Frédéric Wang

panic: assertion failed: !GetCurrentRealmOrNull(*cx).is_null() (at components/script_bindings/realms.rs:25)

5

This is flaky but here is a minimal testcase: ```html window.addEventListener("load", _ => { let canvas = document.createElement("canvas"); canvas.getContext("webgl"); window.close(); window.location.hostname = ""; }); A ``` System: Linux Version: Servo...

panic: assertion failed: !self.loader.borrow().events_inhibited()

2

With the following minimal testcase ``` ``` the latest nightly build (2025-04-26) is crashing with the following message (sorry I cannot copy the text of the full stack trace from...

Compilation currently fails when the corresponding warning is treated as an error. This commit adds virtual destructors openvr.h with empty implementation to avoid that warning. They are not made pure...

Rely on WedIDL's "implements" definition for isHTML/isScript/isScriptURL?

5

cc @koto @lukewarlow @mbrodesser-Igalia Initially suggested here: https://github.com/web-platform-tests/wpt/issues/49371#issuecomment-2500876097 See https://w3c.github.io/trusted-types/dist/spec/#dom-trustedtypepolicyfactory-ishtml "Returns true if value is an instance of [TrustedHTML](https://w3c.github.io/trusted-types/dist/spec/#trustedhtml) and has an associated [data](https://w3c.github.io/trusted-types/dist/spec/#trustedhtml-data) value set, false otherwise." and there...

navigation requests blocked by require-trusted-types-for don't set a violation sample

3

From [4.2.4. Should navigation request of type be blocked by Content Security Policy?](https://w3c.github.io/webappsec-csp/#should-block-navigation-request), step 2.1.1 will execute the [4.3.1.1. require-trusted-types-for Pre-Navigation check](https://w3c.github.io/trusted-types/dist/spec/#require-trusted-types-for-pre-navigation-check). Step 4 is as follows: > Let convertedScriptSource...

Clipping of violation’s sample to the 40 first characters

2

See https://github.com/w3c/webappsec-csp/issues/704 The Trusted Types spec also mentions clipping to 40 first characters, and this can have similar ambiguity and implementation issues: https://w3c.github.io/trusted-types/dist/spec/#should-block-sink-type-mismatch https://w3c.github.io/trusted-types/dist/spec/#should-block-create-policy (and in https://w3c.github.io/trusted-types/dist/spec/#privacy-considerations)

This is flaky, I'm relying on https://github.com/fred-wang/servo-fuzzing/blob/main/parallelize.sh to reproduce. I'm getting multiple assertion failures, sometimes in `StyleThread` sometimes in `ScriptThread`: Minimal testcase: ```html audio:after { content: url(data:image/gif;base64,iVBORw0KGgoAAAANSUhEUgAAAGAAAABgCAIAAABt+uBvAAAAAXNSR0IArs4c6QAAAAlwSFlzAAALEwAACxMBAJqcGAAAAAd0SU1FB9wDGhYvCNVA1EIAAAAZdEVYdENvbW1lbnQAQ3JlYXRlZCB3aXRoIEdJTVBXgQ4XAAAAjklEQVR42u3QIQEAMAgAsHNNVspTgARY1BZh0ZWP3VcgSJAgQYIECRKEIEGCBAkSJEgQggQJEiRIkCBBCBIkSJAgQYIECUKQIEGCBAkSJAhBggQJEiRIkCAECRIkSJAgQYIEIUiQIEGCBAkShCBBggQJEiRIEIIECRIkSJAgQYIQJEiQIEGCBAlCkCBBdwaeugIthHvZ+AAAAABJRU5ErkJggg==); } onload =...

panic: index out of bounds: the len is 2 but the index is 2 (at components/shared/compositing/display_list.rs:474)

1

Minimal testcase: ```html g { display: table; perspective: 0em; } onload = _ => document.getElementById("g").getClientRects(); ``` System: Linux Version: Servo 0.0.1-aac6aa6c7 Command: `./servo/servo` ``` index out of bounds: the len...

panic: Unknown top-level browsing context (thread Constellation, at /home/runner/work/servo/servo/components/constellation/constellation.rs:5448)

2

This is quite flaky, I'm relying on https://github.com/fred-wang/servo-fuzzing/blob/main/repeat.sh to repeat the execution 10 times. Minimal testcase: ```html function gc() { for(var i=0;i { textarea.addEventListener("focus", gc); form.submit(); textarea.setCustomValidity("1"); textarea.reportValidity(); window.history.replaceState({ "2":...

panic: called `Option::unwrap()` on a `None` value (thread Script#1, at components/script/dom/html/htmloptionscollection.rs:224)

2

Minimal testcase: ```html const select = document.createElement("select"); const optgroup = document.createElement("optgroup"); select.options.add(optgroup, select); ``` System: Linux Version: Version: Servo 0.0.3-079356795 Command: `./servo/servo` ``` called `Option::unwrap()` on a `None` value (thread...