moving cursor over a loading iframe crashes Servo

[paulrouget]

STR:

<style>
  html, body {
    margin: 0;
    width: 100%;
    height: 100%;
  }
  iframe {
    display: block;
    width: 100%;
    height: 100%;
    border: 0;
  }
</style>
<iframe src="https://news.ycombinator.com/"></iframe>

While the page is loading (right after the window shows up), move the mouse over the window.

thread 'ScriptThread PipelineId { namespace_id: PipelineNamespaceId(1), index: PipelineIndex(0) }' panicked at 'called `Option::unwrap()` on a `None` value', ../src/libcore/option.rs:330
stack backtrace:
   1:        0x1062f92d8 - sys::backtrace::tracing::imp::write::hdd549f07f7745d62xZt
   2:        0x1062fb4cf - panicking::default_handler::_<closure>::closure.41800
   3:        0x1062faf4f - panicking::default_handler::haa11ce011d688073GWx
   4:        0x1062e60d4 - sys_common::unwind::begin_unwind_inner::h5fdd923b078bc2aaz2s
   5:        0x1062e657e - sys_common::unwind::begin_unwind_fmt::hca18532ec345b882F1s
   6:        0x1062f88f7 - rust_begin_unwind
   7:        0x10631fe60 - panicking::panic_fmt::he5f9c513e9167673LnK
   8:        0x10632015c - panicking::panic::h4d53392809a8cd58imK
   9:        0x1047342f2 - option::Option<T>::unwrap::h8177679629538280872
  10:        0x1045fef64 - script_thread::ScriptThread::root_page::hb226a8af91220ecdxwg
  11:        0x104738837 - script_thread::ScriptThread::handle_event::hdf5063ecbd91c0f9Czh
  12:        0x104765771 - script_thread::ScriptThread::handle_msg_from_constellation::h50ec7f86099ab034uIg
  13:        0x104764141 - script_thread::ScriptThread::handle_msgs::_<closure>::closure.172677
  14:        0x104763d62 - script_thread::ScriptThread::profile_event::h14477634762309725791
  15:        0x1047369ef - script_thread::ScriptThread::handle_msgs::h5d20ec0b7da30e42vxg
  16:        0x1046dfdc0 - script_thread::ScriptThread::start::h069c0d774b92fbe0lxg
  17:        0x1046dfd74 - script_thread::ScriptThread.ScriptThreadFactory::create::_<closure>::_<closure>::closure.171404
  18:        0x1046dfae0 - mem::ProfilerChan::run_with_memory_reporting::h2610061323499862213
  19:        0x1046c9c5f - script_thread::ScriptThread.ScriptThreadFactory::create::_<closure>::closure.170784
  20:        0x1046c9037 - util::thread::spawn_named_with_send_on_failure::_<closure>::closure.170771
  21:        0x1046c8a23 - std::thread::Builder::spawn::_<closure>::_<closure>::closure.170760
  22:        0x1046c8998 - sys_common::unwind::try::try_fn::h9419768829949667197
  23:        0x1062f8718 - __rust_try
  24:        0x1062f55ce - sys_common::unwind::try::inner_try::h3da6140ab038e3437Ys
  25:        0x1046c88d5 - sys_common::unwind::try::h15585938672162292927
  26:        0x1046c870e - std::thread::Builder::spawn::_<closure>::closure.170757
  27:        0x1046c9257 - boxed::F.FnBox<A>::call_box::h1689917281937953796
  28:        0x1062fa5ed - sys::thread::Thread::new::thread_start::hf2e9bf34aeeb6fa0acx
  29:     0x7fff94c9599c - _pthread_body
  30:     0x7fff94c95919 - _pthread_start
thread 'Constellation' panicked at 'unable to find pipeline - this is a bug', ../src/libcore/option.rs:298
stack backtrace:
thread 'LayoutThread PipelineId { namespace_id: PipelineNamespaceId(1), index: PipelineIndex(0) }' panicked at 'called `Result::unwrap()` on an `Err` value: Error { repr: Custom(Custom { kind: Other, error: StringError("MPSC send failed") }) }', ../src/libcore/result.rs:688
thread 'PaintThread PipelineId { namespace_id: PipelineNamespaceId(1), index: PipelineIndex(0) }' panicked at 'called `Result::unwrap()` on an `Err` value: Error { repr: Custom(Custom { kind: Other, error: StringError("recursive IPC channel use during serialization") }) }', ../src/libcore/result.rs:688
   1:        0x1062f92d8 - sys::backtrace::tracing::imp::write::hdd549f07f7745d62xZt
   2:        0x1062fb4cf - panicking::default_handler::_<closure>::closure.41800
   3:        0x1062faf4f - panicking::default_handler::haa11ce011d688073GWx
   4:        0x1062e60d4 - sys_common::unwind::begin_unwind_inner::h5fdd923b078bc2aaz2s
   5:        0x1062e657e - sys_common::unwind::begin_unwind_fmt::hca18532ec345b882F1s
   6:        0x1062f88f7 - rust_begin_unwind
   7:        0x10631fe60 - panicking::panic_fmt::he5f9c513e9167673LnK
   8:        0x1036f731f - option::Option<T>::expect::h5339844227311931841
   9:        0x1037c5488 - constellation::Constellation<LTF, STF>::handle_failure_msg::h12046843456072119420
  10:        0x10367b301 - constellation::Constellation<LTF, STF>::handle_request::h15666559289675337404
  11:        0x103677d3c - constellation::Constellation<LTF, STF>::run::h3172571108249641926
  12:        0x10365b9e3 - export::compositing::constellation::Constellation<LTF, STF>::start::_<closure>::closure.24011
  13:        0x103659823 - std::thread::Builder::spawn::_<closure>::_<closure>::closure.24000
  14:        0x103659798 - sys_common::unwind::try::try_fn::h3515637966895896247
  15:        0x1062f8718 - __rust_try
  16:        0x1062f55ce - sys_common::unwind::try::inner_try::h3da6140ab038e3437Ys
  17:        0x1036596d5 - sys_common::unwind::try::h11623311639750873733
  18:        0x10365950e - std::thread::Builder::spawn::_<closure>::closure.23977
  19:        0x10365bca7 - boxed::F.FnBox<A>::call_box::h8828800509819653060
  20:        0x1062fa5ed - sys::thread::Thread::new::thread_start::hf2e9bf34aeeb6fa0acx
  21:     0x7fff94c9599c - _pthread_body
  22:     0x7fff94c95919 - _pthread_start
stack backtrace:
   1:        0x1062f92d8 - sys::backtrace::tracing::imp::write::hdd549f07f7745d62xZt
   2:        0x1062fb4cf - panicking::default_handler::_<closure>::closure.41800
   3:        0x1062faf4f - panicking::default_handler::haa11ce011d688073GWx
   4:        0x1062e60d4 - sys_common::unwind::begin_unwind_inner::h5fdd923b078bc2aaz2s
   5:        0x1062e657e - sys_common::unwind::begin_unwind_fmt::hca18532ec345b882F1s
   6:        0x1062f88f7 - rust_begin_unwind
   7:        0x10631fe60 - panicking::panic_fmt::he5f9c513e9167673LnK
   8:        0x1039e7de6 - result::Result<T, E>::unwrap::h13669876520401285798
   9:        0x103c219ab - layout_thread::LayoutThread::exit_now::h0506a6bb12b6796b8Yq
  10:        0x103beaba0 - layout_thread::LayoutThread::handle_request_helper::hc8c44cd9203fe4dd3Oq
  11:        0x103bc0f9b - layout_thread::LayoutThread::handle_request::h2ace98cf47d88468sJq
  12:        0x103b8d13a - layout_thread::LayoutThread::start::h2abcb552cbf69a3dHHq
  13:        0x103b8cf87 - layout_thread::LayoutThread.LayoutThreadFactory::create::_<closure>::_<closure>::closure.55183
  14:        0x103b87183 - mem::ProfilerChan::run_with_memory_reporting::h15726168540943441063
  15:        0x103b50fdd - layout_thread::LayoutThread.LayoutThreadFactory::create::_<closure>::closure.53457
  16:        0x103b50357 - util::thread::spawn_named_with_send_on_failure::_<closure>::closure.53428
  17:        0x103b4fd43 - std::thread::Builder::spawn::_<closure>::_<closure>::closure.53417
  18:        0x103b4fcb8 - sys_common::unwind::try::try_fn::h5284159491821017053
  19:        0x1062f8718 - __rust_try
  20:        0x1062f55ce - sys_common::unwind::try::inner_try::h3da6140ab038e3437Ys
  21:        0x103b4fbf5 - sys_common::unwind::try::h13556685622416969616
  22:        0x103b4fa2e - std::thread::Builder::spawn::_<closure>::closure.53394
  23:        0x103b505b7 - boxed::F.FnBox<A>::call_box::h11784976529355248574
  24:        0x1062fa5ed - sys::thread::Thread::new::thread_start::hf2e9bf34aeeb6fa0acx
  25:     0x7fff94c9599c - _pthread_body
  26:     0x7fff94c95919 - _pthread_start
stack backtrace:
   1:        0x1062f92d8 - sys::backtrace::tracing::imp::write::hdd549f07f7745d62xZt
   2:        0x1062fb4cf - panicking::default_handler::_<closure>::closure.41800
   3:        0x1062faf4f - panicking::default_handler::haa11ce011d688073GWx
   4:        0x1062e60d4 - sys_common::unwind::begin_unwind_inner::h5fdd923b078bc2aaz2s
   5:        0x1062e657e - sys_common::unwind::begin_unwind_fmt::hca18532ec345b882F1s
   6:        0x1062f88f7 - rust_begin_unwind
   7:        0x10631fe60 - panicking::panic_fmt::he5f9c513e9167673LnK
   8:        0x104b024f6 - result::Result<T, E>::unwrap::h16971998360882155653
   9:        0x104b896de - gfx::paint_thread::PaintThread<C>::create::_<closure>::closure.33526
  10:        0x104b88917 - util::thread::spawn_named_with_send_on_failure::_<closure>::closure.33497
  11:        0x104b88303 - std::thread::Builder::spawn::_<closure>::_<closure>::closure.33486
  12:        0x104b88278 - sys_common::unwind::try::try_fn::h962043809951869491
  13:        0x1062f8718 - __rust_try
  14:        0x1062f55ce - sys_common::unwind::try::inner_try::h3da6140ab038e3437Ys
  15:        0x104b881b5 - sys_common::unwind::try::h9372886371861194604
  16:        0x104b87fee - std::thread::Builder::spawn::_<closure>::closure.33463
  17:        0x104b88b77 - boxed::F.FnBox<A>::call_box::h3399964151574302148
  18:        0x1062fa5ed - sys::thread::Thread::new::thread_start::hf2e9bf34aeeb6fa0acx
  19:     0x7fff94c9599c - _pthread_body
  20:     0x7fff94c95919 - _pthread_start

[paulrouget]

In script_thread.rs#MouseMoveEvent(), self.root_page() panics:

self.page.borrow().as_ref().unwrap().clone()

thread 'ScriptThread PipelineId { namespace_id: PipelineNamespaceId(1), index: PipelineIndex(0) }' panicked at 'called `Option::unwrap()` on a `None` value', ../src/libcore/option.rs:330

[paulrouget]

We could just verify there's a root_page first, like in many place in this file, but I'm wondering why this only happens with webrender.

@glennw any idea?

[paulrouget]

root_page is initialized in load (once the HTTP server replied).
So Servo will panic anytime root_page() is called before load.

ScriptThread::page_fetch_complete, which call load, is call after ScriptThread::start, which calls handle_msgs where the calls to root_page() might happen in all the handle_*_msg functions.

So it's totally possible that root_page() is accessed before the root page is initialized.

Not sure why it only happens with WR.

[paulrouget]

Actually, it happens with non WR builds. Just harder to reproduce.

I'll file a bug in servo/servo.

[paulrouget]

servo/servo#9417