Crash when adopting an image element with an onload listener from an iframe that is subsequently removed #36397
Description
First reported in #36367.
Minimal testcase:
<iframe></iframe>
<script>
var iframe = document.querySelector('iframe');
iframe.onload = function() {
let img = iframe.contentDocument.body.firstChild;
document.body.appendChild(img);
iframe.remove();
};
iframe.srcdoc="<img src='https://www.joshmatthews.net//portrait.jpg' onload='console.log(window)'>"
</script>This is inconsistent due to racing of async events, but when it panics the output is:
Details
called `Option::unwrap()` on a `None` value (thread Script(1,1), at components/script/dom/window.rs:500)
0: backtrace::backtrace::libunwind::trace
at /Users/jdm/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/backtrace-0.3.74/src/backtrace/libunwind.rs:116:5
backtrace::backtrace::trace_unsynchronized
at /Users/jdm/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/backtrace-0.3.74/src/backtrace/mod.rs:66:5
1: <servoshell::backtrace::Print as core::fmt::Debug>::fmt
at /Users/jdm/src/alt-servo/ports/servoshell/backtrace.rs:65:13
2: core::fmt::rt::Argument::fmt
at /rustc/4d91de4e48198da2e33413efdcd9cd2cc0c46688/library/core/src/fmt/rt.rs:177:76
core::fmt::write
at /rustc/4d91de4e48198da2e33413efdcd9cd2cc0c46688/library/core/src/fmt/mod.rs:1440:21
3: std::io::Write::write_fmt
at /Users/jdm/.rustup/toolchains/1.85.0-aarch64-apple-darwin/lib/rustlib/src/rust/library/std/src/io/mod.rs:1887:15
4: servoshell::backtrace::print
at /Users/jdm/src/alt-servo/ports/servoshell/backtrace.rs:18:5
5: servoshell::panic_hook::panic_hook
at /Users/jdm/src/alt-servo/ports/servoshell/panic_hook.rs:40:17
6: core::ops::function::Fn::call
at /Users/jdm/.rustup/toolchains/1.85.0-aarch64-apple-darwin/lib/rustlib/src/rust/library/core/src/ops/function.rs:79:5
7: <alloc::boxed::Box<F,A> as core::ops::function::Fn<Args>>::call
at /rustc/4d91de4e48198da2e33413efdcd9cd2cc0c46688/library/alloc/src/boxed.rs:2007:9
std::panicking::rust_panic_with_hook
at /rustc/4d91de4e48198da2e33413efdcd9cd2cc0c46688/library/std/src/panicking.rs:836:13
8: std::panicking::begin_panic_handler::{{closure}}
at /rustc/4d91de4e48198da2e33413efdcd9cd2cc0c46688/library/std/src/panicking.rs:694:13
9: std::sys::backtrace::__rust_end_short_backtrace
at /rustc/4d91de4e48198da2e33413efdcd9cd2cc0c46688/library/std/src/sys/backtrace.rs:168:18
10: rust_begin_unwind
at /rustc/4d91de4e48198da2e33413efdcd9cd2cc0c46688/library/std/src/panicking.rs:692:5
11: core::panicking::panic_fmt
at /rustc/4d91de4e48198da2e33413efdcd9cd2cc0c46688/library/core/src/panicking.rs:75:14
12: core::panicking::panic
at /rustc/4d91de4e48198da2e33413efdcd9cd2cc0c46688/library/core/src/panicking.rs:145:5
13: core::option::unwrap_failed
at /rustc/4d91de4e48198da2e33413efdcd9cd2cc0c46688/library/core/src/option.rs:2015:5
14: core::option::Option<T>::unwrap
at /Users/jdm/.rustup/toolchains/1.85.0-aarch64-apple-darwin/lib/rustlib/src/rust/library/core/src/option.rs:978:21
script::dom::window::Window::window_proxy
at /Users/jdm/src/alt-servo/components/script/dom/window.rs:500:9
15: <script::dom::window::Window as script_bindings::codegen::GenericBindings::WindowBinding::Window_Binding::WindowMethods<script::dom::bindings::codegen::DomTypeHolder::DomTypeHolder>>::Window
at /Users/jdm/src/alt-servo/components/script/dom/window.rs:1060:9
16: script_b
9754
indings::codegen::GenericBindings::WindowBinding::Window_Binding::get_window::{{closure}}::{{closure}}
at /Users/jdm/src/alt-servo/target/debug/build/script_bindings-a65d74e3e7957e28/out/Bindings/WindowBinding.rs:493:47
17: script_bindings::codegen::GenericBindings::WindowBinding::Window_Binding::get_window::{{closure}}
at /Users/jdm/src/alt-servo/target/debug/build/script_bindings-a65d74e3e7957e28/out/Bindings/WindowBinding.rs:490:33
18: core::ops::function::impls::<impl core::ops::function::FnOnce<A> for &mut F>::call_once
at /Users/jdm/.rustup/toolchains/1.85.0-aarch64-apple-darwin/lib/rustlib/src/rust/library/core/src/ops/function.rs:305:13
19: <core::panic::unwind_safe::AssertUnwindSafe<F> as core::ops::function::FnOnce<()>>::call_once
at /Users/jdm/.rustup/toolchains/1.85.0-aarch64-apple-darwin/lib/rustlib/src/rust/library/core/src/panic/unwind_safe.rs:272:9
20: std::panicking::try::do_call
at /Users/jdm/.rustup/toolchains/1.85.0-aarch64-apple-darwin/lib/rustlib/src/rust/library/std/src/panicking.rs:584:40
21: ___rust_try
22: std::panicking::try
at /Users/jdm/.rustup/toolchains/1.85.0-aarch64-apple-darwin/lib/rustlib/src/rust/library/std/src/panicking.rs:547:19
std::panic::catch_unwind
at /Users/jdm/.rustup/toolchains/1.85.0-aarch64-apple-darwin/lib/rustlib/src/rust/library/std/src/panic.rs:358:14
23: mozjs::panic::wrap_panic
at /Users/jdm/.cargo/git/checkouts/mozjs-dd2a25693c61d87d/e4d4f9a/mozjs/src/panic.rs:22:11
24: script_bindings::codegen::GenericBindings::WindowBinding::Window_Binding::get_window
at /Users/jdm/src/alt-servo/target/debug/build/script_bindings-a65d74e3e7957e28/out/Bindings/WindowBinding.rs:490:5
25: CallJitGetterOp
at /Users/jdm/.cargo/git/checkouts/mozjs-dd2a25693c61d87d/e4d4f9a/mozjs-sys/src/jsglue.cpp:567:10
26: script_bindings::utils::generic_call
at /Users/jdm/src/alt-servo/components/script_bindings/utils.rs:400:5
27: script_bindings::utils::generic_getter
at /Users/jdm/src/alt-servo/components/script_bindings/utils.rs:433:5
28: _Z12CallJSNativeP9JSContextPFbS0_jPN2JS5ValueEEN2js10CallReasonERKNS1_8CallArgsE
at /Users/jdm/.cargo/git/checkouts/mozjs-dd2a25693c61d87d/e4d4f9a/mozjs-sys/mozjs/js/src/vm/Interpreter.cpp:481:13
29: _ZN2js23InternalCallOrConstructEP9JSContextRKN2JS8CallArgsENS_14MaybeConstructENS_10CallReasonE
at /Users/jdm/.cargo/git/checkouts/mozjs-dd2a25693c61d87d/e4d4f9a/mozjs-sys/mozjs/js/src/vm/Interpreter.cpp:575:12
30: _ZL12InternalCallP9JSContextRKN2js13AnyInvokeArgsENS1_10CallReasonE
at /Users/jdm/.cargo/git/checkouts/mozjs-dd2a25693c61d87d/e4d4f9a/mozjs-sys/mozjs/js/src/vm/Interpreter.cpp:642:10
31: _ZN2js4CallEP9JSContextN2JS6HandleINS2_5ValueEEES5_RKNS_13AnyInvokeArgsENS2_13MutableHandleIS4_EENS_10CallReasonE
at /Users/jdm/.cargo/git/checkouts/mozjs-dd2a25693c61d87d/e4d4f9a/mozjs-sys/mozjs/js/src/vm/Interpreter.cpp:674:8
32: _ZN2js10CallGetterEP9JSContextN2JS6HandleINS2_5ValueEEES5_NS2_13MutableHandleIS4_EE
at /Users/jdm/.cargo/git/checkouts/mozjs-dd2a25693c61d87d/e4d4f9a/mozjs-sys/mozjs/js/src/vm/Interpreter.cpp:796:10
33: _ZL10CallGetterP9JSContextN2JS6HandleIPN2js12NativeObjectEEENS2_INS1_5ValueEEENS2_INS1_11PropertyKeyEEENS3_16PropertyInfoBaseIjEENS1_13MutableHandleIS7_EE
at /Users/jdm/.cargo/git/checkouts/mozjs-dd2a25693c61d87d/e4d4f9a/mozjs-sys/mozjs/js/src/vm/NativeObject.cpp:2143:12
34: _ZL19GetExistingPropertyILN2js7AllowGCE1EEbP9JSContextNS0_11MaybeRootedIN2JS5ValueEXT_EE10HandleTypeENS4_IPNS0_12NativeObjectEXT_EE10HandleTypeENS4_INS5_11PropertyKeyEXT_EE10HandleTypeENS0_16PropertyInfoBaseIjEENS7_17MutableHandleTypeE
at /Users/jdm/.cargo/git/checkouts/mozjs-dd2a25693c61d87d/e4d4f9a/mozjs-sys/mozjs/js/src/vm/NativeObject.cpp:2171:12
35: _ZN2js25NativeGetExistingPropertyEP9JSContextN2JS6HandleIP8JSObjectEENS3_IPNS_12NativeObjectEEENS3_INS2_11PropertyKeyEEENS_16PropertyInfoBaseIjEENS2_13MutableHandleINS2_5ValueEEE
at /Users/jdm/.cargo/git/checkouts/mozjs-dd2a25693c61d87d/e4d4f9a/mozjs-sys/mozjs/js/src/vm/NativeObject.cpp:2179:10
36: _ZN2js9FetchNameILNS_11GetNameModeE0EEEbP9JSContextN2JS6HandleIP8JSObjectEES8_NS5_IPNS_12PropertyNameEEERKNS_14PropertyResultENS4_13MutableHandleINS4_5ValueEEE
at /Users/jdm/.cargo/git/checkouts/mozjs-dd2a25693c61d87d/e4d4f9a/mozjs-sys/mozjs/js/src/vm/Interpreter-inl.h:141:12
37: _ZN2js18GetEnvironmentNameILNS_11GetNameModeE0EEEbP9JSContextN2JS6HandleIP8JSObjectEENS5_IPNS_12PropertyNameEEENS4_13MutableHandleINS4_5ValueEEE
at /Users/jdm/.cargo/git/checkouts/mozjs-dd2a25693c61d87d/e4d4f9a/mozjs-sys/mozjs/js/src/vm/Interpreter-inl.h:193:10
38: _ZL16GetNameOperationP9JSContextN2JS6HandleIP8JSObjectEENS2_IPN2js12PropertyNameEEE4JSOpNS1_13MutableHandleINS1_5ValueEEE
at /Users/jdm/.cargo/git/checkouts/mozjs-dd2a25693c61d87d/e4d4f9a/mozjs-sys/mozjs/js/src/vm/Interpreter.cpp:257:10
39: _ZN2js9InterpretEP9JSContextRNS_8RunStateE
at /Users/jdm/.cargo/git/checkouts/mozjs-dd2a25693c61d87d/e4d4f9a/mozjs-sys/mozjs/js/src/vm/Interpreter.cpp:3333:12
40: _ZL31MaybeEnterInterpreterTrampolineP9JSContextRN2js8RunStateE
at /Users/jdm/.cargo/git/checkouts/mozjs-dd2a25693c61d87d/e4d4f9a/mozjs-sys/mozjs/js/src/vm/Interpreter.cpp:395:10
41: _ZN2js9RunScriptEP9JSContextRNS_8RunStateE
at /Users/jdm/.cargo/git/checkouts/mozjs-dd2a25693c61d87d/e4d4f9a/mozjs-sys/mozjs/js/src/vm/Interpreter.cpp:453:13
42: _ZN2js23InternalCallOrConstructEP9JSContextRKN2JS8CallArgsENS_14MaybeConstructENS_10CallReasonE
at /Users/jdm/.cargo/git/checkouts/mozjs-dd2a25693c61d87d/e4d4f9a/mozjs-sys/mozjs/js/src/vm/Interpreter.cpp:607:13
43: _ZL12InternalCallP9JSContextRKN2js13AnyInvokeArgsENS1_10CallReasonE
at /Users/jdm/.cargo/git/checkouts/mozjs-dd2a25693c61d87d/e4d4f9a/mozjs-sys/mozjs/js/src/vm/Interpreter.cpp:642:10
44: _ZN2js4CallEP9JSContextN2JS6HandleINS2_5ValueEEES5_RKNS_13AnyInvokeArgsENS2_13MutableHandleIS4_EENS_10CallReasonE
at /Users/jdm/.cargo/git/checkouts/mozjs-dd2a25693c61d87d/e4d4f9a/mozjs-sys/mozjs/js/src/vm/Interpreter.cpp:674:8
45: _ZN2JS4CallEP9JSContextNS_6HandleINS_5ValueEEES4_RKNS_16HandleValueArrayENS_13MutableHandleIS3_EE
at /Users/jdm/.cargo/git/checkouts/mozjs-dd2a25693c61d87d/e4d4f9a/mozjs-sys/mozjs/js/src/vm/CallAndConstruct.cpp:119:10
46: mozjs::rust::wrappers::Call
at /Users/jdm/.cargo/git/checkouts/mozjs-dd2a25693c61d87d/e4d4f9a/mozjs/src/rust.rs:1135:51
47: script_bindings::codegen::GenericBindings::EventHandlerBinding::EventHandlerNonNull<D>::Call
at /Users/jdm/src/alt-servo/target/debug/build/script_bindings-a65d74e3e7957e28/out/Bindings/EventHandlerBinding.rs:66:50
48: script_bindings::codegen::GenericBindings::EventHandlerBinding::EventHandlerNonNull<D>::Call_
at /Users/jdm/src/alt-servo/target/debug/build/script_bindings-a65d74e3e7957e28/out/Bindings/EventHandlerBinding.rs:41:18
49: script::dom::eventtarget::CompiledEventListener::call_or_handle_event
at /Users/jdm/src/alt-servo/components/script/dom/eventtarget.rs:280:41
50: script::dom::event::inner_invoke
at /Users/jdm/src/alt-servo/components/script/dom/event.rs:1278:9
51: script::dom::event::invoke
at /Users/jdm/src/alt-servo/components/script/dom/event.rs:1161:17
52: script::dom::event::Event::dispatch
at /Users/jdm/src/alt-servo/components/script/dom/event.rs:558:17
53: script::dom::eventtarget::EventTarget::dispatch_event
at /Users/jdm/src/alt-servo/components/script/dom/eventtarget.rs:435:9
54: script::dom::event::Event::fire
at /Users/jdm/src/alt-servo/components/script/dom/event.rs:679:9
55: script::dom::eventtarget::EventTarget::fire_event_with_params
at /Users/jdm/src/alt-servo/components/script/dom/eventtarget.rs:800:9
56: script::dom::eventtarget::EventTarget::fire_event
at /Users/jdm/src/alt-servo/components/script/dom/eventtarget.rs:749:9
57: script::dom::htmlimageelement::HTMLImageElement::update_the_image_data::{{closure}}
at /Users/jdm/src/alt-servo/components/script/dom/htmlimageelement.rs:1047:29
58: <script::dom::htmlimageelement::HTMLImageElement::update_the_image_data::image_load_event<F> as script::task::TaskOnce>::run_once
at /Users/jdm/src/alt-servo/components/script/task.rs:24:17
59: <script::task::CancellableTask<T> as script::task::TaskOnce>::run_once
at /Users/jdm/src/alt-servo/components/script/task.rs:106:13
60: <T as script::task::TaskBox>::run_box
at /Users/jdm/src/alt-servo/components/script/task.rs:57:9
61: script::script_thread::ScriptThread::handle_msg_from_script
at /Users/jdm/src/alt-servo/components/script/script_thread.rs:1972:17
62: script::script_thread::ScriptThread::handle_msgs::{{closure}}
at /Users/jdm/src/alt-servo/components/script/script_thread.rs:1509:60
63: script::script_thread::ScriptThread::profile_event
at /Users/jdm/src/alt-servo/components/script/script_thread.rs:1721:13
64: script::script_thread::ScriptThread::handle_msgs
at /Users/jdm/src/alt-servo/components/script/script_thread.rs:1500:27
65: script::script_thread::ScriptThread::start
at /Users/jdm/src/alt-servo/components/script/script_thread.rs:978:15
66: <script::script_thread::ScriptThread as script_layout_interface::ScriptThreadFactory>::create::{{closure}}::{{closure}}
at /Users/jdm/src/alt-servo/components/script/script_thread.rs:431:25
67: profile_traits::mem::ProfilerChan::run_with_memory_reporting
at /Users/jdm/src/alt-servo/components/shared/profile/mem.rs:91:9
68: <script::script_thread::ScriptThread as script_layout_interface::ScriptThreadFactory>::create::{{closure}}
at /Users/jdm/src/alt-servo/components/script/script_thread.rs:429:17
69: std::sys::backtrace::__rust_begin_short_backtrace
at /Users/jdm/.rustup/toolchains/1.85.0-aarch64-apple-darwin/lib/rustlib/src/rust/library/std/src/sys/backtrace.rs:152:18
70: std::thread::Builder::spawn_unchecked_::{{closure}}::{{closure}}
at /Users/jdm/.rustup/toolchains/1.85.0-aarch64-apple-darwin/lib/rustlib/src/rust/library/std/src/thread/mod.rs:564:17
71: <core::panic::unwind_safe::AssertUnwindSafe<F> as core::ops::function::FnOnce<()>>::call_once
at /Users/jdm/.rustup/toolchains/1.85.0-aarch64-apple-darwin/lib/rustlib/src/rust/library/core/src/panic/unwind_safe.rs:272:9
72: std::panicking::try::do_call
at /Users/jdm/.rustup/toolchains/1.85.0-aarch64-apple-darwin/lib/rustlib/src/rust/library/std/src/panicking.rs:584:40
73: ___rust_try
74: std::panicking::try
at /Users/jdm/.rustup/toolchains/1.85.0-aarch64-apple-darwin/lib/rustlib/src/rust/library/std/src/panicking.rs:547:19
std::panic::catch_unwind
at /Users/jdm/.rustup/toolchains/1.85.0-aarch64-apple-darwin/lib/rustlib/src/rust/library/std/src/panic.rs:358:14
std::thread::Builder::spawn_unchecked_::{{closure}}
at /Users/jdm/.rustup/toolchains/1.85.0-aarch64-apple-darwin/lib/rustlib/src/rust/library/std/src/thread/mod.rs:562:30
75: core::ops::function::FnOnce::call_once{{vtable.shim}}
at /Users/jdm/.rustup/toolchains/1.85.0-aarch64-apple-darwin/lib/rustlib/src/rust/library/core/src/ops/function.rs:250:5
76: <alloc::boxed::Box<F,A> as core::ops::function::FnOnce<Args>>::call_once
at /rustc/4d91de4e48198da2e33413efdcd9cd2cc0c46688/library/alloc/src/boxed.rs:1993:9
<alloc::boxed::Box<F,A> as core::ops::function::FnOnce<Args>>::call_once
at /rustc/4d91de4e48198da2e33413efdcd9cd2cc0c46688/library/alloc/src/boxed.rs:1993:9
std::sys::pal::unix::thread::Thread::new::thread_start
at /rustc/4d91de4e48198da2e33413efdcd9cd2cc0c46688/library/std/src/sys/pal/unix/thread.rs:106:17
77: __pthread_deallocate
[2025-04-08T02:37:11Z ERROR servoshell::panic_hook] called `Option::unwrap()` on a `None` value