1408444 - Assertion failure: !mMightHaveUnreportedJSException, at /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/ErrorResult.h:486

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Jason Kratzer [:jkratzer]]

Attachment: trigger.html

Testcase found while fuzzing mozilla-central rev 196dadb2fe50.  Reproduction requires both trigger.html and comment.html.

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: comment.html

Comment 2

[Jason Kratzer [:jkratzer]]

Attachment: log_minidump.txt

Comment 3

[Ryan VanderMeulen [:RyanVM]]

INFO: Last good revision: c777acbcd2a9f0bcf14cbb0fffcdf399d8d6c8d2
INFO: First bad revision: 867fe67b16a1227b2f4758ff69a705e43b39af10
INFO: Pushlog:
https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=c777acbcd2a9f0bcf14cbb0fffcdf399d8d6c8d2&tochange=867fe67b16a1227b2f4758ff69a705e43b39af10

Comment 4

[Boris Zbarsky [:bzbarsky]]

Attachment: Flag a few more ErrorResults as would-report-JS-exceptions

MozReview-Commit-ID: 6kx4TOao7nM

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/a3a95b44e309
Flag a few more ErrorResults as would-report-JS-exceptions.  r=peterv

Comment 6

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/a3a95b44e309

Comment 7

[Ryan VanderMeulen [:RyanVM]]

Doesn't seem like a must-fix for 57. Feel free to set the status back to affected and nominate for approval if you feel strongly otherwise.

Comment 8

[Boris Zbarsky [:bzbarsky]]

This should not be taken in 57.  It's fixing an assertion that is somewhat bogus in this case, but bogus for nonlocal reasons that it can't detect.

Comment 9

[Jason Kratzer [:jkratzer]]

Attachment: trigger2.html

I've identified a new testcase which triggers the same assertion.

Comment 10

[Jason Kratzer [:jkratzer]]

(In reply to Jason Kratzer [:jkratzer] from comment #9)
> Created attachment 8923863 [details]
> trigger2.html
> 
> I've identified a new testcase which triggers the same assertion.

Tested on mozilla-central rev 083a9c84fbd0 (20171030).

Comment 11

[Ryan VanderMeulen [:RyanVM]]

Normally I'd say one issue per bug, but this newer testcase also bisects back to bug 1393806, so I guess it's another edge case related to the initial fix. Be warned that this testcase spams a LOT of new windows.

Comment 12

[Boris Zbarsky [:bzbarsky]]

Yes, one issue per bug.  This needs to be fixed at all possible callsites that can reach the relevant code, so unless it's asserting at the exact same place (and I don't mean the assertion location, I mean the ErrorResult instantiation location), it should be a separate bug.  Please file one and cc me?