panic: already mutably borrowed at atomic_refcell-0.1.13/src/lib.rs:155 #41183
Description
This is flaky, I'm relying on https://github.com/fred-wang/servo-fuzzing/blob/main/parallelize.sh to reproduce. I'm getting multiple assertion failures, sometimes in StyleThread sometimes in ScriptThread:
Minimal testcase:
<!DOCTYPE html>
<style>
audio:after { content: url(data:image/gif;base64,iVBORw0KGgoAAAANSUhEUgAAAGAAAABgCAIAAABt+uBvAAAAAXNSR0IArs4c6QAAAAlwSFlzAAALEwAACxMBAJqcGAAAAAd0SU1FB9wDGhYvCNVA1EIAAAAZdEVYdENvbW1lbnQAQ3JlYXRlZCB3aXRoIEdJTVBXgQ4XAAAAjklEQVR42u3QIQEAMAgAsHNNVspTgARY1BZh0ZWP3VcgSJAgQYIECRKEIEGCBAkSJEgQggQJEiRIkCBBCBIkSJAgQYIECUKQIEGCBAkSJAhBggQJEiRIkCAECRIkSJAgQYIEIUiQIEGCBAkShCBBggQJEiRIEIIECRIkSJAgQYIQJEiQIEGCBAlCkCBBdwaeugIthHvZ+AAAAABJRU5ErkJggg==); }
</style>
<script>
onload = _ => object.style = "text-transform: uppercase";
</script>
<object id="object"><audio controls><source src="about:blank"></audio></object>System: Linux
Version: Version: Servo 0.0.3-224ca771c
Command: ./parallelize.sh ./servo/servo testcase.html
already mutably borrowed (thread StyleThread#2, at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/atomic_refcell-0.1.13/src/lib.rs:155)
0: servoshell::backtrace::print
1: servoshell::panic_hook::panic_hook
2: std::panicking::panic_with_hook
3: std::panicking::panic_handler::{{closure}}
4: std::sys::backtrace::__rust_end_short_backtrace
5: __rustc::rust_begin_unwind
6: core::panicking::panic_fmt
7: core::panicking::panic_display
8: layout::layout_box_base::LayoutBoxBase::inline_content_sizes
9: core::cell::lazy::LazyCell<T,F>::really_init
10: layout::flow::<impl layout::formatting_contexts::IndependentFormattingContext>::layout_float_or_atomic_inline
11: layout::flow::BlockContainer::layout
12: layout::flow::BlockFormattingContext::layout
13: layout::formatting_contexts::IndependentFormattingContext::layout
14: layout::positioned::HoistedAbsolutelyPositionedBox::layout
15: rayon::iter::plumbing::bridge_producer_consumer::helper
16: layout::positioned::HoistedAbsolutelyPositionedBox::layout_many
17: layout::positioned::PositioningContext::layout_collected_children
18: layout::flow::BlockLevelBox::layout
19: rayon::iter::plumbing::bridge_producer_consumer::helper
20: layout::flow::BlockContainer::layout
21: layout::flow::BlockFormattingContext::layout
22: layout::formatting_contexts::IndependentFormattingContext::layout
23: layout::flow::<impl layout::formatting_contexts::IndependentFormattingContext>::layout_float_or_atomic_inline
24: layout::flow::BlockContainer::layout
25: layout::flow::BlockLevelBox::layout::{{closure}}
26: layout::flow::BlockLevelBox::layout
27: rayon::iter::plumbing::bridge_producer_consumer::helper
28: <rayon_core::job::StackJob<L,F,R> as rayon_core::job::Job>::execute
29: rayon_core::registry::WorkerThread::wait_until_cold
30: rayon_core::registry::ThreadBuilder::run
31: std::sys::backtrace::__rust_begin_short_backtrace
32: core::ops::function::FnOnce::call_once{{vtable.shim}}
33: std::sys::thread::unix::Thread::new::thread_start