Skip to content

(new Blob).slice(0,0).text() panics due to BorrowError in GlobalScope.blob_state #29450

Closed
#29451
Closed
(new Blob).slice(0,0).text() panics due to BorrowError in GlobalScope.blob_state#29450
#29451
Labels
A-content/scriptRelated to the script thread
@delan

Description

@delan
delan
opened on Mar 1, 2023
$ cat test.html
<body><script>(async () => { document.body.textContent = await (new Blob(["PASS"]).slice(0,4).text()) })()</script>

$ ./mach run -d test.html
NOTE: Entering nix-shell etc/shell.nix
already mutably borrowed: BorrowError (thread Script(1,1), at components/script/dom/bindings/cell.rs:78)
   0: servo::backtrace::print
             at /home/delan/code/servo.master/ports/winit/backtrace.rs:17:5
   1: servo::main::{{closure}}
             at /home/delan/code/servo.master/ports/winit/main2.rs:133:21
   2: <alloc::boxed::Box<F,A> as core::ops::function::Fn<Args>>::call
             at /rustc/dc1d9d50fba2f6a1ccab8748a0050cde38253f60/library/alloc/src/boxed.rs:2002:9
      std::panicking::rust_panic_with_hook
             at /rustc/dc1d9d50fba2f6a1ccab8748a0050cde38253f60/library/std/src/panicking.rs:692:13
   3: std::panicking::begin_panic_handler::{{closure}}
             at /rustc/dc1d9d50fba2f6a1ccab8748a0050cde38253f60/library/std/src/panicking.rs:579:13
   4: std::sys_common::backtrace::__rust_end_short_backtrace
             at /rustc/dc1d9d50fba2f6a1ccab8748a0050cde38253f60/library/std/src/sys_common/backtrace.rs:137:18
   5: rust_begin_unwind
             at /rustc/dc1d9d50fba2f6a1ccab8748a0050cde38253f60/library/std/src/panicking.rs:575:5
   6: core::panicking::panic_fmt
             at /rustc/dc1d9d50fba2f6a1ccab8748a0050cde38253f60/library/core/src/panicking.rs:64:14
   7: core::result::unwrap_failed
             at /rustc/dc1d9d50fba2f6a1ccab8748a0050cde38253f60/library/core/src/result.rs:1790:5
   8: core::result::Result<T,E>::expect
             at /rustc/dc1d9d50fba2f6a1ccab8748a0050cde38253f60/library/core/src/result.rs:1069:23
   9: core::cell::RefCell<T>::borrow
             at /rustc/dc1d9d50fba2f6a1ccab8748a0050cde38253f60/library/core/src/cell.rs:876:9
  10: script::dom::bindings::cell::DomRefCell<T>::borrow
             at /home/delan/code/servo.master/components/script/dom/bindings/cell.rs:78:9
  11: script::dom::globalscope::GlobalScope::get_blob_size
             at /home/delan/code/servo.master/components/script/dom/globalscope.rs:1780:26
  12: script::dom::globalscope::GlobalScope::get_blob_url_id
             at /home/delan/code/servo.master/components/script/dom/globalscope.rs:1847:39
  13: script::dom::blob::Blob::get_blob_url_id
             at /home/delan/code/servo.master/components/script/dom/blob.rs:88:9
  14: <script::dom::blob::Blob as script::dom::bindings::codegen::Bindings::BlobBinding::BlobBinding::BlobMethods>::Text
             at /home/delan/code/servo.master/components/script/dom/blob.rs:243:18
  15: script::dom::bindings::codegen::Bindings::BlobBinding::BlobBinding::text::{{closure}}::{{closure}}
             at /home/delan/code/servo.master/target/debug/build/script-e7aeb837ea75c12d/out/Bindings/BlobBinding.rs:823:35
  16: script::dom::bindings::codegen::Bindings::BlobBinding::BlobBinding::text::{{closure}}
             at /home/delan/code/servo.master/target/debug/build/script-e7aeb837ea75c12d/out/Bindings/BlobBinding.rs:818:33
  17: core::ops::function::impls::<impl core::ops::function::FnOnce<A> for &mut F>::call_once
             at /rustc/dc1d9d50fba2f6a1ccab8748a0050cde38253f60/library/core/src/ops/function.rs:310:13
  18: <core::panic::unwind_safe::AssertUnwindSafe<F> as core::ops::function::FnOnce<()>>::call_once
             at /rustc/dc1d9d50fba2f6a1ccab8748a0050cde38253f60/library/core/src/panic/unwind_safe.rs:271:9
  19: std::panicking::try::do_call
             at /rustc/dc1d9d50fba2f6a1ccab8748a0050cde38253f60/library/std/src/panicking.rs:483:40
  20: __rust_try
  21: std::panicking::try
             at /rustc/dc1d9d50fba2f6a1ccab8748a0050cde38253f60/library/std/src/panicking.rs:447:19
  22: std::panic::catch_unwind
             at /rustc/dc1d9d50fba2f6a1ccab8748a0050cde38253f60/library/std/src/panic.rs:140:14
  23: mozjs::panic::wrap_panic
             at /home/delan/.cargo/git/checkouts/mozjs-fa11ffc7d4f1cc2d/d2a3526/rust-mozjs/src/panic.rs:22:11
  24: script::dom::bindings::codegen::Bindings::BlobBinding::BlobBinding::text
             at /home/delan/code/servo.master/target/debug/build/script-e7aeb837ea75c12d/out/Bindings/BlobBinding.rs:818:5
  25: CallJitMethodOp
             at /home/delan/.cargo/git/checkouts/mozjs-fa11ffc7d4f1cc2d/d2a3526/rust-mozjs/src/jsglue.cpp:623:10
  26: script::dom::bindings::utils::generic_call
             at /home/delan/code/servo.master/components/script/dom/bindings/utils.rs:531:5
  27: script::dom::bindings::utils::generic_method
             at /home/delan/code/servo.master/components/script/dom/bindings/utils.rs:547:5
  28: _Z12CallJSNativeP9JSContextPFbS0_jPN2JS5ValueEEN2js10CallReasonERKNS1_8CallArgsE
             at /home/delan/.cargo/git/checkouts/mozjs-fa11ffc7d4f1cc2d/d2a3526/mozjs/mozjs/js/src/vm/Interpreter.cpp:459:13
  29: _ZN2js23InternalCallOrConstructEP9JSContextRKN2JS8CallArgsENS_14MaybeConstructENS_10CallReasonE
             at /home/delan/.cargo/git/checkouts/mozjs-fa11ffc7d4f1cc2d/d2a3526/mozjs/mozjs/js/src/vm/Interpreter.cpp:547:12
  30: _ZN2js13CallFromStackEP9JSContextRKN2JS8CallArgsENS_10CallReasonE
             at /home/delan/.cargo/git/checkouts/mozjs-fa11ffc7d4f1cc2d/d2a3526/mozjs/mozjs/js/src/vm/Interpreter.cpp:619:10
      _ZL9InterpretP9JSContextRN2js8RunStateE
             at /home/delan/.cargo/git/checkouts/mozjs-fa11ffc7d4f1cc2d/d2a3526/mozjs/mozjs/js/src/vm/Interpreter.cpp:3375:16
  31: _ZN2js9RunScriptEP9JSContextRNS_8RunStateE
             at /home/delan/.cargo/git/checkouts/mozjs-fa11ffc7d4f1cc2d/d2a3526/mozjs/mozjs/js/src/vm/Interpreter.cpp:431:13
  32: _ZN2js13ExecuteKernelEP9JSContextN2JS6HandleIP8JSScriptEENS3_IP8JSObjectEENS_16AbstractFramePtrENS2_13MutableHandleINS2_5ValueEEE
             at /home/delan/.cargo/git/checkouts/mozjs-fa11ffc7d4f1cc2d/d2a3526/mozjs/mozjs/js/src/vm/Interpreter.cpp:825:13
  33: _ZN2js7ExecuteEP9JSContextN2JS6HandleIP8JSScriptEENS3_IP8JSObjectEENS2_13MutableHandleINS2_5ValueEEE
             at /home/delan/.cargo/git/checkouts/mozjs-fa11ffc7d4f1cc2d/d2a3526/mozjs/mozjs/js/src/vm/Interpreter.cpp:857:10
  34: _ZL13ExecuteScriptP9JSContextN2JS6HandleIP8JSObjectEENS2_IP8JSScriptEENS1_13MutableHandleINS1_5ValueEEE
             at /home/delan/.cargo/git/checkouts/mozjs-fa11ffc7d4f1cc2d/d2a3526/mozjs/mozjs/js/src/vm/CompilationAndEvaluation.cpp:467:10
  35: _Z16JS_ExecuteScriptP9JSContextN2JS6HandleIP8JSScriptEENS1_13MutableHandleINS1_5ValueEEE
             at /home/delan/.cargo/git/checkouts/mozjs-fa11ffc7d4f1cc2d/d2a3526/mozjs/mozjs/js/src/vm/CompilationAndEvaluation.cpp:484:10
  36: mozjs::rust::wrappers::JS_ExecuteScript
             at /home/delan/.cargo/git/checkouts/mozjs-fa11ffc7d4f1cc2d/d2a3526/rust-mozjs/src/rust.rs:1519:51
  37: script::dom::globalscope::GlobalScope::evaluate_script_on_global_with_result::{{closure}}
             at /home/delan/code/servo.master/components/script/dom/globalscope.rs:2669:34
  38: profile_traits::time::profile
             at /home/delan/code/servo.master/components/profile_traits/time.rs:141:15
  39: script::dom::globalscope::GlobalScope::evaluate_script_on_global_with_result
             at /home/delan/code/servo.master/components/script/dom/globalscope.rs:2598:9
  40: script::dom::htmlscriptelement::HTMLScriptElement::run_a_classic_script
             at /home/delan/code/servo.master/components/script/dom/htmlscriptelement.rs:1058:9
  41: script::dom::htmlscriptelement::HTMLScriptElement::execute
             at /home/delan/code/servo.master/components/script/dom/htmlscriptelement.rs:1020:17
  42: script::dom::htmlscriptelement::HTMLScriptElement::prepare
             at /home/delan/code/servo.master/components/script/dom/htmlscriptelement.rs:827:25
  43: script::dom::servoparser::ServoParser::tokenize
             at /home/delan/code/servo.master/components/script/dom/servoparser/mod.rs:619:13
  44: script::dom::servoparser::ServoParser::do_parse_sync
             at /home/delan/code/servo.master/components/script/dom/servoparser/mod.rs:560:9
  45: script::dom::servoparser::ServoParser::parse_sync::{{closure}}
             at /home/delan/code/servo.master/components/script/dom/servoparser/mod.rs:542:16
  46: profile_traits::time::profile
             at /home/delan/code/servo.master/components/profile_traits/time.rs:141:15
  47: script::dom::servoparser::ServoParser::parse_sync
             at /home/delan/code/servo.master/components/script/dom/servoparser/mod.rs:534:9
  48: script::dom::servoparser::ServoParser::parse_bytes_chunk
             at /home/delan/code/servo.master/components/script/dom/servoparser/mod.rs:585:13
  49: <script::dom::servoparser::ParserContext as net_traits::FetchResponseListener>::process_response_chunk
             at /home/delan/code/servo.master/components/script/dom/servoparser/mod.rs:919:9
  50: script::script_thread::ScriptThread::handle_fetch_chunk
             at /home/delan/code/servo.master/components/script/script_thread.rs:3858:13
  51: script::script_thread::ScriptThread::handle_msg_from_constellation
             at /home/delan/code/servo.master/components/script/script_thread.rs:1922:25
  52: script::script_thread::ScriptThread::handle_msgs::{{closure}}
             at /home/delan/code/servo.master/components/script/script_thread.rs:1646:53
  53: script::script_thread::ScriptThread::profile_event
             at /home/delan/code/servo.master/components/script/script_thread.rs:1890:13
  54: script::script_thread::ScriptThread::handle_msgs
             at /home/delan/code/servo.master/components/script/script_thread.rs:1640:26
  55: script::script_thread::ScriptThread::start
             at /home/delan/code/servo.master/components/script/script_thread.rs:1444:15
  56: <script::script_thread::ScriptThread as script_traits::ScriptThreadFactory>::create::{{closure}}::{{closure}}
             at /home/delan/code/servo.master/components/script/script_thread.rs:832:25
  57: profile_traits::mem::ProfilerChan::run_with_memory_reporting
             at /home/delan/code/servo.master/components/profile_traits/mem.rs:88:9
  58: <script::script_thread::ScriptThread as script_traits::ScriptThreadFactory>::create::{{closure}}
             at /home/delan/code/servo.master/components/script/script_thread.rs:830:17
  59: std::sys_common::backtrace::__rust_begin_short_backtrace
             at /rustc/dc1d9d50fba2f6a1ccab8748a0050cde38253f60/library/std/src/sys_common/backtrace.rs:121:18
  60: std::thread::Builder::spawn_unchecked_::{{closure}}::{{closure}}
             at /rustc/dc1d9d50fba2f6a1ccab8748a0050cde38253f60/library/std/src/thread/mod.rs:558:17
  61: <core::panic::unwind_safe::AssertUnwindSafe<F> as core::ops::function::FnOnce<()>>::call_once
             at /rustc/dc1d9d50fba2f6a1ccab8748a0050cde38253f60/library/core/src/panic/unwind_safe.rs:271:9
  62: std::panicking::try::do_call
             at /rustc/dc1d9d50fba2f6a1ccab8748a0050cde38253f60/library/std/src/panicking.rs:483:40
  63: __rust_try
  64: std::panicking::try
             at /rustc/dc1d9d50fba2f6a1ccab8748a0050cde38253f60/library/std/src/panicking.rs:447:19
  65: std::panic::catch_unwind
             at /rustc/dc1d9d50fba2f6a1ccab8748a0050cde38253f60/library/std/src/panic.rs:140:14
  66: std::thread::Builder::spawn_unchecked_::{{closure}}
             at /rustc/dc1d9d50fba2f6a1ccab8748a0050cde38253f60/library/std/src/thread/mod.rs:557:30
  67: core::ops::function::FnOnce::call_once{{vtable.shim}}
             at /rustc/dc1d9d50fba2f6a1ccab8748a0050cde38253f60/library/core/src/ops/function.rs:250:5
  68: <alloc::boxed::Box<F,A> as core::ops::function::FnOnce<Args>>::call_once
             at /rustc/dc1d9d50fba2f6a1ccab8748a0050cde38253f60/library/alloc/src/boxed.rs:1988:9
      <alloc::boxed::Box<F,A> as core::ops::function::FnOnce<Args>>::call_once
             at /rustc/dc1d9d50fba2f6a1ccab8748a0050cde38253f60/library/alloc/src/boxed.rs:1988:9
      std::sys::unix::thread::Thread::new::thread_start
             at /rustc/dc1d9d50fba2f6a1ccab8748a0050cde38253f60/library/std/src/sys/unix/thread.rs:108:17
  69: start_thread
  70: clone3
[2023-03-01T12:01:19Z ERROR servo] already mutably borrowed: BorrowError
Caught signal 11
Servo was terminated by signal 11

This issue causes /FileAPI/Blob-methods-from-detached-frame.html to fail even when named getter access is avoided with:

diff --git a/tests/wpt/web-platform-tests/FileAPI/Blob-methods-from-detached-frame.html b/tests/wpt/web-platform-tests/FileAPI/Blob-methods-from-detached-frame.html
index 37efd5ed20..1d7ac3b7d6 100644
--- a/tests/wpt/web-platform-tests/FileAPI/Blob-methods-from-detached-frame.html
+++ b/tests/wpt/web-platform-tests/FileAPI/Blob-methods-from-detached-frame.html
@@ -7,6 +7,7 @@
 <iframe id="emptyDocumentIframe" src="../support/empty-document.html"></iframe>
 
 <script>
+const emptyDocumentIframe = document.querySelector("#emptyDocumentIframe");
 const BlobPrototypeFromDetachedFramePromise = new Promise(resolve => {
     emptyDocumentIframe.onload = () => {
         const BlobPrototype = emptyDocumentIframe.contentWindow.Blob.prototype;

Metadata

Metadata

Assignees

No one assigned

    Labels

    A-content/scriptRelated to the script thread

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions