servo
servo copied to clipboard
Intermittent double mutable borrow during GC while running tests
From interpreting the stack trace, this looks like the same underlying issue as https://github.com/servo/servo/issues/32454. When the parser is synchronously parsing and a GC occurs, we attempt to mutably borrow fields of the parser that are already borrowed.
▶ CRASH [expected OK] /url/failure.html (#28574)
│
│ already mutably borrowed: BorrowError (thread Script(1,1), at components/script/dom/bindings/cell.rs:80)
│ 0: servoshell::backtrace::print
│ 1: servoshell::panic_hook::panic_hook
│ 2: std::panicking::rust_panic_with_hook
│ 3: std::panicking::begin_panic_handler::{{closure}}
│ 4: std::sys_common::backtrace::__rust_end_short_backtrace
│ 5: rust_begin_unwind
│ 6: core::panicking::panic_fmt
│ 7: core::cell::panic_already_mutably_borrowed
│ 8: script::dom::bindings::trace::<impl mozjs::gc::trace::Traceable for script::dom::bindings::cell::DomRefCell<T>>::trace
│ 9: script::dom::bindings::codegen::Bindings::ServoParserBinding::ServoParser_Binding::_trace::{{closure}}
│ 10: mozjs::panic::wrap_panic
│ 11: script::dom::bindings::codegen::Bindings::ServoParserBinding::ServoParser_Binding::_trace
│ 12: _ZN2js8GCMarker19processMarkStackTopILj4EEEbRNS_11SliceBudgetE
│ 13: _ZN2js8GCMarker9doMarkingILj4EEEbRNS_11SliceBudgetENS_2gc20ShouldReportMarkTimeE
│ 14: _ZN2js2gc9GCRuntime24markUntilBudgetExhaustedERNS_11SliceBudgetENS1_15ParallelMarkingENS0_20ShouldReportMarkTimeE
│ 15: _ZN2js2gc9GCRuntime16incrementalSliceERNS_11SliceBudgetEN2JS8GCReasonEb
│ 16: _ZN2js2gc9GCRuntime7gcCycleEbRKNS_11SliceBudgetEN2JS8GCReasonE
│ 17: _ZN2js2gc9GCRuntime7collectEbRKNS_11SliceBudgetEN2JS8GCReasonE
│ 18: _ZN2js2gc9GCRuntime17gcIfRequestedImplEb
│ 19: _ZN2js2gc13CellAllocator16AllocTenuredCellILNS_7AllowGCE1EEEPvP9JSContextNS0_9AllocKindEm
│ 20: _ZN2js12GetterSetter6createEP9JSContextN2JS6HandleIP8JSObjectEES7_
│ 21: _ZN2js20NativeDefinePropertyEP9JSContextN2JS6HandleIPNS_12NativeObjectEEENS3_INS2_11PropertyKeyEEENS3_INS2_18PropertyDescriptorEEERNS2_14ObjectOpResultE
│ 22: _ZN2js22DefineAccessorPropertyEP9JSContextN2JS6HandleIP8JSObjectEENS3_INS2_11PropertyKeyEEES6_S6_j
│ 23: _ZL26DefineAccessorPropertyByIdP9JSContextN2JS6HandleIP8JSObjectEENS2_INS1_11PropertyKeyEEERK15JSNativeWrapperSA_j
│ 24: _Z19JS_DefinePropertiesP9JSContextN2JS6HandleIP8JSObjectEEPK14JSPropertySpec
│ 25: mozjs::rust::define_properties
│ 26: script::dom::bindings::interface::create_object
│ 27: script::dom::bindings::interface::create_interface_prototype_object
│ 28: script::dom::bindings::codegen::Bindings::HTMLBodyElementBinding::HTMLBodyElement_Binding::CreateInterfaceObjects
│ 29: script::dom::bindings::interface::get_per_interface_object_handle
│ 30: script::dom::bindings::codegen::Bindings::HTMLBodyElementBinding::HTMLBodyElement_Binding::Wrap
│ 31: script::dom::create::create_native_html_element
│ 32: script::dom::create::create_element
│ 33: script::dom::servoparser::create_element_for_token
│ 34: <script::dom::servoparser::Sink as markup5ever::interface::tree_builder::TreeSink>::create_element
│ 35: markup5ever::interface::tree_builder::create_element
│ 36: html5ever::tree_builder::TreeBuilder<Handle,Sink>::insert_element
│ 37: html5ever::tree_builder::TreeBuilder<Handle,Sink>::step
│ 38: <html5ever::tree_builder::TreeBuilder<Handle,Sink> as html5ever::tokenizer::interface::TokenSink>::process_token
│ 39: html5ever::tokenizer::Tokenizer<Sink>::process_token
│ 40: html5ever::tokenizer::Tokenizer<Sink>::end
│ 41: script::dom::servoparser::ServoParser::do_parse_sync
│ 42: profile_traits::time::profile
│ 43: script::dom::servoparser::ServoParser::parse_sync
│ 44: <script::dom::servoparser::ParserContext as net_traits::FetchResponseListener>::process_response_eof
│ 45: script::script_thread::ScriptThread::handle_new_layout
│ 46: script::script_thread::ScriptThread::process_attach_layout
│ 47: script::dom::htmliframeelement::HTMLIFrameElement::start_new_pipeline
│ 48: <T as script::task::TaskBox>::run_box
│ 49: script::dom::document::Document::remove_script_and_layout_blocker
│ 50: script::dom::node::Node::insert
│ 51: script::dom::node::Node::pre_insert
│ 52: script::dom::bindings::codegen::Bindings::NodeBinding::Node_Binding::appendChild::{{closure}}
│ 53: mozjs::panic::wrap_panic
│ 54: script::dom::bindings::codegen::Bindings::NodeBinding::Node_Binding::appendChild
│ 55: CallJitMethodOp
│ 56: script::dom::bindings::utils::generic_call
│ 57: <unknown>
│ 58: <unknown>
│ 59: <unknown>
│ 60: <unknown>
│ 61: <unknown>
│ 62: <unknown>
│ 63: <unknown>
│ 64: <unknown>
│ 65: <unknown>
│ 66: <unknown>
│ 67: _ZN2js3jit32EnterBaselineInterpreterAtBranchEP9JSContextPNS_16InterpreterFrameEPh
│ 68: <unknown>
│ mozilla::detail::MutexImpl::~MutexImpl: pthread_mutex_destroy failed: Device or resource busy
│ Caught signal 11thread panicked while processing panic. aborting.
│ Redirecting call to abort() to mozalloc_abort