2042101 - [devtools-toolbox-crash] Error: Protocol error (TypeError): can't access dead object from: server0.conn3.watcher2.process53801//domwalker700 (resource://devtools/server/actors/inspector/event-collector.js:278:21)

Status: RESOLVED FIXED

(DevTools :: Inspector, defect, P2)

Description

[Julian Descottes [:jdescottes]]

Currently experiencing the issue on https://risetheexperience.com/pages/benefits, might affect other websites.

STRs:

• install Stylus (https://addons.mozilla.org/fr/firefox/addon/styl-us/)
• open a tab on https://risetheexperience.com/pages/benefits
• open devtools > inspector
• do a hard reload (ctrl or cmd + shift + R) (or disable cache in the netmonitor)

The hard-reload vs reload or cache disabling is not 100% necessary, on some other profiles I consistently get it regardless of that. But on a clean profile that seems necessary.

Seems like a race condition so it might be hardware specific.

In the Browser Console I can see:

Failed to start [root-node] legacy listener for target server0.conn0.watcher2.process9//windowGlobalTarget4789 Error: Protocol error (NS_ERROR_FAILURE): Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [inIDeepTreeWalker.currentNode] from: server0.conn0.watcher2.process9//domwalker4463 (resource://devtools/server/actors/inspector/document-walker.js:73:36)
onPacket resource://devtools/shared/protocol/Front.js:405
DevTools RDP*request resource://devtools/shared/protocol/Front.js:321
name resource://devtools/shared/protocol/Front/FrontClassWithSpec.js:94
reparentRemoteFrame resource://devtools/client/fronts/walker.js:416

Comment 1

[Alexandre Poirot [:ochameau]]

Note that bug 2042894's patch: https://phabricator.services.mozilla.com/D302827
significantly helps by showing all the stacktraces, and clearly shows the something went wrong and that a bug can be filled.

Comment 2

[Julian Descottes [:jdescottes]]

(In reply to Alexandre Poirot [:ochameau] from comment #1)

Note that bug 2042894's patch: https://phabricator.services.mozilla.com/D302827
significantly helps by showing all the stacktraces, and clearly shows the something went wrong and that a bug can be filled.

Stumbled upon the crash today:

Error in Inspector Panel:

Error: Protocol error (TypeError): can't access dead object from: server0.conn3.watcher2.process53801//domwalker700 (resource://devtools/server/actors/inspector/event-collector.js:278:21)

Client Packet:

{
  "type": "querySelector",
  "node": "server0.conn3.watcher2.process53801//domnode699",
  "selector": "body",
  "to": "server0.conn3.watcher2.process53801//domwalker700"
}

Server Packet:

{
  "from": "server0.conn3.watcher2.process53801//domwalker700",
  "error": "TypeError",
  "message": "can't access dead object",
  "fileName": "resource://devtools/server/actors/inspector/event-collector.js",
  "lineNumber": 278,
  "columnNumber": 21
}

Server Stack:

getDOMListeners@resource://devtools/server/actors/inspector/event-collector.js:278:21
getListeners@resource://devtools/server/actors/inspector/event-collector.js:340:28
hasListeners@resource://devtools/server/actors/inspector/event-collector.js:226:17
hasEventListeners@resource://devtools/server/actors/inspector/event-collector.js:807:21
hasEventListeners@resource://devtools/server/actors/inspector/node.js:445:43
form@resource://devtools/server/actors/inspector/node.js:239:37
write@resource://devtools/shared/protocol/types.js:374:32
types.addArrayType/write/<@resource://devtools/shared/protocol/types.js:224:33
write@resource://devtools/shared/protocol/types.js:224:16
write@resource://devtools/shared/protocol/types.js:272:39
write@resource://devtools/shared/protocol/Response.js:101:22
write@resource://devtools/shared/protocol/Response.js:49:28
sendReturn@resource://devtools/shared/protocol/Actor.js:258:38

Comment 3

[Julian Descottes [:jdescottes]]

Attachment: Bug 2042101 - [devtools] Avoid inspector crashes if getListenerInfoFor returns dead wrappers r=#devtools!

Fixes the issue locally for me when Stylus is installed.

Comment 4

[Julian Descottes [:jdescottes]]

From a quick logging it seems that this issue occurs on the html element, when looping on the listeners returned by EventListenerService::GetListenerInfoFor.

I managed to simplify the test case to a basic html page + webextension content script, will upload the test case.

Comment 5

[Julian Descottes [:jdescottes]]

Attachment: bug2042101_webextension.zip

Unzip and load as temporary webextension via about:debugging.

Comment 6

[Julian Descottes [:jdescottes]]

Attachment: testcase.html

Open the test page, with the webextension installed, make sure devtools are set to open on the inspector. Reload the page, open devtools, the panel should crash.

Comment 7

[Julian Descottes [:jdescottes]]

Key parts:

1. Markup:

• create an iframe pointing to about:blank
• insert it in the DOM
• immediately navigate it

<script type="text/javascript">
  const frame = document.createElement("iframe");
  frame.src = "about:blank";
  document.body.appendChild(frame);
  frame.src = "https://example.com"
</script>

2. Extension

• only defines a content script
• config: run at document start, match all urls, match about:blank, match all frames
• code itself, if the current global is an about:blank iframe, add an event listener on the parent (the actual type of the event doesn't matter)

const isFrame = window !== top;
const isAboutBlank = location.href === "about:blank";
if (isFrame && isAboutBlank) {
  window.parent.addEventListener("click", function() {});
}

The compartment for the event listener must be destroyed when the frame navigates and we end up returning a dead wrapper listener object.

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/59461b5446f7
https://hg.mozilla.org/integration/autoland/rev/2e9c9654dd3e
[devtools] Avoid inspector crashes if getListenerInfoFor returns dead wrappers r=devtools-reviewers,nchevobbe

Comment 10

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/2e9c9654dd3e

Comment 17

[Julian Descottes [:jdescottes]]

Based on our probes, this issue spiked significantly in 153. It's not clear what was the regressor, but since 153 hit the release channel we have a lot of reports + ~300 events per day for this error. We should uplift.

Comment 18

[Phabricator Automation]

firefox-esr153 Uplift Approval Request

• User impact if declined/Reason for urgency: Based on our toolbox error probes this is the most frequent cause of devtools toolbox crashes (~300 per day, while we usually have a total of ~700 so around +50% of increase).

https://sql.telemetry.mozilla.org/queries/119237#291111

• Code covered by automated testing?: no
• Fix verified in Nightly?: yes
• Needs manual QE testing?: no
• Steps to reproduce for manual QE testing: n/a
• Risk associated with taking this patch: low
• Explanation of risk level: Adding simple guards in devtools only JS.
• String changes made/needed?: n/a
• Is Android affected?: no

Comment 19

[Julian Descottes [:jdescottes]]

Attachment: Bug 2042101 - [devtools] Avoid inspector crashes if getListenerInfoFor returns dead wrappers

Fixes the issue locally for me when Stylus is installed.

Original Revision: https://phabricator.services.mozilla.com/D308247

Comment 20

[Phabricator Automation]

firefox-release Uplift Approval Request

• User impact if declined/Reason for urgency: Based on our toolbox error probes this is the most frequent cause of devtools toolbox crashes (~300 per day, while we usually have a total of ~700 so around +50% of increase).

https://sql.telemetry.mozilla.org/queries/119237#291111

• Code covered by automated testing?: no
• Fix verified in Nightly?: yes
• Needs manual QE testing?: no
• Steps to reproduce for manual QE testing: n/a
• Risk associated with taking this patch: low
• Explanation of risk level: Adding simple guards in devtools only JS.
• String changes made/needed?: n/a
• Is Android affected?: no

Comment 21

[Julian Descottes [:jdescottes]]

Attachment: Bug 2042101 - [devtools] Avoid inspector crashes if getListenerInfoFor returns dead wrappers

Fixes the issue locally for me when Stylus is installed.

Original Revision: https://phabricator.services.mozilla.com/D308247

Comment 22

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr153/rev/0f75e83d38a4

Comment 23

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/ec7b896fd2dd
https://hg.mozilla.org/releases/mozilla-release/rev/116bdb096bad