From interpreting the stack trace, this looks like the same underlying issue as <a cla

Another repro… <div class="highlight highlight-text-html-basic notranslate positio

Intermittent double mutable borrow when GC occurs during synchronous parsing about servo HOT 2 CLOSED

jdm commented on August 28, 2024

Intermittent double mutable borrow when GC occurs during synchronous parsing

from servo.

Comments (2)

jdm commented on August 28, 2024

go to https://ocv.me/hashi
* click the 2 button and then the big button below
* wait until get solution 2 appears, then click that
* it continues for a while, then crashes

the crash only occurs with puzzle 2, and not with 0, 1 or 3

reproduced on:

macos 14.5 on an m1 mbp, Z11C running the nightly with rosetta
macos 14.2 on an m3pro mbp, MRW23N/A running the native build

from servo.

delan commented on August 28, 2024

Another repro…

<!DOCTYPE html>
<meta charset="utf-8">
<input id="count">
<script>
var tags = '<div></div><div></div><div></div><div></div><div></div>';
var attr = '<div foo="bar" foo="bar" foo="bar" foo="bar sda"></div>';
var nest = '<div><div><div><div><div></div></div></div></div></div>';

var tags10 = tags + tags + tags + tags + tags + tags + tags + tags + tags + tags;
var attr10 = attr + attr + attr + attr + attr + attr + attr + attr + attr + attr;
var nest10 = nest + nest + nest + nest + nest + nest + nest + nest + nest + nest;

var div = document.createElement('div');
var i = 0;

setInterval(function() {
    for (let j = 0; j < 100; j++) {
        div.innerHTML = tags10;
        div.innerHTML = attr10;
        div.innerHTML = nest10;
    }
    count.value = ++i;
}, 0);
</script>

…based on these Blink perf tests:

[2024-07-11T10:52:10Z ERROR servoshell::panic_hook] already mutably borrowed: BorrowError
already mutably borrowed: BorrowError (thread Script(1,33), at components/script/dom/bindings/cell.rs:95)
   0: servoshell::backtrace::print
   1: servoshell::panic_hook::panic_hook
   2: std::panicking::rust_panic_with_hook
   3: std::panicking::begin_panic_handler::{{closure}}
   4: std::sys_common::backtrace::__rust_end_short_backtrace
   5: rust_begin_unwind
   6: core::panicking::panic_fmt
   7: core::cell::panic_already_mutably_borrowed
   8: script::dom::bindings::trace::<impl mozjs::gc::trace::Traceable for script::dom::bindings::cell::DomRefCell<T>>::trace
   9: script::dom::bindings::codegen::Bindings::ServoParserBinding::ServoParser_Binding::_trace::{{closure}}
  10: mozjs::panic::wrap_panic
  11: script::dom::bindings::codegen::Bindings::ServoParserBinding::ServoParser_Binding::_trace
  12: _ZN2js8GCMarker19processMarkStackTopILj4EEEbRNS_11SliceBudgetE
  13: _ZN2js8GCMarker9doMarkingILj4EEEbRNS_11SliceBudgetENS_2gc20ShouldReportMarkTimeE
  14: _ZN2js2gc9GCRuntime24markUntilBudgetExhaustedERNS_11SliceBudgetENS1_15ParallelMarkingENS0_20ShouldReportMarkTimeE
  15: _ZN2js2gc9GCRuntime16incrementalSliceERNS_11SliceBudgetEN2JS8GCReasonEb
  16: _ZN2js2gc9GCRuntime7gcCycleEbRKNS_11SliceBudgetEN2JS8GCReasonE
  17: _ZN2js2gc9GCRuntime7collectEbRKNS_11SliceBudgetEN2JS8GCReasonE
  18: _ZN2js2gc9GCRuntime17gcIfRequestedImplEb
  19: _ZN2js2gc13CellAllocator25AllocNurseryOrTenuredCellILN2JS9TraceKindE0ELNS_7AllowGCE1EEEPvP9JSContextNS0_9AllocKindENS0_4HeapEPNS0_9AllocSiteE
  20: _ZN2js29NewObjectWithGivenTaggedProtoEP9JSContextPK7JSClassN2JS6HandleINS_11TaggedProtoEEENS_2gc9AllocKindENS_13NewObjectKindE
  21: script::dom::bindings::codegen::Bindings::HTMLDivElementBinding::HTMLDivElement_Binding::Wrap
  22: script::dom::create::create_native_html_element
  23: script::dom::create::create_element
  24: script::dom::servoparser::create_element_for_token
  25: <script::dom::servoparser::Sink as markup5ever::interface::tree_builder::TreeSink>::create_element
  26: markup5ever::interface::tree_builder::create_element
  27: html5ever::tree_builder::TreeBuilder<Handle,Sink>::insert_element
  28: html5ever::tree_builder::TreeBuilder<Handle,Sink>::step
  29: <html5ever::tree_builder::TreeBuilder<Handle,Sink> as html5ever::tokenizer::interface::TokenSink>::process_token
  30: html5ever::tokenizer::Tokenizer<Sink>::emit_current_tag
  31: html5ever::tokenizer::Tokenizer<Sink>::step
  32: html5ever::tokenizer::Tokenizer<Sink>::run
  33: script::dom::servoparser::html::Tokenizer::feed
  34: script::dom::servoparser::ServoParser::do_parse_sync
  35: profile_traits::time::profile
  36: script::dom::servoparser::ServoParser::parse_sync
  37: script::dom::servoparser::ServoParser::parse_html_fragment
  38: script::dom::element::Element::parse_fragment
  39: <script::dom::element::Element as script::dom::bindings::codegen::Bindings::ElementBinding::Element_Binding::ElementMethods>::SetInnerHTML
  40: script::dom::bindings::codegen::Bindings::ElementBinding::Element_Binding::set_innerHTML::{{closure}}
  41: mozjs::panic::wrap_panic
  42: script::dom::bindings::codegen::Bindings::ElementBinding::Element_Binding::set_innerHTML
  43: <unknown>

from servo.

Intermittent double mutable borrow when GC occurs during synchronous parsing about servo HOT 2 CLOSED

Comments (2)

Related Issues (20)

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent