Skip to content

"index out of bounds: the len is 64 but the index is 64" when loading discord.gg #36792

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
simonwuelker opened this issue May 1, 2025 · 5 comments
Open

"index out of bounds: the len is 64 but the index is 64" when loading discord.gg #36792

simonwuelker opened this issue May 1, 2025 · 5 comments
Labels
C-has-manual-testcase C-needs-investigation I-panic Servo encounters a panic.

Comments

@simonwuelker
Copy link
Contributor

simonwuelker commented May 1, 2025 •
edited
Loading

To reproduce: ./mach build && ./mach run discord.gg

Backtrace 
index out of bounds: the len is 64 but the index is 64 (thread <unnamed>, at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ipc-channel-0.19.0/src/ipc.rs:562)
   0: servoshell::backtrace::print
             at /home/alaska/servo/ports/servoshell/backtrace.rs:18:5
   1: servoshell::panic_hook::panic_hook
             at /home/alaska/servo/ports/servoshell/panic_hook.rs:40:17
   2: core::ops::function::Fn::call
             at /home/alaska/.rustup/toolchains/1.85.0-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ops/function.rs:79:5
   3: <alloc::boxed::Box<F,A> as core::ops::function::Fn<Args>>::call
             at /rustc/4d91de4e48198da2e33413efdcd9cd2cc0c46688/library/alloc/src/boxed.rs:2007:9
      std::panicking::rust_panic_with_hook
             at /rustc/4d91de4e48198da2e33413efdcd9cd2cc0c46688/library/std/src/panicking.rs:836:13
   4: std::panicking::begin_panic_handler::{{closure}}
             at /rustc/4d91de4e48198da2e33413efdcd9cd2cc0c46688/library/std/src/panicking.rs:701:13
   5: std::sys::backtrace::__rust_end_short_backtrace
             at /rustc/4d91de4e48198da2e33413efdcd9cd2cc0c46688/library/std/src/sys/backtrace.rs:168:18
   6: rust_begin_unwind
             at /rustc/4d91de4e48198da2e33413efdcd9cd2cc0c46688/library/std/src/panicking.rs:692:5
   7: core::panicking::panic_fmt
             at /rustc/4d91de4e48198da2e33413efdcd9cd2cc0c46688/library/core/src/panicking.rs:75:14
   8: core::panicking::panic_bounds_check
             at /rustc/4d91de4e48198da2e33413efdcd9cd2cc0c46688/library/core/src/panicking.rs:273:5
   9: <usize as core::slice::index::SliceIndex<[T]>>::index_mut
             at /home/alaska/.rustup/toolchains/1.85.0-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/slice/index.rs:280:14
  10: core::slice::index::<impl core::ops::index::IndexMut<I> for [T]>::index_mut
             at /home/alaska/.rustup/toolchains/1.85.0-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/slice/index.rs:27:9
      <alloc::vec::Vec<T,A> as core::ops::index::IndexMut<I>>::index_mut
             at /home/alaska/.rustup/toolchains/1.85.0-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/alloc/src/vec/mod.rs:3373:9
  11: <ipc_channel::ipc::IpcSharedMemory as serde::de::Deserialize>::deserialize::{{closure}}
             at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ipc-channel-0.19.0/src/ipc.rs:562:78
  12: std::thread::local::LocalKey<T>::try_with
             at /home/alaska/.rustup/toolchains/1.85.0-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/thread/local.rs:308:12
  13: std::thread::local::LocalKey<T>::with
             at /home/alaska/.rustup/toolchains/1.85.0-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/thread/local.rs:272:9
  14: <ipc_channel::ipc::IpcSharedMemory as serde::de::Deserialize>::deserialize
             at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ipc-channel-0.19.0/src/ipc.rs:558:32
  15: <core::marker::PhantomData<T> as serde::de::DeserializeSeed>::deserialize
             at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/serde-1.0.219/src/de/mod.rs:800:9
  16: <<&mut bincode::de::Deserializer<R,O> as serde::de::Deserializer>::deserialize_tuple::Access<R,O> as serde::de::SeqAccess>::next_element_seed
             at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bincode-1.3.3/src/de/mod.rs:314:25
  17: serde::de::SeqAccess::next_element
             at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/serde-1.0.219/src/de/mod.rs:1734:9
  18: <pixels::_::<impl serde::de::Deserialize for pixels::ImageFrame>::deserialize::__Visitor as serde::de::Visitor>::visit_seq
             at /home/alaska/servo/components/pixels/lib.rs:132:17
  19: <&mut bincode::de::Deserializer<R,O> as serde::de::Deserializer>::deserialize_tuple
             at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bincode-1.3.3/src/de/mod.rs:326:9
  20: <&mut bincode::de::Deserializer<R,O> as serde::de::Deserializer>::deserialize_struct
             at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bincode-1.3.3/src/de/mod.rs:411:9
  21: pixels::_::<impl serde::de::Deserialize for pixels::ImageFrame>::deserialize
             at /home/alaska/servo/components/pixels/lib.rs:132:17
  22: <core::marker::PhantomData<T> as serde::de::DeserializeSeed>::deserialize
             at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/serde-1.0.219/src/de/mod.rs:800:9
  23: <<&mut bincode::de::Deserializer<R,O> as serde::de::Deserializer>::deserialize_tuple::Access<R,O> as serde::de::SeqAccess>::next_element_seed
             at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bincode-1.3.3/src/de/mod.rs:314:25
  24: serde::de::SeqAccess::next_element
             at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/serde-1.0.219/src/de/mod.rs:1734:9
  25: <serde::de::impls::<impl serde::de::Deserialize for alloc::vec::Vec<T>>::deserialize::VecVisitor<T> as serde::de::Visitor>::visit_seq
             at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/serde-1.0.219/src/de/impls.rs:1175:46
  26: <&mut bincode::de::Deserializer<R,O> as serde::de::Deserializer>::deserialize_tuple
             at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bincode-1.3.3/src/de/mod.rs:326:9
  27: <&mut bincode::de::Deserializer<R,O> as serde::de::Deserializer>::deserialize_seq
             at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bincode-1.3.3/src/de/mod.rs:350:9
  28: serde::de::impls::<impl serde::de::Deserialize for alloc::vec::Vec<T>>::deserialize
             at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/serde-1.0.219/src/de/impls.rs:1186:9
  29: <core::marker::PhantomData<T> as serde::de::DeserializeSeed>::deserialize
             at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/serde-1.0.219/src/de/mod.rs:800:9
  30: <<&mut bincode::de::Deserializer<R,O> as serde::de::Deserializer>::deserialize_tuple::Access<R,O> as serde::de::SeqAccess>::next_element_seed
             at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bincode-1.3.3/src/de/mod.rs:314:25
  31: serde::de::SeqAccess::next_element
             at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/serde-1.0.219/src/de/mod.rs:1734:9
  32: <pixels::_::<impl serde::de::Deserialize for pixels::Image>::deserialize::__Visitor as serde::de::Visitor>::visit_seq
             at /home/alaska/servo/components/pixels/lib.rs:122:17
  33: <&mut bincode::de::Deserializer<R,O> as serde::de::Deserializer>::deserialize_tuple
             at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bincode-1.3.3/src/de/mod.rs:326:9
  34: <&mut bincode::de::Deserializer<R,O> as serde::de::Deserializer>::deserialize_struct
             at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bincode-1.3.3/src/de/mod.rs:411:9
  35: pixels::_::<impl serde::de::Deserialize for pixels::Image>::deserialize
             at /home/alaska/servo/components/pixels/lib.rs:122:17
  36: serde::de::impls::<impl serde::de::Deserialize for alloc::boxed::Box<T>>::deserialize
             at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/serde-1.0.219/src/de/impls.rs:863:17
  37: serde::de::impls::<impl serde::de::Deserialize for alloc::sync::Arc<T>>::deserialize
             at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/serde-1.0.219/src/de/impls.rs:2068:17
  38: <core::marker::PhantomData<T> as serde::de::DeserializeSeed>::deserialize
             at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/serde-1.0.219/src/de/mod.rs:800:9
  39: <<&mut bincode::de::Deserializer<R,O> as serde::de::Deserializer>::deserialize_tuple::Access<R,O> as serde::de::SeqAccess>::next_element_seed
             at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bincode-1.3.3/src/de/mod.rs:314:25
  40: serde::de::SeqAccess::next_element
             at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/serde-1.0.219/src/de/mod.rs:1734:9
  41: <<net_traits::image_cache::_::<impl serde::de::Deserialize for net_traits::image_cache::ImageResponse>::deserialize::__Visitor as serde::de::Visitor>::visit_enum::__Visitor as serde::de::Visitor>::visit_seq
             at /home/alaska/servo/components/shared/net/image_cache.rs:75:24
  42: <&mut bincode::de::Deserializer<R,O> as serde::de::Deserializer>::deserialize_tuple
             at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bincode-1.3.3/src/de/mod.rs:326:9
  43: <&mut bincode::de::Deserializer<R,O> as serde::de::VariantAccess>::tuple_variant
             at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bincode-1.3.3/src/de/mod.rs:483:9
  44: <net_traits::image_cache::_::<impl serde::de::Deserialize for net_traits::image_cache::ImageResponse>::deserialize::__Visitor as serde::de::Visitor>::visit_enum
             at /home/alaska/servo/components/shared/net/image_cache.rs:75:24
  45: <&mut bincode::de::Deserializer<R,O> as serde::de::Deserializer>::deserialize_enum
             at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bincode-1.3.3/src/de/mod.rs:290:9
  46: net_traits::image_cache::_::<impl serde::de::Deserialize for net_traits::image_cache::ImageResponse>::deserialize
             at /home/alaska/servo/components/shared/net/image_cache.rs:75:24
  47: <core::marker::PhantomData<T> as serde::de::DeserializeSeed>::deserialize
             at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/serde-1.0.219/src/de/mod.rs:800:9
  48: <<&mut bincode::de::Deserializer<R,O> as serde::de::Deserializer>::deserialize_tuple::Access<R,O> as serde::de::SeqAccess>::next_element_seed
             at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bincode-1.3.3/src/de/mod.rs:314:25
  49: serde::de::SeqAccess::next_element
             at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/serde-1.0.219/src/de/mod.rs:1734:9
  50: <net_traits::image_cache::_::<impl serde::de::Deserialize for net_traits::image_cache::PendingImageResponse>::deserialize::__Visitor as serde::de::Visitor>::visit_seq
             at /home/alaska/servo/components/shared/net/image_cache.rs:91:24
  51: <&mut bincode::de::Deserializer<R,O> as serde::de::Deserializer>::deserialize_tuple
             at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bincode-1.3.3/src/de/mod.rs:326:9
  52: <&mut bincode::de::Deserializer<R,O> as serde::de::Deserializer>::deserialize_struct
             at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bincode-1.3.3/src/de/mod.rs:411:9
  53: net_traits::image_cache::_::<impl serde::de::Deserialize for net_traits::image_cache::PendingImageResponse>::deserialize
             at /home/alaska/servo/components/shared/net/image_cache.rs:91:24
  54: <core::marker::PhantomData<T> as serde::de::DeserializeSeed>::deserialize
             at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/serde-1.0.219/src/de/mod.rs:800:9
  55: bincode::internal::deserialize_seed
             at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bincode-1.3.3/src/internal.rs:118:15
  56: bincode::internal::deserialize
             at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bincode-1.3.3/src/internal.rs:106:5
  57: bincode::config::Options::deserialize
             at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bincode-1.3.3/src/config/mod.rs:200:9
      bincode::deserialize
             at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bincode-1.3.3/src/lib.rs:181:5
  58: ipc_channel::ipc::IpcMessage::to::{{closure}}::{{closure}}
             at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ipc-channel-0.19.0/src/ipc.rs:726:34
  59: std::thread::local::LocalKey<T>::try_with
             at /home/alaska/.rustup/toolchains/1.85.0-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/thread/local.rs:308:12
  60: std::thread::local::LocalKey<T>::with
             at /home/alaska/.rustup/toolchains/1.85.0-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/thread/local.rs:272:9
  61: ipc_channel::ipc::IpcMessage::to::{{closure}}
             at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ipc-channel-0.19.0/src/ipc.rs:713:13
  62: std::thread::local::LocalKey<T>::try_with
             at /home/alaska/.rustup/toolchains/1.85.0-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/thread/local.rs:308:12
  63: std::thread::local::LocalKey<T>::with
             at /home/alaska/.rustup/toolchains/1.85.0-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/thread/local.rs:272:9
  64: ipc_channel::ipc::IpcMessage::to
             at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ipc-channel-0.19.0/src/ipc.rs:712:9
  65: ipc_channel::router::RouterProxy::add_typed_route::{{closure}}
             at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ipc-channel-0.19.0/src/router.rs:90:33
  66: <alloc::boxed::Box<F,A> as core::ops::function::FnMut<Args>>::call_mut
             at /home/alaska/.rustup/toolchains/1.85.0-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/alloc/src/boxed.rs:2000:9
  67: ipc_channel::router::Router::run
             at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ipc-channel-0.19.0/src/router.rs:220:25
  68: ipc_channel::router::RouterProxy::new::{{closure}}
             at /home/alaska/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ipc-channel-0.19.0/src/router.rs:50:31
  69: std::sys::backtrace::__rust_begin_short_backtrace
             at /home/alaska/.rustup/toolchains/1.85.0-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/sys/backtrace.rs:152:18
  70: std::thread::Builder::spawn_unchecked_::{{closure}}::{{closure}}
             at /home/alaska/.rustup/toolchains/1.85.0-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/thread/mod.rs:564:17
  71: <core::panic::unwind_safe::AssertUnwindSafe<F> as core::ops::function::FnOnce<()>>::call_once
             at /home/alaska/.rustup/toolchains/1.85.0-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/panic/unwind_safe.rs:272:9
  72: std::panicking::try::do_call
             at /home/alaska/.rustup/toolchains/1.85.0-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/panicking.rs:584:40
  73: __rust_try
  74: std::panicking::try
             at /home/alaska/.rustup/toolchains/1.85.0-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/panicking.rs:547:19
      std::panic::catch_unwind
             at /home/alaska/.rustup/toolchains/1.85.0-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/panic.rs:358:14
      std::thread::Builder::spawn_unchecked_::{{closure}}
             at /home/alaska/.rustup/toolchains/1.85.0-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/thread/mod.rs:562:30
  75: core::ops::function::FnOnce::call_once{{vtable.shim}}
             at /home/alaska/.rustup/toolchains/1.85.0-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ops/function.rs:250:5
  76: <alloc::boxed::Box<F,A> as core::ops::function::FnOnce<Args>>::call_once
             at /rustc/4d91de4e48198da2e33413efdcd9cd2cc0c46688/library/alloc/src/boxed.rs:1993:9
      <alloc::boxed::Box<F,A> as core::ops::function::FnOnce<Args>>::call_once
             at /rustc/4d91de4e48198da2e33413efdcd9cd2cc0c46688/library/alloc/src/boxed.rs:1993:9
      std::sys::pal::unix::thread::Thread::new::thread_start
             at /rustc/4d91de4e48198da2e33413efdcd9cd2cc0c46688/library/std/src/sys/pal/unix/thread.rs:106:17
  77: start_thread
  78: __clone3
@simonwuelker simonwuelker added I-panic Servo encounters a panic. C-needs-investigation labels May 1, 2025
@jdm
Copy link
Member

jdm commented May 1, 2025

https://github.com/servo/ipc-channel/blob/82f6c49096b116208861f928862f9eefaf47c3c9/src/ipc.rs#L584

@simonwuelker
Copy link
Contributor Author

The comment right above that line sure looks suspicious :D

@simonwuelker simonwuelker mentioned this issue May 1, 2025
Merged
@simonwuelker
Copy link
Contributor Author

simonwuelker commented May 1, 2025 •
edited
Loading

servo/ipc-channel#392 reveals that the route that causes the panic is added here:

servo/components/script/script_thread.rs

Lines 877 to 882 in b10fc49

ROUTER.add_typed_route(
ipc_image_cache_receiver,
Box::new(move |message| {
let _ = image_cache_sender.send(message.unwrap());
}),
);

New Backtrace 
called `Result::unwrap()` on an `Err` value: Custom("Cannot consume shared memory region at index 64, there are only 64 regions available") (thread router-proxy, at components/script/script_thread.rs:880)
   0: servoshell::backtrace::print
             at /home/alaska/servo/ports/servoshell/backtrace.rs:18:5
   1: servoshell::panic_hook::panic_hook
             at /home/alaska/servo/ports/servoshell/panic_hook.rs:40:17
   2: core::ops::function::Fn::call
             at /home/alaska/.rustup/toolchains/1.85.0-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ops/function.rs:79:5
   3: <alloc::boxed::Box<F,A> as core::ops::function::Fn<Args>>::call
             at /rustc/4d91de4e48198da2e33413efdcd9cd2cc0c46688/library/alloc/src/boxed.rs:2007:9
      std::panicking::rust_panic_with_hook
             at /rustc/4d91de4e48198da2e33413efdcd9cd2cc0c46688/library/std/src/panicking.rs:836:13
   4: std::panicking::begin_panic_handler::{{closure}}
             at /rustc/4d91de4e48198da2e33413efdcd9cd2cc0c46688/library/std/src/panicking.rs:701:13
   5: std::sys::backtrace::__rust_end_short_backtrace
             at /rustc/4d91de4e48198da2e33413efdcd9cd2cc0c46688/library/std/src/sys/backtrace.rs:168:18
   6: rust_begin_unwind
             at /rustc/4d91de4e48198da2e33413efdcd9cd2cc0c46688/library/std/src/panicking.rs:692:5
   7: core::panicking::panic_fmt
             at /rustc/4d91de4e48198da2e33413efdcd9cd2cc0c46688/library/core/src/panicking.rs:75:14
   8: core::result::unwrap_failed
             at /rustc/4d91de4e48198da2e33413efdcd9cd2cc0c46688/library/core/src/result.rs:1704:5
   9: core::result::Result<T,E>::unwrap
             at /home/alaska/.rustup/toolchains/1.85.0-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/result.rs:1109:23
      script::script_thread::ScriptThread::new::{{closure}}
             at /home/alaska/servo/components/script/script_thread.rs:880:49
  10: <alloc::boxed::Box<F,A> as core::ops::function::FnMut<Args>>::call_mut
             at /home/alaska/.rustup/toolchains/1.85.0-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/alloc/src/boxed.rs:2000:9
  11: ipc_channel::router::RouterProxy::add_typed_route::{{closure}}
             at /home/alaska/ipc-channel/src/router.rs:94:13
  12: <alloc::boxed::Box<F,A> as core::ops::function::FnMut<Args>>::call_mut
             at /home/alaska/.rustup/toolchains/1.85.0-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/alloc/src/boxed.rs:2000:9
  13: ipc_channel::router::Router::run
             at /home/alaska/ipc-channel/src/router.rs:223:25
  14: ipc_channel::router::RouterProxy::new::{{closure}}
             at /home/alaska/ipc-channel/src/router.rs:52:28
  15: std::sys::backtrace::__rust_begin_short_backtrace
             at /home/alaska/.rustup/toolchains/1.85.0-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/sys/backtrace.rs:152:18
  16: std::thread::Builder::spawn_unchecked_::{{closure}}::{{closure}}
             at /home/alaska/.rustup/toolchains/1.85.0-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/thread/mod.rs:564:17
  17: <core::panic::unwind_safe::AssertUnwindSafe<F> as core::ops::function::FnOnce<()>>::call_once
             at /home/alaska/.rustup/toolchains/1.85.0-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/panic/unwind_safe.rs:272:9
  18: std::panicking::try::do_call
             at /home/alaska/.rustup/toolchains/1.85.0-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/panicking.rs:584:40
  19: __rust_try
  20: std::panicking::try
             at /home/alaska/.rustup/toolchains/1.85.0-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/panicking.rs:547:19
      std::panic::catch_unwind
             at /home/alaska/.rustup/toolchains/1.85.0-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/panic.rs:358:14
      std::thread::Builder::spawn_unchecked_::{{closure}}
             at /home/alaska/.rustup/toolchains/1.85.0-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/thread/mod.rs:562:30
  21: core::ops::function::FnOnce::call_once{{vtable.shim}}
             at /home/alaska/.rustup/toolchains/1.85.0-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ops/function.rs:250:5
  22: <alloc::boxed::Box<F,A> as core::ops::function::FnOnce<Args>>::call_once
             at /rustc/4d91de4e48198da2e33413efdcd9cd2cc0c46688/library/alloc/src/boxed.rs:1993:9
      <alloc::boxed::Box<F,A> as core::ops::function::FnOnce<Args>>::call_once
             at /rustc/4d91de4e48198da2e33413efdcd9cd2cc0c46688/library/alloc/src/boxed.rs:1993:9
      std::sys::pal::unix::thread::Thread::new::thread_start
             at /rustc/4d91de4e48198da2e33413efdcd9cd2cc0c46688/library/std/src/sys/pal/unix/thread.rs:106:17
  23: start_thread
  24: __clone3

@simonwuelker simonwuelker changed the title "index out of bounds: the len is 64 but the index is 64" when loading discord..gg "index out of bounds: the len is 64 but the index is 64" when loading discord.gg May 1, 2025
@simonwuelker
Copy link
Contributor Author

Reduced testcase:

<!DOCTYPE html>
<html>
<body>
  <img src="https://cdn.prod.website-files.com/6257adef93867e50d84d30e2/664754815450cb39bca27b05_Smoke.gif">

(I think a smoke gif is very fitting considering it's lighting our IPC code on fire)

@sebsebmc sebsebmc mentioned this issue May 11, 2025
Open
@fred-wang
Copy link
Contributor

fred-wang commented May 12, 2025 •
edited
Loading

Fuzzers found the same panic message using the following canvas-based testcase:

Minimal testcase:

<!DOCTYPE html>
<script>
  let canvas = document.createElement("canvas");
  let context = canvas.getContext("2d");
  let textMetrics = context.measureText("A");
  let width = textMetrics.width;
  let height = textMetrics.actualBoundingBoxAscent + textMetrics.actualBoundingBoxDescent;
  context.drawImage(canvas, 0, 0, width, height, 0, 0, width, height);
</script>

System: Linux
Version: Servo 0.0.1-e702bde9b

index out of bounds: the len is 42 but the index is 42 (thread Canvas, at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/sw-composite-0.7.16/src/lib.rs:523)
   0: servoshell::backtrace::print
   1: servoshell::panic_hook::panic_hook
   2: std::panicking::rust_panic_with_hook
   3: std::panicking::begin_panic_handler::{{closure}}
   4: std::sys::backtrace::__rust_end_short_backtrace
   5: rust_begin_unwind
   6: core::panicking::panic_fmt
   7: core::panicking::panic_bounds_check
   8: <sw_composite::PadFetch as sw_composite::PixelFetch>::get_pixel
   9: <raqote::blitter::TransformedImageShader<Fetch> as raqote::blitter::Shader>::shade_span
  10: <raqote::blitter::ShaderMaskBlitter as raqote::blitter::Blitter>::blit_span
  11: raqote::draw_target::DrawTarget<Backing>::composite
  12: raqote::draw_target::DrawTarget<Backing>::fill
  13: canvas::raqote_backend::<impl canvas::backend::GenericDrawTarget<canvas::raqote_backend::RaqoteBackend> for raqote::draw_target::DrawTarget>::fill
  14: canvas::canvas_data::CanvasData<B>::draw_image::{{closure}}
  15: canvas::canvas_paint_thread::Canvas::draw_image
  16: canvas::canvas_paint_thread::CanvasPaintThread::process_canvas_2d_message
  17: std::sys::backtrace::__rust_begin_short_backtrace
  18: core::ops::function::FnOnce::call_once{{vtable.shim}}
  19: std::sys::pal::unix::thread::Thread::new::thread_start
  20: start_thread
             at ./nptl/pthread_create.c:447:8
  21: clone3
             at ./misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78:0

fred-wang added a commit to fred-wang/servo-fuzzing that referenced this issue May 12, 2025
@fred-wang
Add servo/servo#36792
812fbb8
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
C-has-manual-testcase C-needs-investigation I-panic Servo encounters a panic.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@jdm @fred-wang @simonwuelker