1505957 - Assertion failure: 1 >= mContent->GetShadowRoot()->GetChildCount(), at src/layout/generic/nsVideoFrame.cpp:188

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect, P3)

Description

[Tyson Smith [:tsmith] (PTO)]

Attachment: testcase.html

Reduced with m-c:
BuildID=20181108184903
SourceStamp=12cc80a0e9968ade961879ee07effb815da691f0

Assertion failure: 1 >= mContent->GetShadowRoot()->GetChildCount(), at src/layout/generic/nsVideoFrame.cpp:188

#0 nsVideoFrame::GetVideoControls() src/layout/generic/nsVideoFrame.cpp:187:5
#1 mozilla::dom::TextTrackManager::UpdateCueDisplay() src/dom/html/TextTrackManager.cpp:278:47
#2 mozilla::dom::TextTrackManager::HandleEvent(mozilla::dom::Event*) src/dom/html/TextTrackManager.cpp:479:5
#3 mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) src/dom/events/EventListenerManager.cpp:1107:52
#4 mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) src/dom/events/EventListenerManager.cpp:1309:15
#5 mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:425:17
#6 mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:642:16
#7 mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) src/dom/events/EventDispatcher.cpp:1164:11
#8 mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*) src/dom/events/EventDispatcher.cpp
#9 nsINode::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&) src/dom/base/nsINode.cpp:1142:5
#10 mozilla::dom::EventTarget_Binding::dispatchEvent(JSContext*, JS::Handle<JSObject*>, mozilla::dom::EventTarget*, JSJitMethodCallArgs const&) src/obj-firefox/dom/bindings/EventTargetBinding.cpp:1034:21
#11 bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::MaybeGlobalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) src/dom/bindings/BindingUtils.cpp:3374:13
#12 CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) src/js/src/vm/Interpreter.cpp:468:15
#13 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) src/js/src/vm/Interpreter.cpp:560:16
#14 InternalCall(JSContext*, js::AnyInvokeArgs const&) src/js/src/vm/Interpreter.cpp:614:12
#15 js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) src/js/src/vm/Interpreter.cpp:633:10
#16 js::fun_apply(JSContext*, unsigned int, JS::Value*) src/js/src/vm/JSFunction.cpp:1381:12
#17 CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) src/js/src/vm/Interpreter.cpp:468:15
#18 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) src/js/src/vm/Interpreter.cpp:560:16
#19 InternalCall(JSContext*, js::AnyInvokeArgs const&) src/js/src/vm/Interpreter.cpp:614:12
#20 js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICCall_Fallback*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) src/js/src/jit/BaselineIC.cpp:3688:14
#21 0x37e93c8355b2  (<unknown module>)

Comment 1

[Marcos Caceres [:marcosc]]

Hi Tim, git blame says I should ask you 😊 any thoughts?

Comment 2

[Tim Guan-tin Chien [:timdream] (please needinfo)]

I can't reproduce it on the latest m-c yet. Will try with the buildid given.

Comment 3

[Tim Guan-tin Chien [:timdream] (please needinfo)]

OK. It looks like I would have to replace the src of the iframe from "data:video/mpeg," to a real video in the same host, and also turn off the popup blocker.

On the same build ID with artifact debug build, if I don't turn off the popup blocker, the page will throw at

JavaScript error: http://127.0.0.1:8080/bug1505957test.html, line 9: TypeError: o is undefined; can't access its "parentNode" property

If I did and reload the page, the page will throw at

JavaScript error: http://127.0.0.1:8080/bug1505957test.html, line 8: SecurityError: Permission denied to access property "document" on cross-origin object

Comment 4

[Tim Guan-tin Chien [:timdream] (please needinfo)]

Attachment: log

I've added a few dump() in the test file and UAWidgetsChild.jsm. This is somewhat similar to bug 1493741 where UAWidgetsChild gets confused and try to initialize the widget again.

I will try to identify the root cause here, but I think we should add a safeguard there too.

Comment 5

[Tim Guan-tin Chien [:timdream] (please needinfo)]

So the first videocontrols constructor throws because of this failures

[Child 60507, Main Thread] WARNING: NS_ENSURE_TRUE(!mHasOrHasHadOwnerWindow || mOwnerWindow) failed: file /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/DOMEventTargetHelper.h, line 145
[Child 60507, Main Thread] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x8000FFFF: file /builds/worker/workspace/build/src/dom/events/DOMEventTargetHelper.cpp, line 245
JavaScript error: chrome://global/content/elements/videocontrols.js, line 2041: NS_ERROR_UNEXPECTED:

Inspecting the loop, I can see this happens when it does

> video.textTracks.addEventListener("addtrack", this, { mozSystemGroup: true, capture: true });

I can see the same error is produced when I switch to the XBL binding:

!!!! 15
++DOCSHELL 0x154dce800 == 10 [pid = 98345] [id = {1eb66d0d-96f1-bd45-aedd-1729647e73a9}]
++DOMWINDOW == 23 (0x14fceb800) [pid = 98345] [serial = 23] [outer = 0x0]
[Child 98345, Main Thread] WARNING: NS_ENSURE_TRUE(!mHasOrHasHadOwnerWindow || mOwnerWindow) failed: file /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/DOMEventTargetHelper.h, line 145
[Child 98345, Main Thread] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x8000FFFF: file /builds/worker/workspace/build/src/dom/events/DOMEventTargetHelper.cpp, line 245
JavaScript error: chrome://global/content/bindings/videocontrols.xml, line 1982: NS_ERROR_UNEXPECTED:
[Child 98345, Main Thread] WARNING: NS_ENSURE_TRUE(!mHasOrHasHadOwnerWindow || mOwnerWindow) failed: file /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/DOMEventTargetHelper.h, line 145
[Child 98345, Main Thread] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x8000FFFF: file /builds/worker/workspace/build/src/dom/events/DOMEventTargetHelper.cpp, line 245
JavaScript error: chrome://global/content/bindings/videocontrols.xml, line 1982: NS_ERROR_UNEXPECTED:
!!!! 16
++DOMWINDOW == 24 (0x13067b400) [pid = 98345] [serial = 24] [outer = 0x14fceb800]
[Child 98345, Main Thread] WARNING: NS_ENSURE_TRUE(currentInner) failed: file /builds/worker/workspace/build/src/dom/base/WindowDestroyedEvent.cpp, line 113
--DOCSHELL 0x120d86800 == 1 [pid = 97987] [id = {a0333343-223f-e24b-8388-1f83bad8dfbc}]
--DOCSHELL 0x116045000 == 0 [pid = 97987] [id = {0b7e40ea-5a51-a249-88f3-7913fe387077}]
[Child 98345, Main Thread] WARNING: NS_ENSURE_SUCCESS(rv, false) failed with result 0x80004005: file /builds/worker/workspace/build/src/docshell/shistory/nsSHistory.cpp, line 129

I don't think I can address the underlining issue here, so what I will do here is to make sure UAWidgetsChild.setupWidget() can recover a failed widget construction when it happens.

I will file a follow-up bug for the failure.

Comment 6

[Tim Guan-tin Chien [:timdream] (please needinfo)]

Attachment: Bug 1505957 - Recover from failed UA Widget construction and destruction

This patch modifies UAWidgetsChild.js so that when the call into UA Widget
script throws, it could correctly clean up the Shadow DOM, to avoid leaving
the DOM in a half-broken state.

This is needed because of bug 1506300 will cause the constructor of videocontrols
UA Widget to throw, in our specific test case.

This exception also happens when the videocontrols XBL binding initializes,
but the way the XBL service calls into the XBL binding allow it to reach a usable
but half-broken state, while our current approach will cause the UA Widget DOM
to be inserted twice, and layout to assert.

Our clean-up approach here will make UA Widget complete absent when the
constructor throws, until the cause of the exception is fixed.

Comment 7

[Tim Guan-tin Chien [:timdream] (please needinfo)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=8e53a019691affdaef8257a3fc2155705ca94927

Comment 8

[Tim Guan-tin Chien [:timdream] (please needinfo)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=709ff495a0d76ab128c89897b64120f695a1b4c6

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/6eb370cb386c
Recover from failed UA Widget construction and destruction r=bgrins

Comment 10

[Andreea Pavel [:apavel]]

Backed out for eslint failure

Push with failure: https://treeherder.mozilla.org/#/jobs?repo=autoland&revision=6eb370cb386c62e17f1a58bb0cc7d9e788587f83

Failure log: https://treeherder.mozilla.org/logviewer.html#?job_id=211807218&repo=autoland&lineNumber=266

Backout:  https://hg.mozilla.org/integration/autoland/rev/2a16ee42df97043cdaf29f0b90c1ab786af6af45

Comment 11

[Tim Guan-tin Chien [:timdream] (please needinfo)]

Relanded.

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/faacbb32e16a
Recover from failed UA Widget construction and destruction r=bgrins

Comment 13

[Arthur Iakab [arthur_iakab]]

https://hg.mozilla.org/mozilla-central/rev/faacbb32e16a

Comment 14

[Ryan VanderMeulen [:RyanVM]]

Can we land the attached testcase as a crashtest?

Comment 15

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/4e9dc6118cca
Follow-up, add testcase as crashtest, r=me

Comment 16

[Tim Guan-tin Chien [:timdream] (please needinfo)]

Pushed to inbound

Comment 17

[Bogdan Tara[:bogdan_tara | bogdant]]

https://hg.mozilla.org/mozilla-central/rev/4e9dc6118cca