Skip to content

panic: Unstyled layout node? (thread Script#1, at components/script/layout_dom/servo_layout_element.rs:151) #46883

Closed

Description

@fred-wang

See #46024 for a previous report with the same panic message.

Minimal testcase:

<!DOCTYPE html>
<div id="container"><span></span><span id="span1"></span><div id="div1"><span id="span2"></span></div></div>
<script>
  onload = _ => {
    span2.append("");
    div1.attachShadow({mode: "open"});
    container.replaceChild(span1, container.firstChild);
  }
</script>

System: Linux
Version: Version: Servo 0.4.0-68171645a
Command: ./servo/servoshell

Unstyled layout node? (thread Script#1, at components/script/layout_dom/servo_layout_element.rs:151)
   0: servoshell::backtrace::print
   1: servoshell::panic_hook::panic_hook
   2: std::panicking::panic_with_hook
   3: std::panicking::panic_handler::{closure#0}
   4: std::sys::backtrace::__rust_end_short_backtrace::<std::panicking::panic_handler::{closure#0}, !>
   5: __rustc::rust_begin_unwind
   6: core::panicking::panic_fmt
   7: core::option::expect_failed
   8: <script::layout_dom::servo_layout_element::ServoLayoutElement as layout_api::layout_element::LayoutElement>::element_data
   9: <script::layout_dom::servo_layout_element::ServoLayoutElement as layout_api::layout_element::LayoutElement>::style
  10: <script::layout_dom::servo_layout_node::ServoLayoutNode as layout_api::layout_node::LayoutNode>::style
  11: layout::dom_traversal::traverse_children_of
  12: layout::flow::construct::<impl layout::flow::BlockContainer>::construct
  13: layout::flow::construct::BlockLevelJob::finish
  14: layout::flow::construct::BlockContainerBuilder::finish
  15: layout::flow::construct::<impl layout::flow::BlockContainer>::construct
  16: layout::flow::construct::BlockLevelJob::finish
  17: layout::flow::construct::BlockContainerBuilder::finish
  18: layout::flow::construct::<impl layout::flow::BlockContainer>::construct
  19: layout::formatting_contexts::IndependentFormattingContext::construct_contents
  20: layout::formatting_contexts::IndependentFormattingContext::construct
  21: layout::flow::root::BoxTree::construct
  22: layout::layout_impl::LayoutThread::restyle_and_build_trees::{{closure}}
  23: layout::layout_impl::LayoutThread::handle_reflow
  24: <layout::layout_impl::LayoutThread as layout_api::Layout>::reflow
  25: <script::dom::window::window::Window>::reflow
  26: <script::dom::document::document::Document>::update_the_rendering
  27: <script::script_thread::ScriptThread>::update_the_rendering
  28: <script::script_thread::ScriptThread>::handle_msgs
  29: std::sys::backtrace::__rust_begin_short_backtrace::<<script::script_thread::ScriptThread as layout_api::ScriptThreadFactory>::create::{closure#0}, ()>
  30: <std::thread::lifecycle::spawn_unchecked<<script::script_thread::ScriptThread as layout_api::ScriptThreadFactory>::create::{closure#0}, ()>::{closure#1} as core::ops::function::FnOnce<()>>::call_once::{shim:vtable#0}
  31: <std::sys::thread::unix::Thread>::new::thread_start
  32: start_thread
             at ./nptl/pthread_create.c:447:8
  33: clone3
             at ./misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78:0

Activity

  1. fred-wang commented on Jul 30, 2026

    @fred-wang
    ContributorAuthor

    @mrobinson also reported a different test case which is still panicking: #46024 (comment)

  2. added
    A-content/domInteracting with the DOM from web content
    C-has-manual-testcaseA minimal testcase exists that can be run manually.
    I-panicServo encounters a panic.
    and removed
    C-untriagedNew issues that haven't been triaged yet
    on Jul 30, 2026
  3. added a commit that references this issue on Aug 4, 2026
    2eab094
  4. added a commit that references this issue on Aug 5, 2026
    ca42da6
  5. added a commit that references this issue on Oct 6, 2026
    479b3f0
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    A-content/domInteracting with the DOM from web contentB-fuzzingFound by a fuzzer.C-has-manual-testcaseA minimal testcase exists that can be run manually.I-panicServo encounters a panic.

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions