1873290 - Permission denied to access property "styleSheet" with devtools open

Status: VERIFIED FIXED

(Core :: DOM: CSS Object Model, defect, P2)

Description

[Simon Lydell]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:122.0) Gecko/20100101 Firefox/122.0

Steps to reproduce:

1. Create a minimal HTML file and a minimal CSS file next to it called style.css.
2. Open the HTML file in Firefox.
3. Run the following in the console:

const style = document.createElement("style"); style.textContent = @import "./style.css";; style.onload = () => { console.log('load', style.sheet.cssRules[0].styleSheet) }; document.head.append(style)

It only happens when run in the console: If you add that code to a script tag, it doesn’t happen. Well, in my real project it does happen when run from a script tag if the devtools happen to be open, but I haven’t been able to reproduce that in a minimal example yet. For now, I hope that the “run from console” reproduction is enough to solve the bug.

Actual results:

An error is thrown:

Permission denied to access property "styleSheet"

Note: Sometimes you need to run the code a couple of times in a row for the error to happen. Seems like a timing thing, maybe.

Expected results:

The following should be logged to the console:

load CSSStyleSheet file:///Users/simon/stuff/firefox-bug/style.css

Comment 1

[Simon Lydell]

Attachment: index.html

Comment 2

[Simon Lydell]

Attachment: style.css

Comment 3

[Simon Lydell]

This (fixed) bug sounds very similar: https://bugzilla.mozilla.org/show_bug.cgi?id=1673199

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::DOM: Core & HTML' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 5

[Sean Feng [:sefeng211]]

I can repro by loading index.html and then execute

setTimeout(() => { for (let i = 0; i < 10; i++) { const style = document.createElement("style"); style.textContent = `@import "./style.css";`; style.onload = () => { console.log('load', style.sheet.cssRules[0].styleSheet) }; document.head.append(style) } }, 1000);

in the devtool console.

And yeah this indeed sounds similar to bug 1673199.

Looks like we are possibly using mOwningNode here.

Thoughts Emilio?

Comment 6

[Emilio Cobos Álvarez [:emilio]]

This is actually a regression from bug 1863874.

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1863874

Comment 8

[Emilio Cobos Álvarez [:emilio]]

Attachment: Bug 1873290 - Make Rule::GetParentObject return the stylesheet. r=mccr8,smaug

Rather than just asking for the relevant global.
StyleSheet::GetParentObject is a lot more subtle. This is enough to fix
the repro.

The issue is that some sheets don't have a relevant global because they
come with the stylesheet cache and get associated to a document after
being complete.

Comment 9

[Emilio Cobos Álvarez [:emilio]]

Attachment: Bug 1873290 - Update the relevant global on association for already-complete stylesheets. r=mccr8,smaug

When an stylesheet comes from the stylesheet cache and gets cloned, it
is already complete, but we only associate it to a document afterwards.

Make sure to set the relevant global then.

Depends on D197960

Comment 10

[Emilio Cobos Álvarez [:emilio]]

Attachment: Bug 1873290 - Extend test_medialist_privilege to cover this bug. r=mccr8,smaug

Depends on D197961

Comment 11

[Emilio Cobos Álvarez [:emilio]]

Comment on attachment 9371628 [details]
Bug 1873290 - Make Rule::GetParentObject return the stylesheet. r=mccr8,smaug

Beta/Release Uplift Approval Request

• User impact if declined: comment 0, weird errors for developers to find with devtools open.
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: Yes
• If yes, steps to reproduce: comment 0, and other attachments.
• List of other uplifts needed: none
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Trivial-ish change.
• String changes made/needed: none
• Is Android affected?: Yes

Comment 12

[Emilio Cobos Álvarez [:emilio]]

Comment on attachment 9371629 [details]
Bug 1873290 - Update the relevant global on association for already-complete stylesheets. r=mccr8,smaug

(see above)

Comment 13

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/6f6ac0bfc966
Make Rule::GetParentObject return the stylesheet. r=smaug
https://hg.mozilla.org/integration/autoland/rev/56dc701ab32c
Update the relevant global on association for already-complete stylesheets. r=smaug
https://hg.mozilla.org/integration/autoland/rev/52afac2411d2
Extend test_medialist_privilege to cover this bug. r=smaug

Comment 14

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/6f6ac0bfc966
https://hg.mozilla.org/mozilla-central/rev/56dc701ab32c
https://hg.mozilla.org/mozilla-central/rev/52afac2411d2

Comment 15

[Simon Lydell]

Wow, well done fixing it so quickly! 🌟

Comment 16

[Donal Meehan [:dmeehan]]

Comment on attachment 9371628 [details]
Bug 1873290 - Make Rule::GetParentObject return the stylesheet. r=mccr8,smaug

Approved for 122.0b9

Comment 17

[Donal Meehan [:dmeehan]]

Comment on attachment 9371629 [details]
Bug 1873290 - Update the relevant global on association for already-complete stylesheets. r=mccr8,smaug

Approved for 122.0b9

Comment 18

[Donal Meehan [:dmeehan]]

Comment on attachment 9371630 [details]
Bug 1873290 - Extend test_medialist_privilege to cover this bug. r=mccr8,smaug

Approved for 122.0b9

Comment 19

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-beta/rev/5e0859d75311
https://hg.mozilla.org/releases/mozilla-beta/rev/7dc3449b5232
https://hg.mozilla.org/releases/mozilla-beta/rev/c1a93cd76913

Comment 20

[Alexandru Trif, Desktop Test Engineering [:atrif]]

Reproduced the issue with 123.0a1 (2024-01-05) on Windows 10x64 by using the attached test case and the snippet from comment 5. Uncaught Error: Permission denied to access property "styleSheet" is displayed in web console.
The error is no longer displayed with Firefox 122.0b9 and 123.0a1 (2024-01-14) on Windows 10x64, macOS 12 and Ubuntu 22 by following thesame steps.