Closed
Bug 842726
Opened 11 years ago
Closed 11 years ago
Debugger crash when trying to inspect XUL document.__proto__
Categories
(Core :: DOM: Core & HTML, defect, P1)
Tracking
()
RESOLVED
FIXED
mozilla22
People
(Reporter: msucan, Assigned: bzbarsky)
References
Details
Attachments
(2 files)
8.35 KB,
text/plain
|
Details | |
5.33 KB,
patch
|
peterv
:
review+
|
Details | Diff | Splinter Review |
STR: 1. Apply patches from bug 783499 and bug 808370. 2. Open about:config 3. Open the Web Console. 4. Type document.__proto__. 5. Click on the result so you can inspect the object. Crash! This also happens with the test from: toolkit/devtools/webconsole/test/test_bug819670_getter_throws.html - which does the same. Attaching stacktrace from gdb. This crasher seems to be blocking me from completing bug 783499 - I couldn't find any workaround - except disabling the test. Jim, can you please look into this problem? Thank you! (I'm not sure which Core component to pick, filing in General for now. Please move as appropriate. Thanks!)
Assignee | ||
Comment 1•11 years ago
|
||
> 1. Apply patches from bug 783499 and bug 808370.
applying debug-api-variables-view
patching file browser/devtools/webconsole/webconsole.js
Hunk #1 FAILED at 13
1 out of 20 hunks FAILED -- saving rejects to file browser/devtools/webconsole/webconsole.js.rej
Assignee | ||
Comment 2•11 years ago
|
||
OK, I think I hand-edited the patch into submission. The stack looks like some XPConnect invariants are being violated; I should know which ones and how soon....
Reporter | ||
Comment 3•11 years ago
|
||
Updated bug 808370 include the latest rebased patch. Please apply in fx-team repo. Also note the bugs have dependencies. My patch queue: - Bug 837723 - Bug 820524 - Bug 783499 - Bug 808370 bz: thank you for looking into this.
Assignee | ||
Comment 4•11 years ago
|
||
So we're ending up calling GetterShim<DocumentURIObjectGetter>. The object passed in is the proto object. Then we end up with a null XPCWrappedNative, which is fine. Then we do: nsCOMPtr<nsIDocument> doc = do_QueryWrappedNative(wrapper, obj); but do_QueryWrappedNative assumes that null wrapper means the obj has an nsISupports private, which is pretty definitely not the case here. This can be triggered without the debug view thing pretty easily. Just open the web console on about:config and do: document.__proto__.documentURIObject Now the good news is, with bug 816387 fixed I think we can just rip out this GetterShim business altogether, like we did for Node in bug 817473.
Component: General → DOM
Depends on: 816387
Assignee | ||
Comment 5•11 years ago
|
||
Attachment #715699 -
Flags: review?(peterv)
Assignee | ||
Updated•11 years ago
|
Assignee: nobody → bzbarsky
Assignee | ||
Updated•11 years ago
|
Whiteboard: [need review]
Comment 6•11 years ago
|
||
Comment on attachment 715699 [details] [diff] [review] Kill off GetterShim and the classinfo support for chrome-only stuff on Document now that we can do that via WebIDL. Review of attachment 715699 [details] [diff] [review]: ----------------------------------------------------------------- I wonder if we should start putting mozilla-specific stuff on separate "implements" chunk.
Attachment #715699 -
Flags: review?(peterv) → review+
Assignee | ||
Comment 7•11 years ago
|
||
> I wonder if we should start putting mozilla-specific stuff on separate "implements" chunk.
Or at least a separate partial interface?
Assignee | ||
Comment 8•11 years ago
|
||
https://hg.mozilla.org/integration/mozilla-inbound/rev/4c8080f73b60 Mihai, we don't need this on Aurora, right?
Flags: in-testsuite?
Whiteboard: [need review]
Reporter | ||
Comment 9•11 years ago
|
||
(In reply to Boris Zbarsky (:bz) from comment #8) > https://hg.mozilla.org/integration/mozilla-inbound/rev/4c8080f73b60 > > Mihai, we don't need this on Aurora, right? No, we haven't landed bug 783499 yet. Thank you very much for the quick fix!
Comment 10•11 years ago
|
||
Unfortunately, this was backed out due to one of the changesets in the push making browser_dbg_bug723069_editor-breakpoints.js fail frequently on Windows and OSX opt builds. https://hg.mozilla.org/integration/mozilla-inbound/rev/ca34c11bf55d https://tbpl.mozilla.org/php/getParsedLog.php?id=19995636&tree=Mozilla-Inbound 11:12:16 INFO - TEST-PASS | chrome://mochitests/content/browser/browser/devtools/debugger/test/browser_dbg_bug723069_editor-breakpoints.js | editor.getBreakpoints().length is correct 11:12:16 INFO - TEST-INFO | chrome://mochitests/content/browser/browser/devtools/debugger/test/browser_dbg_bug723069_editor-breakpoints.js | remove the second breakpoint using the mouse 11:12:16 INFO - TEST-INFO | chrome://mochitests/content/browser/browser/devtools/debugger/test/browser_dbg_bug723069_editor-breakpoints.js | Console message: [JavaScript Warning: "Use of attributes' specified attribute is deprecated. It always returns true." {file: "chrome://browser/content/orion.js" line: 6341}] 11:12:16 INFO - TEST-INFO | chrome://mochitests/content/browser/browser/devtools/debugger/test/browser_dbg_bug723069_editor-breakpoints.js | Console message: [JavaScript Warning: "Use of removeAttributeNode() is deprecated. Use removeAttribute() instead." {file: "chrome://browser/content/orion.js" line: 6342}] 11:12:17 INFO - DBG-FRONTEND: Updating the DebuggerView editor: http://example.com/browser/browser/devtools/debugger/test/test-script-switching-02.js @ 6, flags: ({noSwitch:true}) 11:12:17 INFO - DBG-FRONTEND: Updating the DebuggerView editor: http://example.com/browser/browser/devtools/debugger/test/test-script-switching-02.js @ 6, flags: ({noSwitch:true}) 11:12:17 INFO - DBG-FRONTEND: Updating the DebuggerView editor: http://example.com/browser/browser/devtools/debugger/test/test-script-switching-02.js @ 6, flags: ({noSwitch:true}) 11:12:17 INFO - DBG-FRONTEND: Updating the DebuggerView editor: http://example.com/browser/browser/devtools/debugger/test/test-script-switching-02.js @ 6, flags: ({noSwitch:true}) 11:12:46 WARNING - TEST-UNEXPECTED-FAIL | chrome://mochitests/content/browser/browser/devtools/debugger/test/browser_dbg_bug723069_editor-breakpoints.js | Test timed out 11:12:46 WARNING - This is a harness error. 11:12:46 INFO - args: ['/usr/sbin/screencapture', '-C', '-x', '-t', 'png', '/var/folders/qd/srwd5f710sj0fcl9z464lkj00000gn/T/mozilla-test-fail_GzeI8j'] 11:12:48 INFO - SCREENSHOT: <see log> 11:12:48 INFO - DBG-FRONTEND: Destroying the DebuggerView 11:12:48 INFO - DBG-FRONTEND: Destroying the ToolbarView 11:12:48 INFO - DBG-FRONTEND: Destroying the OptionsView 11:12:48 INFO - DBG-FRONTEND: Destroying the ChromeGlobalsView 11:12:48 INFO - DBG-FRONTEND: Destroying the SourcesView 11:12:48 INFO - DBG-FRONTEND: Destroying the FilterView 11:12:48 INFO - DBG-FRONTEND: Destroying the FilteredSourcesView 11:12:48 INFO - DBG-FRONTEND: Destroying the StackFramesView 11:12:48 INFO - DBG-FRONTEND: Destroying the BreakpointsView 11:12:48 INFO - DBG-FRONTEND: Destroying the WatchExpressionsView 11:12:48 INFO - DBG-FRONTEND: Destroying the GlobalSearchView 11:12:48 INFO - DBG-FRONTEND: Destroying the DebuggerView window 11:12:48 INFO - DBG-FRONTEND: Destroying the DebuggerView panes 11:12:48 INFO - DBG-FRONTEND: Destroying the DebuggerView editor 11:12:48 INFO - DBG-FRONTEND: SourceScripts is disconnecting... 11:12:48 INFO - DBG-FRONTEND: StackFrames is disconnecting... 11:12:48 INFO - DBG-FRONTEND: ThreadState is disconnecting... 11:12:48 INFO - TEST-PASS | chrome://mochitests/content/browser/browser/devtools/debugger/test/browser_dbg_bug723069_editor-breakpoints.js | correct number of breakpoints have been added 11:12:48 INFO - TEST-PASS | chrome://mochitests/content/browser/browser/devtools/debugger/test/browser_dbg_bug723069_editor-breakpoints.js | correct number of breakpoints have been removed 11:12:48 WARNING - TEST-UNEXPECTED-FAIL | chrome://mochitests/content/browser/browser/devtools/debugger/test/browser_dbg_bug723069_editor-breakpoints.js | correct number of editor breakpoint changes - Got 3, expected 4 11:12:48 WARNING - This is a harness error. 11:12:48 INFO - Stack trace: 11:12:48 INFO - JS frame :: chrome://mochikit/content/browser-test.js :: test_is :: line 486 11:12:48 INFO - JS frame :: chrome://mochitests/content/browser/browser/devtools/debugger/test/browser_dbg_bug723069_editor-breakpoints.js :: <TOP_LEVEL> :: line 295 11:12:48 INFO - JS frame :: chrome://mochikit/content/browser-test.js :: Tester_nextTest :: line 250 11:12:48 INFO - JS frame :: chrome://mochikit/content/browser-test.js :: <TOP_LEVEL> :: line 419 11:12:48 INFO - native frame :: <unknown filename> :: <TOP_LEVEL> :: line 0 11:12:48 INFO - INFO TEST-END | chrome://mochitests/content/browser/browser/devtools/debugger/test/browser_dbg_bug723069_editor-breakpoints.js | finished in 30099ms
Assignee | ||
Comment 11•11 years ago
|
||
Confirmed via try that this bug is not responsible for that orange (as far as I can tell) and pushed http://hg.mozilla.org/integration/mozilla-inbound/rev/af5152ddbf22
Target Milestone: --- → mozilla22
Comment 12•11 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/af5152ddbf22
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
Updated•5 years ago
|
Component: DOM → DOM: Core & HTML
You need to log in
before you can comment on or make changes to this bug.
Description
•