panic: slice index starts at 1 but ends at 0 (at src/compute/grid/types/grid_item.rs:323) #36761
Description
Minimal testcase:
<!DOCTYPE html>
<div style="display: inline-grid">
<div style="grid-row-start: span last"></div>
</div>
System: Linux
Version: Servo 0.0.1-107fd2546
Command: ./servo/servo --enable-experimental-web-platform-features
slice index starts at 1 but ends at 0 (thread Script(1,1), at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/taffy-0.7.7/src/compute/grid/types/grid_item.rs:323)
0: servoshell::backtrace::print
1: servoshell::panic_hook::panic_hook
2: std::panicking::rust_panic_with_hook
3: std::panicking::begin_panic_handler::{{closure}}
4: std::sys::backtrace::__rust_end_short_backtrace
5: rust_begin_unwind
6: core::panicking::panic_fmt
7: core::slice::index::slice_index_order_fail::do_panic::runtime
8: core::slice::index::slice_index_order_fail
9: taffy::compute::grid::types::grid_item::GridItem::available_space
10: taffy::compute::grid::track_sizing::track_sizing_algorithm
11: taffy::compute::grid::compute_grid_layout
12: layout::layout_box_base::LayoutBoxBase::inline_content_sizes
13: core::cell::lazy::LazyCell<T,F>::really_init
14: layout::geom::Size<app_units::app_unit::Au>::resolve_for_preferred
15: layout::flow::<impl layout::formatting_contexts::IndependentFormattingContext>::layout_float_or_atomic_inline
16: layout::flow::BlockContainer::layout
17: layout::flow::BlockLevelBox::layout::{{closure}}
18: layout::flow::BlockLevelBox::layout
19: rayon::iter::plumbing::bridge_producer_consumer::helper
20: layout::flow::BlockContainer::layout
21: layout::flow::BlockFormattingContext::layout
22: layout::formatting_contexts::IndependentNonReplacedContents::layout
23: layout::flow::<impl layout::formatting_contexts::IndependentFormattingContext>::layout_in_flow_block_level
24: layout::flow::BlockLevelBox::layout
25: rayon::iter::plumbing::bridge_producer_consumer::helper
26: layout::flow::BlockContainer::layout
27: layout::flow::BlockFormattingContext::layout
28: layout::flow::root::BoxTree::layout
29: profile_traits::time::profile
30: <layout::layout_impl::LayoutThread as script_layout_interface::Layout>::reflow
31: script::dom::window::Window::reflow
32: script::dom::window::Window::allow_layout_if_necessary
33: script::dom::document::Document::finish_load
34: script::dom::servoparser::ServoParser::parse_sync
35: <script::dom::servoparser::ParserContext as net_traits::FetchResponseListener>::process_response_eof
36: script::script_thread::ScriptThread::handle_msg_from_script
37: script::script_thread::ScriptThread::handle_msgs::{{closure}}
38: script::script_thread::ScriptThread::handle_msgs
39: std::sys::backtrace::__rust_begin_short_backtrace
40: core::ops::function::FnOnce::call_once{{vtable.shim}}
41: std::sys::pal::unix::thread::Thread::new::thread_start
42: start_thread
at ./nptl/pthread_create.c:447:8
43: clone3
at ./misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78:0