Closed Bug 1408444 Opened 3 years ago Closed 3 years ago

Assertion failure: !mMightHaveUnreportedJSException, at /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/ErrorResult.h:486

Categories

(Core :: DOM: Core & HTML, defect)

57 Branch
defect
Not set

Tracking

()

RESOLVED FIXED
mozilla58
Tracking Status
firefox-esr52 --- unaffected
firefox56 --- unaffected
firefox57 --- wontfix
firefox58 --- fixed

People

(Reporter: jkratzer, Assigned: bzbarsky)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(5 files)

Attached file trigger.html
Testcase found while fuzzing mozilla-central rev 196dadb2fe50.  Reproduction requires both trigger.html and comment.html.
Flags: in-testsuite?
Attached file comment.html
Attached file log_minidump.txt
INFO: Last good revision: c777acbcd2a9f0bcf14cbb0fffcdf399d8d6c8d2
INFO: First bad revision: 867fe67b16a1227b2f4758ff69a705e43b39af10
INFO: Pushlog:
https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=c777acbcd2a9f0bcf14cbb0fffcdf399d8d6c8d2&tochange=867fe67b16a1227b2f4758ff69a705e43b39af10
Blocks: 1393806
Has Regression Range: --- → yes
Flags: needinfo?(bzbarsky)
Version: unspecified → 57 Branch
MozReview-Commit-ID: 6kx4TOao7nM
Attachment #8919984 - Flags: review?(peterv)
Assignee: nobody → bzbarsky
Status: NEW → ASSIGNED
Flags: needinfo?(bzbarsky)
Attachment #8919984 - Flags: review?(peterv) → review+
Pushed by bzbarsky@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/a3a95b44e309
Flag a few more ErrorResults as would-report-JS-exceptions.  r=peterv
https://hg.mozilla.org/mozilla-central/rev/a3a95b44e309
Status: ASSIGNED → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla58
Doesn't seem like a must-fix for 57. Feel free to set the status back to affected and nominate for approval if you feel strongly otherwise.
This should not be taken in 57.  It's fixing an assertion that is somewhat bogus in this case, but bogus for nonlocal reasons that it can't detect.
Attached file trigger2.html
I've identified a new testcase which triggers the same assertion.
(In reply to Jason Kratzer [:jkratzer] from comment #9)
> Created attachment 8923863 [details]
> trigger2.html
> 
> I've identified a new testcase which triggers the same assertion.

Tested on mozilla-central rev 083a9c84fbd0 (20171030).
Normally I'd say one issue per bug, but this newer testcase also bisects back to bug 1393806, so I guess it's another edge case related to the initial fix. Be warned that this testcase spams a LOT of new windows.
Status: RESOLVED → REOPENED
Flags: needinfo?(bzbarsky)
Flags: in-testsuite?
Flags: in-testsuite-
Resolution: FIXED → ---
Target Milestone: mozilla58 → ---
Yes, one issue per bug.  This needs to be fixed at all possible callsites that can reach the relevant code, so unless it's asserting at the exact same place (and I don't mean the assertion location, I mean the ErrorResult instantiation location), it should be a separate bug.  Please file one and cc me?
Status: REOPENED → RESOLVED
Closed: 3 years ago3 years ago
Flags: needinfo?(bzbarsky)
Resolution: --- → FIXED
Target Milestone: --- → mozilla58
See Also: → 1413253
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.