Assertion failure: 1 >= mContent->GetShadowRoot()->GetChildCount(), at src/layout/generic/nsVideoFrame.cpp:188

RESOLVED FIXED in Firefox 65

Status

()

defect
P3
normal
RESOLVED FIXED
8 months ago
4 months ago

People

(Reporter: tsmith, Assigned: timdream)

Tracking

(Depends on 1 bug, Blocks 2 bugs, {assertion, testcase})

unspecified
mozilla65
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite ?

Firefox Tracking Flags

(firefox-esr60 unaffected, firefox63 unaffected, firefox64 unaffected, firefox65 fixed)

Details

Attachments

(3 attachments)

Posted file testcase.html
Reduced with m-c:
BuildID=20181108184903
SourceStamp=12cc80a0e9968ade961879ee07effb815da691f0

Assertion failure: 1 >= mContent->GetShadowRoot()->GetChildCount(), at src/layout/generic/nsVideoFrame.cpp:188

#0 nsVideoFrame::GetVideoControls() src/layout/generic/nsVideoFrame.cpp:187:5
#1 mozilla::dom::TextTrackManager::UpdateCueDisplay() src/dom/html/TextTrackManager.cpp:278:47
#2 mozilla::dom::TextTrackManager::HandleEvent(mozilla::dom::Event*) src/dom/html/TextTrackManager.cpp:479:5
#3 mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) src/dom/events/EventListenerManager.cpp:1107:52
#4 mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) src/dom/events/EventListenerManager.cpp:1309:15
#5 mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:425:17
#6 mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:642:16
#7 mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) src/dom/events/EventDispatcher.cpp:1164:11
#8 mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*) src/dom/events/EventDispatcher.cpp
#9 nsINode::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&) src/dom/base/nsINode.cpp:1142:5
#10 mozilla::dom::EventTarget_Binding::dispatchEvent(JSContext*, JS::Handle<JSObject*>, mozilla::dom::EventTarget*, JSJitMethodCallArgs const&) src/obj-firefox/dom/bindings/EventTargetBinding.cpp:1034:21
#11 bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::MaybeGlobalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) src/dom/bindings/BindingUtils.cpp:3374:13
#12 CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) src/js/src/vm/Interpreter.cpp:468:15
#13 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) src/js/src/vm/Interpreter.cpp:560:16
#14 InternalCall(JSContext*, js::AnyInvokeArgs const&) src/js/src/vm/Interpreter.cpp:614:12
#15 js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) src/js/src/vm/Interpreter.cpp:633:10
#16 js::fun_apply(JSContext*, unsigned int, JS::Value*) src/js/src/vm/JSFunction.cpp:1381:12
#17 CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) src/js/src/vm/Interpreter.cpp:468:15
#18 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) src/js/src/vm/Interpreter.cpp:560:16
#19 InternalCall(JSContext*, js::AnyInvokeArgs const&) src/js/src/vm/Interpreter.cpp:614:12
#20 js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICCall_Fallback*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) src/js/src/jit/BaselineIC.cpp:3688:14
#21 0x37e93c8355b2  (<unknown module>)
Flags: in-testsuite?
Hi Tim, git blame says I should ask you 😊 any thoughts?
Flags: needinfo?(timdream)
Priority: -- → P3
I can't reproduce it on the latest m-c yet. Will try with the buildid given.
Assignee: nobody → timdream
Status: NEW → ASSIGNED
Flags: needinfo?(timdream)
OK. It looks like I would have to replace the src of the iframe from "data:video/mpeg," to a real video in the same host, and also turn off the popup blocker.

On the same build ID with artifact debug build, if I don't turn off the popup blocker, the page will throw at

JavaScript error: http://127.0.0.1:8080/bug1505957test.html, line 9: TypeError: o is undefined; can't access its "parentNode" property

If I did and reload the page, the page will throw at

JavaScript error: http://127.0.0.1:8080/bug1505957test.html, line 8: SecurityError: Permission denied to access property "document" on cross-origin object
Posted file log
I've added a few dump() in the test file and UAWidgetsChild.jsm. This is somewhat similar to bug 1493741 where UAWidgetsChild gets confused and try to initialize the widget again.

I will try to identify the root cause here, but I think we should add a safeguard there too.
So the first videocontrols constructor throws because of this failures

[Child 60507, Main Thread] WARNING: NS_ENSURE_TRUE(!mHasOrHasHadOwnerWindow || mOwnerWindow) failed: file /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/DOMEventTargetHelper.h, line 145
[Child 60507, Main Thread] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x8000FFFF: file /builds/worker/workspace/build/src/dom/events/DOMEventTargetHelper.cpp, line 245
JavaScript error: chrome://global/content/elements/videocontrols.js, line 2041: NS_ERROR_UNEXPECTED:

Inspecting the loop, I can see this happens when it does

> video.textTracks.addEventListener("addtrack", this, { mozSystemGroup: true, capture: true });

I can see the same error is produced when I switch to the XBL binding:

!!!! 15
++DOCSHELL 0x154dce800 == 10 [pid = 98345] [id = {1eb66d0d-96f1-bd45-aedd-1729647e73a9}]
++DOMWINDOW == 23 (0x14fceb800) [pid = 98345] [serial = 23] [outer = 0x0]
[Child 98345, Main Thread] WARNING: NS_ENSURE_TRUE(!mHasOrHasHadOwnerWindow || mOwnerWindow) failed: file /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/DOMEventTargetHelper.h, line 145
[Child 98345, Main Thread] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x8000FFFF: file /builds/worker/workspace/build/src/dom/events/DOMEventTargetHelper.cpp, line 245
JavaScript error: chrome://global/content/bindings/videocontrols.xml, line 1982: NS_ERROR_UNEXPECTED:
[Child 98345, Main Thread] WARNING: NS_ENSURE_TRUE(!mHasOrHasHadOwnerWindow || mOwnerWindow) failed: file /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/DOMEventTargetHelper.h, line 145
[Child 98345, Main Thread] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x8000FFFF: file /builds/worker/workspace/build/src/dom/events/DOMEventTargetHelper.cpp, line 245
JavaScript error: chrome://global/content/bindings/videocontrols.xml, line 1982: NS_ERROR_UNEXPECTED:
!!!! 16
++DOMWINDOW == 24 (0x13067b400) [pid = 98345] [serial = 24] [outer = 0x14fceb800]
[Child 98345, Main Thread] WARNING: NS_ENSURE_TRUE(currentInner) failed: file /builds/worker/workspace/build/src/dom/base/WindowDestroyedEvent.cpp, line 113
--DOCSHELL 0x120d86800 == 1 [pid = 97987] [id = {a0333343-223f-e24b-8388-1f83bad8dfbc}]
--DOCSHELL 0x116045000 == 0 [pid = 97987] [id = {0b7e40ea-5a51-a249-88f3-7913fe387077}]
[Child 98345, Main Thread] WARNING: NS_ENSURE_SUCCESS(rv, false) failed with result 0x80004005: file /builds/worker/workspace/build/src/docshell/shistory/nsSHistory.cpp, line 129

I don't think I can address the underlining issue here, so what I will do here is to make sure UAWidgetsChild.setupWidget() can recover a failed widget construction when it happens.

I will file a follow-up bug for the failure.
See Also: → 1506300
This patch modifies UAWidgetsChild.js so that when the call into UA Widget
script throws, it could correctly clean up the Shadow DOM, to avoid leaving
the DOM in a half-broken state.

This is needed because of bug 1506300 will cause the constructor of videocontrols
UA Widget to throw, in our specific test case.

This exception also happens when the videocontrols XBL binding initializes,
but the way the XBL service calls into the XBL binding allow it to reach a usable
but half-broken state, while our current approach will cause the UA Widget DOM
to be inserted twice, and layout to assert.

Our clean-up approach here will make UA Widget complete absent when the
constructor throws, until the cause of the exception is fixed.
Attachment #9024149 - Attachment description: Bug 1505957 - Recover from failed UA Widget construction and destruction r=jaws → Bug 1505957 - Recover from failed UA Widget construction and destruction
Pushed by tchien@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/6eb370cb386c
Recover from failed UA Widget construction and destruction r=bgrins
Relanded.
Flags: needinfo?(timdream)
Pushed by tchien@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/faacbb32e16a
Recover from failed UA Widget construction and destruction r=bgrins
https://hg.mozilla.org/mozilla-central/rev/faacbb32e16a
Status: ASSIGNED → RESOLVED
Closed: 8 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla65
Can we land the attached testcase as a crashtest?
Flags: needinfo?(timdream)
Pushed by timdream@gmail.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/4e9dc6118cca
Follow-up, add testcase as crashtest, r=me
Pushed to inbound
Flags: needinfo?(timdream)
Depends on: 1507810
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.