Closed Bug 842726 Opened 7 years ago Closed 7 years ago

Debugger crash when trying to inspect XUL document.__proto__

Categories

(Core :: DOM: Core & HTML, defect, P1, major)

x86_64
Linux
defect

Tracking

()

RESOLVED FIXED
mozilla22

People

(Reporter: msucan, Assigned: bzbarsky)

References

Details

Attachments

(2 files)

Attached file gdb bt
STR:

1. Apply patches from bug 783499 and bug 808370.
2. Open about:config
3. Open the Web Console.
4. Type document.__proto__.
5. Click on the result so you can inspect the object.

Crash!

This also happens with the test from: toolkit/devtools/webconsole/test/test_bug819670_getter_throws.html - which does the same.

Attaching stacktrace from gdb.

This crasher seems to be blocking me from completing bug 783499 - I couldn't find any workaround - except disabling the test.

Jim, can you please look into this problem? Thank you!

(I'm not sure which Core component to pick, filing in General for now. Please move as appropriate. Thanks!)
> 1. Apply patches from bug 783499 and bug 808370.

applying debug-api-variables-view
patching file browser/devtools/webconsole/webconsole.js
Hunk #1 FAILED at 13
1 out of 20 hunks FAILED -- saving rejects to file browser/devtools/webconsole/webconsole.js.rej
OK, I think I hand-edited the patch into submission.

The stack looks like some XPConnect invariants are being violated; I should know which ones and how soon....
Updated bug 808370 include the latest rebased patch. Please apply in fx-team repo.

Also note the bugs have dependencies. My patch queue:

- Bug 837723
- Bug 820524
- Bug 783499
- Bug 808370

bz: thank you for looking into this.
So we're ending up calling GetterShim<DocumentURIObjectGetter>.

The object passed in is the proto object.  Then we end up with a null XPCWrappedNative, which is fine.  Then we do:

  nsCOMPtr<nsIDocument> doc = do_QueryWrappedNative(wrapper, obj);

but do_QueryWrappedNative assumes that null wrapper means the obj has an nsISupports private, which is pretty definitely not the case here.

This can be triggered without the debug view thing pretty easily. Just open the web console on about:config and do:

  document.__proto__.documentURIObject

Now the good news is, with bug 816387 fixed I think we can just rip out this GetterShim business altogether, like we did for Node in bug 817473.
Component: General → DOM
Depends on: 816387
Assignee: nobody → bzbarsky
Whiteboard: [need review]
Comment on attachment 715699 [details] [diff] [review]
Kill off GetterShim and the classinfo support for chrome-only stuff on Document now that we can do that via WebIDL.

Review of attachment 715699 [details] [diff] [review]:
-----------------------------------------------------------------

I wonder if we should start putting mozilla-specific stuff on separate "implements" chunk.
Attachment #715699 - Flags: review?(peterv) → review+
> I wonder if we should start putting mozilla-specific stuff on separate "implements" chunk.

Or at least a separate partial interface?
https://hg.mozilla.org/integration/mozilla-inbound/rev/4c8080f73b60

Mihai, we don't need this on Aurora, right?
Flags: in-testsuite?
Whiteboard: [need review]
(In reply to Boris Zbarsky (:bz) from comment #8)
> https://hg.mozilla.org/integration/mozilla-inbound/rev/4c8080f73b60
> 
> Mihai, we don't need this on Aurora, right?

No, we haven't landed bug 783499 yet. Thank you very much for the quick fix!
Unfortunately, this was backed out due to one of the changesets in the push making browser_dbg_bug723069_editor-breakpoints.js fail frequently on Windows and OSX opt builds.
https://hg.mozilla.org/integration/mozilla-inbound/rev/ca34c11bf55d

https://tbpl.mozilla.org/php/getParsedLog.php?id=19995636&tree=Mozilla-Inbound

11:12:16     INFO -  TEST-PASS | chrome://mochitests/content/browser/browser/devtools/debugger/test/browser_dbg_bug723069_editor-breakpoints.js | editor.getBreakpoints().length is correct
11:12:16     INFO -  TEST-INFO | chrome://mochitests/content/browser/browser/devtools/debugger/test/browser_dbg_bug723069_editor-breakpoints.js | remove the second breakpoint using the mouse
11:12:16     INFO -  TEST-INFO | chrome://mochitests/content/browser/browser/devtools/debugger/test/browser_dbg_bug723069_editor-breakpoints.js | Console message: [JavaScript Warning: "Use of attributes' specified attribute is deprecated. It always returns true." {file: "chrome://browser/content/orion.js" line: 6341}]
11:12:16     INFO -  TEST-INFO | chrome://mochitests/content/browser/browser/devtools/debugger/test/browser_dbg_bug723069_editor-breakpoints.js | Console message: [JavaScript Warning: "Use of removeAttributeNode() is deprecated. Use removeAttribute() instead." {file: "chrome://browser/content/orion.js" line: 6342}]
11:12:17     INFO -  DBG-FRONTEND: Updating the DebuggerView editor: http://example.com/browser/browser/devtools/debugger/test/test-script-switching-02.js @ 6, flags: ({noSwitch:true})
11:12:17     INFO -  DBG-FRONTEND: Updating the DebuggerView editor: http://example.com/browser/browser/devtools/debugger/test/test-script-switching-02.js @ 6, flags: ({noSwitch:true})
11:12:17     INFO -  DBG-FRONTEND: Updating the DebuggerView editor: http://example.com/browser/browser/devtools/debugger/test/test-script-switching-02.js @ 6, flags: ({noSwitch:true})
11:12:17     INFO -  DBG-FRONTEND: Updating the DebuggerView editor: http://example.com/browser/browser/devtools/debugger/test/test-script-switching-02.js @ 6, flags: ({noSwitch:true})
11:12:46  WARNING -  TEST-UNEXPECTED-FAIL | chrome://mochitests/content/browser/browser/devtools/debugger/test/browser_dbg_bug723069_editor-breakpoints.js | Test timed out
11:12:46  WARNING -  This is a harness error.
11:12:46     INFO -  args: ['/usr/sbin/screencapture', '-C', '-x', '-t', 'png', '/var/folders/qd/srwd5f710sj0fcl9z464lkj00000gn/T/mozilla-test-fail_GzeI8j']
11:12:48     INFO -  SCREENSHOT: <see log>
11:12:48     INFO -  DBG-FRONTEND: Destroying the DebuggerView
11:12:48     INFO -  DBG-FRONTEND: Destroying the ToolbarView
11:12:48     INFO -  DBG-FRONTEND: Destroying the OptionsView
11:12:48     INFO -  DBG-FRONTEND: Destroying the ChromeGlobalsView
11:12:48     INFO -  DBG-FRONTEND: Destroying the SourcesView
11:12:48     INFO -  DBG-FRONTEND: Destroying the FilterView
11:12:48     INFO -  DBG-FRONTEND: Destroying the FilteredSourcesView
11:12:48     INFO -  DBG-FRONTEND: Destroying the StackFramesView
11:12:48     INFO -  DBG-FRONTEND: Destroying the BreakpointsView
11:12:48     INFO -  DBG-FRONTEND: Destroying the WatchExpressionsView
11:12:48     INFO -  DBG-FRONTEND: Destroying the GlobalSearchView
11:12:48     INFO -  DBG-FRONTEND: Destroying the DebuggerView window
11:12:48     INFO -  DBG-FRONTEND: Destroying the DebuggerView panes
11:12:48     INFO -  DBG-FRONTEND: Destroying the DebuggerView editor
11:12:48     INFO -  DBG-FRONTEND: SourceScripts is disconnecting...
11:12:48     INFO -  DBG-FRONTEND: StackFrames is disconnecting...
11:12:48     INFO -  DBG-FRONTEND: ThreadState is disconnecting...
11:12:48     INFO -  TEST-PASS | chrome://mochitests/content/browser/browser/devtools/debugger/test/browser_dbg_bug723069_editor-breakpoints.js | correct number of breakpoints have been added
11:12:48     INFO -  TEST-PASS | chrome://mochitests/content/browser/browser/devtools/debugger/test/browser_dbg_bug723069_editor-breakpoints.js | correct number of breakpoints have been removed
11:12:48  WARNING -  TEST-UNEXPECTED-FAIL | chrome://mochitests/content/browser/browser/devtools/debugger/test/browser_dbg_bug723069_editor-breakpoints.js | correct number of editor breakpoint changes - Got 3, expected 4
11:12:48  WARNING -  This is a harness error.
11:12:48     INFO -  Stack trace:
11:12:48     INFO -      JS frame :: chrome://mochikit/content/browser-test.js :: test_is :: line 486
11:12:48     INFO -      JS frame :: chrome://mochitests/content/browser/browser/devtools/debugger/test/browser_dbg_bug723069_editor-breakpoints.js :: <TOP_LEVEL> :: line 295
11:12:48     INFO -      JS frame :: chrome://mochikit/content/browser-test.js :: Tester_nextTest :: line 250
11:12:48     INFO -      JS frame :: chrome://mochikit/content/browser-test.js :: <TOP_LEVEL> :: line 419
11:12:48     INFO -      native frame :: <unknown filename> :: <TOP_LEVEL> :: line 0
11:12:48     INFO -  INFO TEST-END | chrome://mochitests/content/browser/browser/devtools/debugger/test/browser_dbg_bug723069_editor-breakpoints.js | finished in 30099ms
Confirmed via try that this bug is not responsible for that orange (as far as I can tell) and pushed http://hg.mozilla.org/integration/mozilla-inbound/rev/af5152ddbf22
Target Milestone: --- → mozilla22
https://hg.mozilla.org/mozilla-central/rev/af5152ddbf22
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.