SIGILL with --multiprocess #7755

oesiman · 2015-09-27T13:20:01Z

./servo --multiprocess -o /dev/null http://heise.de
fails here with SIGILL. No problem without --multiprocess.

ERROR:js::rust: Error at http://www.heise.de/:5:0: TypeError: document.write is not a function

ERROR:js::rust: Error at http://www.heise.de/:12:4: ReferenceError: googletag is not defined

ERROR:js::rust: Error at http://www.heise.de/:1:0: ReferenceError: googletag is not defined

ERROR:js::rust: Error at http://www.heise.de/:1:0: ReferenceError: googletag is not defined

ERROR:js::rust: Error at http://www.heise.de/:1:0: ReferenceError: googletag is not defined

ERROR:js::rust: Error at http://www.heise.de/:1:0: ReferenceError: googletag is not defined

ERROR:js::rust: Error at http://www.heise.de/:4:20: TypeError: document.write is not a function

ERROR:js::rust: Error at http://www.heise.de/:1:0: ReferenceError: googletag is not defined

ERROR:js::rust: Error at http://www.heise.de/:1:0: ReferenceError: googletag is not defined

ERROR:js::rust: Error at http://script.ioam.de/iam.js:217:8: TypeError: document.referrer is undefined

thread '<unnamed>' panicked at 'index out of bounds: the len is 64 but the index is 64', src/libcollections/vec.rs:1050
thread 'LayoutTask PipelineId(0)' panicked at 'called `Result::unwrap()` on an `Err` value: ()', src/libcore/result.rs:736
thread 'ScriptTask PipelineId(0)' panicked at 'called `Result::unwrap()` on an `Err` value: RecvError', src/libcore/result.rs:736
thread 'thread 'thread 'ScriptTask PipelineId(1)LayoutTask PipelineId(1)ImageCacheThread' panicked at '' panicked at '' panicked at 'called `Result::unwrap()` on an `Err` value: RecvErrorcalled `Result::unwrap()` on an `Err` value: RecvErrorcalled `Result::unwrap()` on an `Err` value: RecvError', ', ', src/libcore/result.rssrc/libcore/result.rssrc/libcore/result.rs:::736736736


thread 'LayoutTask PipelineId(2)' panicked at 'called `Result::unwrap()` on an `Err` value: RecvError', src/libcore/result.rs:736
thread 'ScriptTask PipelineId(2)' panicked at 'thread 'called `Result::unwrap()` on an `Err` value: RecvErrorPaintTask PipelineId(2)', ' panicked at 'src/libcore/result.rscalled `Result::unwrap()` on an `Err` value: RecvError:', 736src/libcore/result.rs
:736
thread 'PaintTask PipelineId(0)' panicked at 'called `Result::unwrap()` on an `Err` value: RecvError', src/libcore/result.rs:736
thread 'thread 'PaintWorkerthread 'PaintWorker' panicked at 'thread 'PaintTask PipelineId(1)' panicked at 'called `Result::unwrap()` on an `Err` value: RecvErrorPaintWorker' panicked at 'called `Result::unwrap()` on an `Err` value: RecvError', ' panicked at 'called `Result::unwrap()` on an `Err` value: RecvError', src/libcore/result.rscalled `Result::unwrap()` on an `Err` value: RecvError', src/libcore/result.rs:', src/libcore/result.rs:736src/libcore/result.rs:736
:736
736

thread 'PaintWorker' panicked at 'called `Result::unwrap()` on an `Err` value: RecvError', src/libcore/result.rs:736
thread 'PaintWorker' panicked at 'called `Result::unwrap()` on an `Err` value: RecvError', src/libcore/result.rs:736
thread 'thread 'ScriptTask PipelineId(1)PaintWorker' panicked at '' panicked at 'called `Result::unwrap()` on an `Err` value: "SendError(..)"called `Result::unwrap()` on an `Err` value: RecvError', ', src/libcore/result.rssrc/libcore/result.rs::736736thread '

ScriptTask PipelineId(2)stack backtrace:
' panicked at 'called `Result::unwrap()` on an `Err` value: "SendError(..)"', src/libcore/result.rs:736
thread 'thread 'PaintWorkerPaintWorker' panicked at '' panicked at 'called `Result::unwrap()` on an `Err` value: RecvErrorcalled `Result::unwrap()` on an `Err` value: RecvError', ', src/libcore/result.rssrc/libcore/result.rs::736736

thread 'thread 'thread 'PaintWorkerPaintWorkerPaintWorker' panicked at '' panicked at '' panicked at 'called `Result::unwrap()` on an `Err` value: RecvErrorcalled `Result::unwrap()` on an `Err` value: RecvErrorcalled `Result::unwrap()` on an `Err` value: RecvError', ', ', src/libcore/result.rssrc/libcore/result.rssrc/libcore/result.rs:::736736736


thread 'PaintWorker' panicked at 'called `Result::unwrap()` on an `Err` value: RecvError', src/libcore/result.rs:736
thread 'PaintWorker' panicked at 'called `Result::unwrap()` on an `Err` value: RecvError', src/libcore/result.rs:736
thread 'PaintWorker' panicked at 'called `Result::unwrap()` on an `Err` value: RecvError', src/libcore/result.rs:736
thread 'thread 'PaintWorkerPaintWorker' panicked at '' panicked at 'called `Result::unwrap()` on an `Err` value: RecvErrorthread 'called `Result::unwrap()` on an `Err` value: RecvError', PaintWorker', src/libcore/result.rs' panicked at 'src/libcore/result.rs:called `Result::unwrap()` on an `Err` value: RecvError:736', 736
src/libcore/result.rs
:736
thread 'PaintWorker' panicked at 'called `Result::unwrap()` on an `Err` value: RecvError', src/libcore/result.rs:736
   1:     0x556e795625a9 - sys::backtrace::tracing::imp::write::h595d54844cda8b23crt
   2:     0x556e79561ace - panicking::on_panic::hf17957fdbbff3f6fBqx
   3:     0x556e79550c4e - sys_common::unwind::begin_unwind_inner::h53d3786fcf9ca647ffs
   4:     0x556e795513e8 - sys_common::unwind::begin_unwind_fmt::h0d5d504cc09c1d1ales
   5:     0x556e79561001 - rust_begin_unwind
   6:     0x556e79591b1f - panicking::panic_fmt::h74e66b6fcc9eaf3cwZK
thread 'Constellation' panicked at 'called `Result::unwrap()` on an `Err` value: RecvError', src/libcore/result.rs:736
   7:     0x556e7854fc3d - dom::node::LayoutDataRef::dispose::h4806623265195e29SJ6
   8:     0x556e7828da7b - dom..node..Node::drop.123501::hce737c8a063e2311
   9:     0x556e782e870b - dom..element..Element::drop.126086::hb70b762beba5294f
  10:     0x556e7832b1e7 - dom::bindings::codegen::Bindings::HTMLHtmlElementBinding::_finalize::h58c7e5491ecdc2be9kj
  11:     0x556e790866ed - _Z19FinalizeTypedArenasI8JSObjectEbPN2js6FreeOpEPPNS1_2gc11ArenaHeaderERNS4_15SortedArenaListENS4_9AllocKindERNS1_11SliceBudgetENS4_10ArenaLists14KeepArenasEnumE
thread 'PaintTask PipelineId(2)Watcher' panicked at 'called `Result::unwrap()` on an `Err` value: "SendError(..)"', src/libcore/result.rs:736
thread 'ScriptTask PipelineId(0)Watcher' panicked at 'called `Result::unwrap()` on an `Err` value: "SendError(..)"', src/libcore/result.rs:736
                        at /root/Projekte/servo/servo/servo/.cargo/git/checkouts/mozjs-06d7f04b6dbb8a8e/master/mozjs/js/src/jsobjinlines.h:61
                        at /root/Projekte/servo/servo/servo/.cargo/git/checkouts/mozjs-06d7f04b6dbb8a8e/master/mozjs/js/src/jsgc.cpp:500
                        at /root/Projekte/servo/servo/servo/.cargo/git/checkouts/mozjs-06d7f04b6dbb8a8e/master/mozjs/js/src/jsgc.cpp:560
  12:     0x556e79087047 - _ZN2js2gc10ArenaLists16forceFinalizeNowEPNS_6FreeOpENS0_9AllocKindENS1_14KeepArenasEnumEPPNS0_11ArenaHeaderE.constprop.1247
                        at /root/Projekte/servo/servo/servo/.cargo/git/checkouts/mozjs-06d7f04b6dbb8a8e/master/mozjs/js/src/jsgc.cpp:603
                        at /root/Projekte/servo/servo/servo/.cargo/git/checkouts/mozjs-06d7f04b6dbb8a8e/master/mozjs/js/src/jsgc.cpp:2724
  13:     0x556e790872ff - _ZN2js2gc10ArenaLists30queueForegroundObjectsForSweepEPNS_6FreeOpE
                        at /root/Projekte/servo/servo/servo/.cargo/git/checkouts/mozjs-06d7f04b6dbb8a8e/master/mozjs/js/src/jsgc.cpp:2707
                        at /root/Projekte/servo/servo/servo/.cargo/git/checkouts/mozjs-06d7f04b6dbb8a8e/master/mozjs/js/src/jsgc.cpp:2842
  14:     0x556e79087ee7 - _ZN2js2gc9GCRuntime22beginSweepingZoneGroupEv
                        at /root/Projekte/servo/servo/servo/.cargo/git/checkouts/mozjs-06d7f04b6dbb8a8e/master/mozjs/js/src/jsgc.cpp:4921
  15:     0x556e7909a439 - _ZN2js2gc9GCRuntime15beginSweepPhaseEb
                        at /root/Projekte/servo/servo/servo/.cargo/git/checkouts/mozjs-06d7f04b6dbb8a8e/master/mozjs/js/src/jsgc.cpp:5015
  16:     0x556e790a7255 - _ZN2js2gc9GCRuntime23incrementalCollectSliceERNS_11SliceBudgetEN2JS8gcreason6ReasonE
                        at /root/Projekte/servo/servo/servo/.cargo/git/checkouts/mozjs-06d7f04b6dbb8a8e/master/mozjs/js/src/jsgc.cpp:5763
  17:     0x556e790a7e54 - _ZN2js2gc9GCRuntime7gcCycleEbRNS_11SliceBudgetEN2JS8gcreason6ReasonE
                        at /root/Projekte/servo/servo/servo/.cargo/git/checkouts/mozjs-06d7f04b6dbb8a8e/master/mozjs/js/src/jsgc.cpp:5960
  18:     0x556e790a8112 - _ZN2js2gc9GCRuntime7collectEbNS_11SliceBudgetEN2JS8gcreason6ReasonE
                        at /root/Projekte/servo/servo/servo/.cargo/git/checkouts/mozjs-06d7f04b6dbb8a8e/master/mozjs/js/src/jsgc.cpp:6072
  19:     0x556e790a860e - _ZN2js2gc9GCRuntime2gcE18JSGCInvocationKindN2JS8gcreason6ReasonE
                        at /root/Projekte/servo/servo/servo/.cargo/git/checkouts/mozjs-06d7f04b6dbb8a8e/master/mozjs/js/src/jsgc.cpp:6133
  20:     0x556e79038532 - _ZN2js14DestroyContextEP9JSContextNS_18DestroyContextModeE
                        at /root/Projekte/servo/servo/servo/.cargo/git/checkouts/mozjs-06d7f04b6dbb8a8e/master/mozjs/js/src/jscntxt.cpp:186
  21:     0x556e78bfa84c - rust::Runtime.Drop::drop::h9f9012d70d13a5e0zOk
  22:     0x556e7860ef22 - script_task..ScriptTask::drop.150700::h5fa8d5a589c12c54
  23:     0x556e7860c7b6 - boxed::F.FnBox<A>::call_box::h11195805411657372966
  24:     0x556e781f75a4 - sys_common::unwind::try::try_fn::h15370420182885731678
  25:     0x556e79560e68 - __rust_try
  26:     0x556e7955d812 - sys_common::unwind::try::inner_try::h1f4430f3951bcd0aDbs
  27:     0x556e781f7734 - boxed::F.FnBox<A>::call_box::h9299949535247403523
  28:     0x556e79563713 - sys::thread::Thread::new::thread_start::he1eab6693a3e76f9AJw
  29:     0x7f769bac90a3 - start_thread
  30:     0x7f769c2c906c - clone
  31:                0x0 - <unknown>
thread panicked while panicking. aborting.stack backtrace:

jdm · 2015-09-27T13:30:11Z

Curious! I can't reproduce this on OS X in a debug build. What platform are you using? Do you see a backtrace from the first panic (thread '<unnamed>' panicked at 'index out of bounds: the len is 64 but the index is 64', src/libcollections/vec.rs:1050) if you run with RUST_BACKTRACE=1?

jdm · 2015-09-27T13:30:55Z

Alternatively, if you could run it under your favourite debugger, set a breakpoint on rust_panic and paste the backtrace from the firist panic, that would be very useful.

oesiman · 2015-09-27T13:58:38Z

On Sun, Sep 27, 2015 at 06:31:05AM -0700, Josh Matthews wrote:

Alternatively, if you could run it under your favourite debugger, set a breakpoint on rust_panic and paste the backtrace from the firist panic, that would be very useful.

Breakpoint 1, 0x0000555556e17e70 in rust_panic ()
(gdb) #0  0x0000555556e17e70 in rust_panic ()
#1  0x0000555556e07ce1 in sys_common::unwind::begin_unwind_inner::h53d3786fcf9ca647ffs ()
#2  0x0000555556e083e9 in sys_common::unwind::begin_unwind_fmt::h0d5d504cc09c1d1ales ()
#3  0x0000555556e18002 in rust_begin_unwind ()
#4  0x0000555556e48b20 in panicking::panic_fmt::h74e66b6fcc9eaf3cwZK ()
#5  0x0000555556e44f63 in panicking::panic_bounds_check::h265004f3d7fd9398CYK
    ()
#6  0x000055555583a793 in display_list::DisplayItem...serde..de..Deserialize::deserialize::__Visitor$LT$__D$GT$...serde..de..EnumVisitor::visit::h11504634180373506777 ()
#7  0x0000555555831a6c in serde::reader::Deserializer$LT$$u27$a$C$$u20$R$GT$.serde..Deserializer::visit_tuple::TupleVisitor$LT$$u27$a$C$$u20$$u27$b$C$$u20$R$GT$.serde..de..SeqVisitor::visit::h15864993620576044288 ()
#8  0x000055555582fd7e in display_list::DisplayList...serde..de..Deserialize::deserialize::__Visitor$LT$__D$GT$...serde..de..Visitor::visit_seq::h681222545869451553 ()
#9  0x000055555582ec8e in de::impls::Box$LT$T$GT$.Deserialize::deserialize::h14665226173537450985 ()
#10 0x000055555582a5a4 in display_list::StackingContext...serde..de..Deserialize::deserialize::__Visitor$LT$__D$GT$...serde..de..Visitor::visit_seq::h733200741226724401 ()
#11 0x000055555582a30e in de::impls::Arc$LT$T$GT$.Deserialize::deserialize::h129969237752851184 ()
#12 0x0000555555828ca0 in paint_task::PaintLayer...serde..de..Deserialize::deserialize::h9001232950366888834 ()
#13 0x0000555555823e3e in router::RouterProxy::route_ipc_receiver_to_mpsc_sender::closure.22052 ()
#14 0x000055555649a60e in router::RouterProxy::new::closure.17174 ()
#15 0x00005555564995be in boxed::F.FnBox$LT$A$GT$::call_box::h15988641767532700882 ()
#16 0x0000555556499005 in sys_common::unwind::try::try_fn::h15558248333733633357 ()
#17 0x0000555556e17e69 in __rust_try ()
#18 0x0000555556e14813 in sys_common::unwind::try::inner_try::h1f4430f3951bcd0aDbs ()
#19 0x0000555556499195 in boxed::F.FnBox$LT$A$GT$::call_box::h8128644232108127260 ()
#20 0x0000555556e1a714 in sys::thread::Thread::new::thread_start::he1eab6693a3e76f9AJw ()
#21 0x00007ffff54c00a4 in start_thread (arg=0x7fffeebff700)
    at pthread_create.c:309
#22 0x00007ffff5cc006d in clone ()
    at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111
(gdb)

jdm · 2015-09-27T14:47:05Z

cc @pcwalton @erickt

erickt · 2015-09-30T00:05:58Z

I dug a little into this, and I don't see an obvious bounds check in either serde_macros, the Deserialize impl for DisplayItem, nor bincode. I'll see if I can reproduce it.

erickt · 2015-09-30T00:34:34Z

I wasn't able to reproduce this on the master branch. @oesiman: could you see if it's still reproducible?

oesiman · 2015-10-05T16:34:27Z

On Tue, Sep 29, 2015 at 05:34:45PM -0700, Erick Tryzelaar wrote:

I wasn't able to reproduce this on the master branch. @oesiman: could you see if it's still reproducible?

I can reproduce it (but i'm sure that i must be wrong...).

about my system:
It's a Debian GNU/Linux unstable amd64 system
An Alienware M18 Notebook with 16GiB RAM and a 500GB SSD-Disk.

I tried two master again on:

[master] Auto merge of #7719 - Manishearth:ghfix, r=Ms2ger
and
[master] Auto merge of #7790 - frewsxcv:expand-python-executable-names, r=mbrubeck

I name #7719 "old" and #7790 "new":
i only try "--release"-builds.

running from shell gives SIGILL:

RUST_BACKTRACE=1 ./servo --multiprocess http://heise.de
http://txt.hello-penguin.com/servo/nogdb-old.txt
http://txt.hello-penguin.com/servo/nogdb-new.txt
(you can't see the SIGILL here in the txt-files)

running under gdb (overkill):
#! /bin/sh
cat << EOF | gdb --args ./servo --multiprocess http://heise.de
set environment RUST_BACKTRACE=1
break rust_panic
command 1
echo @@@ backtrace begin\n
thread apply all bt
echo @@@ backtrace end\n
cont
end
run
bt
quit
EOF

http://txt.hello-penguin.com/servo/gdb-old.txt.xz
http://txt.hello-penguin.com/servo/gdb-new.txt.xz

I also put the servo-binaries on the net if somebody
wants to play with it:
http://txt.hello-penguin.com/servo/servo-old.xz
http://txt.hello-penguin.com/servo/servo-new.xz

ciao -
Stefan

dralley · 2020-03-24T19:21:08Z

Since it's been 5 years, this should probably be closed.

jdm · 2020-03-24T19:22:55Z

We run multiprocess tests regularly without panics, so closing makes sense until it can be reproduced.

jdm added the I-panic label Sep 27, 2015

jdm closed this Mar 24, 2020

servo / servo

SIGILL with --multiprocess #7755

SIGILL with --multiprocess #7755

oesiman commented Sep 27, 2015

jdm commented Sep 27, 2015

jdm commented Sep 27, 2015

oesiman commented Sep 27, 2015

jdm commented Sep 27, 2015

erickt commented Sep 30, 2015

erickt commented Sep 30, 2015

oesiman commented Oct 5, 2015

dralley commented Mar 24, 2020

jdm commented Mar 24, 2020

servo / servo

Join GitHub today

SIGILL with --multiprocess #7755

SIGILL with --multiprocess #7755

Comments

oesiman commented Sep 27, 2015

jdm commented Sep 27, 2015

jdm commented Sep 27, 2015

oesiman commented Sep 27, 2015

jdm commented Sep 27, 2015

erickt commented Sep 30, 2015

erickt commented Sep 30, 2015

oesiman commented Oct 5, 2015

dralley commented Mar 24, 2020

jdm commented Mar 24, 2020