862825 - crashtest-ipc fails if a test messes up its element prototype chains

Status: RESOLVED FIXED

(Testing :: Reftest, defect)

Description

[Boris Zbarsky [:bzbarsky]]

STEPS TO REPRODUCE:

1)  Create a crashtest that does this:

  HTMLElement.prototype.__proto__ = Proxy.create({}, {});

2)  Try to push it to try.

ACTUAL RESULTS: Passes all tests except crashtest-ipc

EXPECTED RESULTS: Passes crashtest-ipc

What happens is that crashtest-ipc is doing this, in SynchronizeForSnapshot:

  var dummyCanvas = content.document.createElementNS(XHTML_NS, "canvas");

and this throws if the test messed up its DOM.

So obvious questions:

1)  Should we be bailing early from SynchronizeForSnapshot if the test is TYPE_LOAD or TYPE_SCRIPT?  Seems silly to do canvas stuff in those cases, right?

2)  Should we be catching an exception from the createElement here and bailing out or something if that happens?

Comment 1

[Robert O'Callahan (:roc) (email my personal email if necessary)]

1) I guess so.
2) I don't know why we're using the test's document here. Seems to me we should use the outer window's document and avoid this problem that way.

Comment 2

[Boris Zbarsky [:bzbarsky]]

Chris, do you remember anything about this stuff?

Comment 3

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Pinging Chris is probably not a good idea.

I say just flip it to create the canvas using the outer window's document. I think that should work fine.

Comment 4

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

No opinion here, really.  roc's answers sound fine.

(I feel like at some point we need to have better automated tests for the reftest harness.)

Comment 5

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

I agree with roc re: (2).  The current impl is just buggy.

Comment 6

[Boris Zbarsky [:bzbarsky]]

Hmm.  So the outer window's document is in the parent process, while the reftest-content.js is running in the child process.  :(

I guess I'll post the patch to do #1 and call that good enough for now.

Comment 7

[Boris Zbarsky [:bzbarsky]]

Attachment: Stop trying to snapshot IPC crashtests or jsreftests.

Comment 8

[Boris Zbarsky [:bzbarsky]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/fc0bef5a2cfd

Comment 9

[Ryan VanderMeulen [:RyanVM]]

Backed out for mochitest-bc, mochitest-other, and xpcshell orange.
https://hg.mozilla.org/integration/mozilla-inbound/rev/9182c3e6a967

Comment 10

[Boris Zbarsky [:bzbarsky]]

The problem was from bug 869195.

Relanded: https://hg.mozilla.org/integration/mozilla-inbound/rev/1d3b60ab634a

Comment 11

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/1d3b60ab634a