Repository navigation
Closed
Labels
A-content/domInteracting with the DOM from web contentInteracting with the DOM from web contentB-fuzzingFound by a fuzzer.Found by a fuzzer.C-has-manual-testcaseA minimal testcase exists that can be run manually.A minimal testcase exists that can be run manually.I-panicServo encounters a panic.Servo encounters a panic.
Description
See #46024 for a previous report with the same panic message.
Minimal testcase:
<!DOCTYPE html>
<div id="container"><span></span><span id="span1"></span><div id="div1"><span id="span2"></span></div></div>
<script>
onload = _ => {
span2.append("");
div1.attachShadow({mode: "open"});
container.replaceChild(span1, container.firstChild);
}
</script>System: Linux
Version: Version: Servo 0.4.0-68171645a
Command: ./servo/servoshell
Unstyled layout node? (thread Script#1, at components/script/layout_dom/servo_layout_element.rs:151)
0: servoshell::backtrace::print
1: servoshell::panic_hook::panic_hook
2: std::panicking::panic_with_hook
3: std::panicking::panic_handler::{closure#0}
4: std::sys::backtrace::__rust_end_short_backtrace::<std::panicking::panic_handler::{closure#0}, !>
5: __rustc::rust_begin_unwind
6: core::panicking::panic_fmt
7: core::option::expect_failed
8: <script::layout_dom::servo_layout_element::ServoLayoutElement as layout_api::layout_element::LayoutElement>::element_data
9: <script::layout_dom::servo_layout_element::ServoLayoutElement as layout_api::layout_element::LayoutElement>::style
10: <script::layout_dom::servo_layout_node::ServoLayoutNode as layout_api::layout_node::LayoutNode>::style
11: layout::dom_traversal::traverse_children_of
12: layout::flow::construct::<impl layout::flow::BlockContainer>::construct
13: layout::flow::construct::BlockLevelJob::finish
14: layout::flow::construct::BlockContainerBuilder::finish
15: layout::flow::construct::<impl layout::flow::BlockContainer>::construct
16: layout::flow::construct::BlockLevelJob::finish
17: layout::flow::construct::BlockContainerBuilder::finish
18: layout::flow::construct::<impl layout::flow::BlockContainer>::construct
19: layout::formatting_contexts::IndependentFormattingContext::construct_contents
20: layout::formatting_contexts::IndependentFormattingContext::construct
21: layout::flow::root::BoxTree::construct
22: layout::layout_impl::LayoutThread::restyle_and_build_trees::{{closure}}
23: layout::layout_impl::LayoutThread::handle_reflow
24: <layout::layout_impl::LayoutThread as layout_api::Layout>::reflow
25: <script::dom::window::window::Window>::reflow
26: <script::dom::document::document::Document>::update_the_rendering
27: <script::script_thread::ScriptThread>::update_the_rendering
28: <script::script_thread::ScriptThread>::handle_msgs
29: std::sys::backtrace::__rust_begin_short_backtrace::<<script::script_thread::ScriptThread as layout_api::ScriptThreadFactory>::create::{closure#0}, ()>
30: <std::thread::lifecycle::spawn_unchecked<<script::script_thread::ScriptThread as layout_api::ScriptThreadFactory>::create::{closure#0}, ()>::{closure#1} as core::ops::function::FnOnce<()>>::call_once::{shim:vtable#0}
31: <std::sys::thread::unix::Thread>::new::thread_start
32: start_thread
at ./nptl/pthread_create.c:447:8
33: clone3
at ./misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78:0
Metadata
Metadata
Assignees
Labels
A-content/domInteracting with the DOM from web contentInteracting with the DOM from web contentB-fuzzingFound by a fuzzer.Found by a fuzzer.C-has-manual-testcaseA minimal testcase exists that can be run manually.A minimal testcase exists that can be run manually.I-panicServo encounters a panic.Servo encounters a panic.
Activity
fred-wang commentedon Jul 30, 2026
@mrobinson also reported a different test case which is still panicking: #46024 (comment)
script: More carefully handle dirty root and descendant damage marking (
script: More carefully handle dirty root and descendant damage marking (
script: More carefully handle dirty root and descendant damage marking (