Closed Bug 2068874 Opened 11 days ago Closed 10 days ago

Failed event dispatch can reply with a non-cloneable error and mask the real failure

Categories

(Remote Protocol :: Marionette, defect, P3)

defect
Points:
1

Tracking

(firefox157 fixed)

RESOLVED FIXED
157 Branch
Tracking Status
firefox157 --- fixed

People

(Reporter: whimboo, Assigned: whimboo)

References

Details

(Whiteboard: [webdriver:m21])

Attachments

(1 file)

MarionetteCommandsChild.#dispatchEvent converts a failed event synthesis into an AbortError so the actor proxy can retry it:

    } catch (e) {
      if (e.message.includes("NS_ERROR_FAILURE")) {
        // Event dispatch failed. Re-throwing as AbortError to allow retrying
        // to dispatch the event.
        throw new DOMException(
          `Failed to dispatch event "${eventName}": ${e.message}`,
          "AbortError"
        );
      }

      throw e;

The check only looks at message, but an XPCOM exception carries the result code in name and can have an empty message. Such an error is not converted, falls through to receiveMessage, and is returned raw as { error: e, isWebDriverError: false }. An nsIException is not structured-cloneable, so the reply itself fails and the caller only sees:

    unknown error (500): [Exception... "MarionetteCommands:MarionetteCommandsParent:_dispatchEvent:
    message reply cannot be cloned." nsresult: "0x80004005 (DataCloneError)" location: "<unknown>" data: no]

The real error is lost. Instrumenting the catch shows name=NS_ERROR_FAILURE, result=2147500037 and an empty message.

Steps to reproduce: dispatch a touch pointerMove against a parent process page with system access enabled and remote.events.async.touch.enabled disabled. Changing the condition to also accept e.name === "NS_ERROR_FAILURE" turns the reply into:

    unknown error (500): AbortError: Failed to dispatch event "synthesizeTouchAtPoint": NS_ERROR_FAILURE

which is actionable. This only unmasks the error and does not make the dispatch succeed, so the underlying NS_ERROR_FAILURE from synthesizing a touch event in a parent process page needs to be looked at separately.

Bug 1983780 fails with the same DataCloneError signature and could maybe become diagnosable. We could reopen if the fix is easy enough.

Assignee: nobody → hskupin
Status: NEW → ASSIGNED
Severity: -- → S3
Points: --- → 1
Priority: -- → P3
Whiteboard: [webdriver:m21]
Status: ASSIGNED → RESOLVED
Closed: 10 days ago
Resolution: --- → FIXED
Target Milestone: --- → 157 Branch
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: