  38:        0x102bf5f4d - boxed::F.FnBox<A>::call_box::h494122744894092804
  39:        0x10534029d - sys::thread::Thread::new::thread_start::h7529cef3921faffbrIv
  40:     0x7fff8acfc267 - _pthread_body
  41:     0x7fff8acfc1e4 - _pthread_start
thread panicked while panicking. aborting.

(Is a double panic two bugs? I'm not sure how to report this.)

[Ms2ger]

Ignore *self.stack == mem::transmute(&*self) for now.

@jdm, I believe this is your code?

[jdm]

This is actually http://mxr.mozilla.org/servo/source/components/script/dom/document.rs#406 ; the stack showing is from the second assertion.

[Ms2ger]

Looks like we're calling unregister_named_element twice:

DEBUG:script::dom::document: Adding named element to document 0x7fa7e205d380: 0x7fa7e204f3c0 id=x
DEBUG:script::dom::document: Adding named element to document 0x7fa7e205d380: 0x7fa7e204f500 id=x
DEBUG:script::dom::document: Removing named element from document 0x7fa7e205d380: 0x7fa7e204f500 id=x
DEBUG:script::dom::document: Removing named element from document 0x7fa7e205d380: 0x7fa7e204f500 id=x

Looks like someone broke the suppressing

[Ms2ger]

And it was #5972; I thought so at the time.

[nox]

#6660 fixes this, AFAICT.

[nox]

#6660 fixed this.