Closed Bug 1408444 Opened 6 years ago Closed 6 years ago

Assertion failure: !mMightHaveUnreportedJSException, at /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/ErrorResult.h:486

Categories

(Core :: DOM: Core & HTML, defect)

Product:
Core
Component:
DOM: Core & HTML
Version:
57 Branch
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla58
Tracking Flags:
Tracking Status
firefox-esr52 --- unaffected
firefox56 --- unaffected
firefox57 --- wontfix
firefox58 --- fixed

People

(Reporter: jkratzer, Assigned: bzbarsky)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(5 files)

trigger.html
990 bytes, text/html
Details
comment.html
10 bytes, text/html
Details
log_minidump.txt
84.86 KB, text/plain
Details
Flag a few more ErrorResults as would-report-JS-exceptions
1.53 KB, patch
peterv
: review+
Details | Diff | Splinter Review
trigger2.html
1.25 KB, text/html
Details
Attached file trigger.html — 
Testcase found while fuzzing mozilla-central rev 196dadb2fe50.  Reproduction requires both trigger.html and comment.html.
Flags: in-testsuite?
Attached file comment.html — 

    
    

    
  

      
      
      
      

        Attached file
          
        log_minidump.txt
        — 
      

    


  

    
    

    
  
INFO: Last good revision: c777acbcd2a9f0bcf14cbb0fffcdf399d8d6c8d2
INFO: First bad revision: 867fe67b16a1227b2f4758ff69a705e43b39af10
INFO: Pushlog:
https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=c777acbcd2a9f0bcf14cbb0fffcdf399d8d6c8d2&tochange=867fe67b16a1227b2f4758ff69a705e43b39af10
Blocks: 1393806
Has Regression Range: --- → yes

          status-firefox56:
          --- → unaffected

          status-firefox57:
          --- → fix-optional

          status-firefox58:
          --- → affected

          status-firefox-esr52:
          --- → unaffected
Flags: needinfo?(bzbarsky)
Version: unspecified → 57 Branch

    
    

    
  


  
MozReview-Commit-ID: 6kx4TOao7nM

        Attachment #8919984 -
        Flags: review?(peterv)

    
  
Assignee: nobody → bzbarsky
Status: NEW → ASSIGNED

    
  
Flags: needinfo?(bzbarsky)

        Attachment #8919984 -
        Flags: review?(peterv) → review+

    
    

    
  
Pushed by bzbarsky@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/a3a95b44e309
Flag a few more ErrorResults as would-report-JS-exceptions.  r=peterv

    
    

    
  
https://hg.mozilla.org/mozilla-central/rev/a3a95b44e309
Status: ASSIGNED → RESOLVED
Closed: 6 years ago

          status-firefox58:
          affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla58

    
    

    
  
Doesn't seem like a must-fix for 57. Feel free to set the status back to affected and nominate for approval if you feel strongly otherwise.

          status-firefox57:
          fix-optional → wontfix

    
    

    
  
This should not be taken in 57.  It's fixing an assertion that is somewhat bogus in this case, but bogus for nonlocal reasons that it can't detect.

    
    

    
  

      
      
      
      

        Attached file
          
        trigger2.html
        — 
      

    


  
I've identified a new testcase which triggers the same assertion.

    
    

    
  
(In reply to Jason Kratzer [:jkratzer] from comment #9)
> Created attachment 8923863 [details]
> trigger2.html
> 
> I've identified a new testcase which triggers the same assertion.

Tested on mozilla-central rev 083a9c84fbd0 (20171030).

    
    

    
  
Normally I'd say one issue per bug, but this newer testcase also bisects back to bug 1393806, so I guess it's another edge case related to the initial fix. Be warned that this testcase spams a LOT of new windows.
Status: RESOLVED → REOPENED

          status-firefox58:
          fixed → affected
Flags: needinfo?(bzbarsky)
Flags: in-testsuite?
Flags: in-testsuite-
Resolution: FIXED → ---
Target Milestone: mozilla58 → ---

    
    

    
  
Yes, one issue per bug.  This needs to be fixed at all possible callsites that can reach the relevant code, so unless it's asserting at the exact same place (and I don't mean the assertion location, I mean the ErrorResult instantiation location), it should be a separate bug.  Please file one and cc me?
Status: REOPENED → RESOLVED
Closed: 6 years ago → 6 years ago
Flags: needinfo?(bzbarsky)
Resolution: --- → FIXED

          status-firefox58:
          affected → fixed
Target Milestone: --- → mozilla58
See Also:  → 1413253
Component: DOM → DOM: Core & HTML

          You need to log in
          before you can comment on or make changes to this bug.