servo icon indicating copy to clipboard operation
servo copied to clipboard

Intermittent double mutable borrow during GC while running tests

Open jdm opened this issue 1 year ago • 0 comments

From interpreting the stack trace, this looks like the same underlying issue as https://github.com/servo/servo/issues/32454. When the parser is synchronously parsing and a GC occurs, we attempt to mutably borrow fields of the parser that are already borrowed.

  ▶ CRASH [expected OK] /url/failure.html (#28574)
  │ 
  │ already mutably borrowed: BorrowError (thread Script(1,1), at components/script/dom/bindings/cell.rs:80)
  │    0: servoshell::backtrace::print
  │    1: servoshell::panic_hook::panic_hook
  │    2: std::panicking::rust_panic_with_hook
  │    3: std::panicking::begin_panic_handler::{{closure}}
  │    4: std::sys_common::backtrace::__rust_end_short_backtrace
  │    5: rust_begin_unwind
  │    6: core::panicking::panic_fmt
  │    7: core::cell::panic_already_mutably_borrowed
  │    8: script::dom::bindings::trace::<impl mozjs::gc::trace::Traceable for script::dom::bindings::cell::DomRefCell<T>>::trace
  │    9: script::dom::bindings::codegen::Bindings::ServoParserBinding::ServoParser_Binding::_trace::{{closure}}
  │   10: mozjs::panic::wrap_panic
  │   11: script::dom::bindings::codegen::Bindings::ServoParserBinding::ServoParser_Binding::_trace
  │   12: _ZN2js8GCMarker19processMarkStackTopILj4EEEbRNS_11SliceBudgetE
  │   13: _ZN2js8GCMarker9doMarkingILj4EEEbRNS_11SliceBudgetENS_2gc20ShouldReportMarkTimeE
  │   14: _ZN2js2gc9GCRuntime24markUntilBudgetExhaustedERNS_11SliceBudgetENS1_15ParallelMarkingENS0_20ShouldReportMarkTimeE
  │   15: _ZN2js2gc9GCRuntime16incrementalSliceERNS_11SliceBudgetEN2JS8GCReasonEb
  │   16: _ZN2js2gc9GCRuntime7gcCycleEbRKNS_11SliceBudgetEN2JS8GCReasonE
  │   17: _ZN2js2gc9GCRuntime7collectEbRKNS_11SliceBudgetEN2JS8GCReasonE
  │   18: _ZN2js2gc9GCRuntime17gcIfRequestedImplEb
  │   19: _ZN2js2gc13CellAllocator16AllocTenuredCellILNS_7AllowGCE1EEEPvP9JSContextNS0_9AllocKindEm
  │   20: _ZN2js12GetterSetter6createEP9JSContextN2JS6HandleIP8JSObjectEES7_
  │   21: _ZN2js20NativeDefinePropertyEP9JSContextN2JS6HandleIPNS_12NativeObjectEEENS3_INS2_11PropertyKeyEEENS3_INS2_18PropertyDescriptorEEERNS2_14ObjectOpResultE
  │   22: _ZN2js22DefineAccessorPropertyEP9JSContextN2JS6HandleIP8JSObjectEENS3_INS2_11PropertyKeyEEES6_S6_j
  │   23: _ZL26DefineAccessorPropertyByIdP9JSContextN2JS6HandleIP8JSObjectEENS2_INS1_11PropertyKeyEEERK15JSNativeWrapperSA_j
  │   24: _Z19JS_DefinePropertiesP9JSContextN2JS6HandleIP8JSObjectEEPK14JSPropertySpec
  │   25: mozjs::rust::define_properties
  │   26: script::dom::bindings::interface::create_object
  │   27: script::dom::bindings::interface::create_interface_prototype_object
  │   28: script::dom::bindings::codegen::Bindings::HTMLBodyElementBinding::HTMLBodyElement_Binding::CreateInterfaceObjects
  │   29: script::dom::bindings::interface::get_per_interface_object_handle
  │   30: script::dom::bindings::codegen::Bindings::HTMLBodyElementBinding::HTMLBodyElement_Binding::Wrap
  │   31: script::dom::create::create_native_html_element
  │   32: script::dom::create::create_element
  │   33: script::dom::servoparser::create_element_for_token
  │   34: <script::dom::servoparser::Sink as markup5ever::interface::tree_builder::TreeSink>::create_element
  │   35: markup5ever::interface::tree_builder::create_element
  │   36: html5ever::tree_builder::TreeBuilder<Handle,Sink>::insert_element
  │   37: html5ever::tree_builder::TreeBuilder<Handle,Sink>::step
  │   38: <html5ever::tree_builder::TreeBuilder<Handle,Sink> as html5ever::tokenizer::interface::TokenSink>::process_token
  │   39: html5ever::tokenizer::Tokenizer<Sink>::process_token
  │   40: html5ever::tokenizer::Tokenizer<Sink>::end
  │   41: script::dom::servoparser::ServoParser::do_parse_sync
  │   42: profile_traits::time::profile
  │   43: script::dom::servoparser::ServoParser::parse_sync
  │   44: <script::dom::servoparser::ParserContext as net_traits::FetchResponseListener>::process_response_eof
  │   45: script::script_thread::ScriptThread::handle_new_layout
  │   46: script::script_thread::ScriptThread::process_attach_layout
  │   47: script::dom::htmliframeelement::HTMLIFrameElement::start_new_pipeline
  │   48: <T as script::task::TaskBox>::run_box
  │   49: script::dom::document::Document::remove_script_and_layout_blocker
  │   50: script::dom::node::Node::insert
  │   51: script::dom::node::Node::pre_insert
  │   52: script::dom::bindings::codegen::Bindings::NodeBinding::Node_Binding::appendChild::{{closure}}
  │   53: mozjs::panic::wrap_panic
  │   54: script::dom::bindings::codegen::Bindings::NodeBinding::Node_Binding::appendChild
  │   55: CallJitMethodOp
  │   56: script::dom::bindings::utils::generic_call
  │   57: <unknown>
  │   58: <unknown>
  │   59: <unknown>
  │   60: <unknown>
  │   61: <unknown>
  │   62: <unknown>
  │   63: <unknown>
  │   64: <unknown>
  │   65: <unknown>
  │   66: <unknown>
  │   67: _ZN2js3jit32EnterBaselineInterpreterAtBranchEP9JSContextPNS_16InterpreterFrameEPh
  │   68: <unknown>
  │ mozilla::detail::MutexImpl::~MutexImpl: pthread_mutex_destroy failed: Device or resource busy
  │ Caught signal 11thread panicked while processing panic. aborting.
  │ Redirecting call to abort() to mozalloc_abort

jdm avatar Jun 29 '24 16:06 jdm