Malformed HTML crashes rustdoc #146890
Description
Code
/// <TABLE
/// BORDER>
/// <TR
/// >
/// <TH
/// >key
/// </TD
/// >
/// <TH
/// >value
/// </TD
/// >
/// </TR
/// >
/// </TABLE
/// >
pub fn foo() {}Minimized from objc2-system-configuration/src/generated/SCDynamicStore.rs. Auto-generated code, I know, not the prettiest, and the HTML is indeed invalid. But still, didn't expect rustdoc to crash.
Version it worked on
rustdoc --version --verbose:
rustdoc 1.90.0 (1159e78c4 2025-09-14)
binary: rustdoc
commit-hash: 1159e78c4747b02ef996e55082b704c09b970588
commit-date: 2025-09-14
host: aarch64-apple-darwin
release: 1.90.0
LLVM version: 20.1.8
Version with regression
rustdoc --version --verbose:
rustdoc 1.92.0-nightly (9f32ccf35 2025-09-21)
binary: rustdoc
commit-hash: 9f32ccf35fb877270bc44a86a126440f04d676d0
commit-date: 2025-09-21
host: aarch64-apple-darwin
release: 1.92.0-nightly
LLVM version: 21.1.1
Error output
thread 'rustc' panicked at compiler/rustc_resolve/src/rustdoc.rs:639:47:
begin <= end (30 <= 2) when slicing `<TABLE
BORDER>
<TR
>
<TH
>key
</TD
>
<TH
>value
</TD
>
</TR
>
</TABLE
>`
Backtrace
stack backtrace:
0: 0x113c0cae4 - std::backtrace::Backtrace::create::hdfe6a08a39dce3b7
1: 0x111c27d7c - std[2aea63358043a5ce]::panicking::update_hook::<alloc[43a708cbeb521386]::boxed::Box<rustc_driver_impl[3e2bc2460ea85a3b]::install_ice_hook::{closure#1}>>::{closure#0}
2: 0x113c0da18 - std::panicking::panic_with_hook::h1bc70b382bb8f402
3: 0x113c0d6c8 - std::panicking::panic_handler::{{closure}}::hcbf646f74270fe0c
4: 0x113c06fbc - std::sys::backtrace::__rust_end_short_backtrace::hf5e611d919e771bb
5: 0x113beb544 - __rustc[8706850ec95f189]::rust_begin_unwind
6: 0x116978b9c - core::panicking::panic_fmt::haa1d95cfaf0b4786
7: 0x111093604 - core::str::slice_error_fail_rt::hfa6ba60df92b9999
8: 0x116977de4 - core::str::slice_error_fail::h4756da2502dcdd85
9: 0x1134ef6e8 - rustc_resolve[805fc4c8ea1eda1c]::rustdoc::source_span_for_markdown_range_inner
10: 0x104cff4a8 - rustdoc[967e0090b9e027d2]::passes::lint::html_tags::visit_item::{closure#0}
11: 0x104b869d8 - <rustdoc[967e0090b9e027d2]::passes::lint::html_tags::TagParser>::extract_html_tag::<rustdoc[967e0090b9e027d2]::passes::lint::html_tags::visit_item::{closure#0}>
12: 0x104e35ed8 - <rustdoc[967e0090b9e027d2]::passes::lint::Linter as rustdoc[967e0090b9e027d2]::visit::DocVisitor>::visit_item
13: 0x104e36850 - <rustdoc[967e0090b9e027d2]::passes::lint::Linter as rustdoc[967e0090b9e027d2]::visit::DocVisitor>::visit_item
14: 0x104e00374 - rustdoc[967e0090b9e027d2]::passes::lint::run_lints
15: 0x104dab5fc - rustdoc[967e0090b9e027d2]::core::run_global_ctxt
16: 0x104ce43dc - rustdoc[967e0090b9e027d2]::main_args::{closure#2}::{closure#0}
17: 0x104cd8354 - rustc_interface[490367cd7c57faeb]::interface::run_compiler::<(), rustdoc[967e0090b9e027d2]::main_args::{closure#2}>::{closure#1}
18: 0x104c390c0 - std[2aea63358043a5ce]::sys::backtrace::__rust_begin_short_backtrace::<rustc_interface[490367cd7c57faeb]::util::run_in_thread_with_globals<rustc_interface[490367cd7c57faeb]::util::run_in_thread_pool_with_globals<rustc_interface[490367cd7c57faeb]::interface::run_compiler<(), rustdoc[967e0090b9e027d2]::main_args::{closure#2}>::{closure#1}, ()>::{closure#0}, ()>::{closure#0}::{closure#0}, ()>
19: 0x104d03184 - <<std[2aea63358043a5ce]::thread::Builder>::spawn_unchecked_<rustc_interface[490367cd7c57faeb]::util::run_in_thread_with_globals<rustc_interface[490367cd7c57faeb]::util::run_in_thread_pool_with_globals<rustc_interface[490367cd7c57faeb]::interface::run_compiler<(), rustdoc[967e0090b9e027d2]::main_args::{closure#2}>::{closure#1}, ()>::{closure#0}, ()>::{closure#0}::{closure#0}, ()>::{closure#1} as core[1f80264947f97832]::ops::function::FnOnce<()>>::call_once::{shim:vtable#0}
20: 0x113c0394c - std::sys::thread::unix::Thread::new::thread_start::h5199d2e2328b2819
21: 0x18bc8fc0c - __pthread_cond_wait