Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

TypeError: can't access dead object in patchWindow.js #4

Open
jamhubhub opened this issue Jul 3, 2022 · 5 comments
Open

TypeError: can't access dead object in patchWindow.js #4

jamhubhub opened this issue Jul 3, 2022 · 5 comments
Assignees
@hackademix
Labels
bug Something isn't working

Comments

@jamhubhub
Copy link

First, I apologize as I cannot reproduce consistently the issue and cannot share the code that leads to it (it is from a private website). If this bug report is useless, feel free to close it.

So, this happens on a fairly complex javascript application that manipulates the DOM and uses Web Workers. The browser used is Tor Browser 11.0.14, based on Mozilla Firefox 91.10.0esr, in its default configuration (so, noscript is enabled by default). Sometimes, when using the application, all DOM manipulations seem to stop working, and a page reload is required. Specifically, running:

document.createElement("div").appendChild(document.createElement("div"))

in the browser javascript console throws a DOMException. When catched with a try-catch block, the catched error is undefined. Using the browser debugger step by step shows the original exception. On line 285 of the NSCL patchWindow.js, this:

for (let j = 0; j in win; j++) {

produces this exception:

TypeError: can't access dead object

and indeed, win appears as DeadObject in the browser debugger. See MDN about dead objects:

https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Errors/Dead_object

Do you know if the issue might be coming from your software or if I'm looking in the wrong direction?
@jamhubhub
Copy link
Author

I found a way to reproduce the issue consistently with a minimal code example. It looks like the issue comes either from the NSCL or from Firefox / Tor Browser? Steps to reproduce the issue:

  1. Create a file first.html:
<html>
    <head>
        <meta charset="UTF-8">
    </head>
    <body>
        <button onclick="document.createElement('div').appendChild(document.createElement('div'));">
            Add something to the DOM
        </button>
        <br/>
        <a href="second.html">second.html</a>
    </body>
</html>
  1. Create a file second.html:
<html>
    <head>
        <meta charset="UTF-8">
    </head>
    <body>
    </body>
</html>

  1. Open Tor Browser 11.0.14, based on Mozilla Firefox 91.10.0esr, NoScript version 11.4.6, and set the Tor Browser security level to "Safer". Open the browser console to monitor the issue.

  2. Open first.html as a local file. Click the button, no issue. Click the link. Go back to the previous page using the browser "left arrow" button. Click the button again, a DOMException is thrown. The browser console indicates the exception comes from patchWindow.js:299. Using the browser debugger seems to indicate the initial exception comes from patchWindow.js:285.

The issue doesn't come up when using Tor Browser security level "Normal".

@hackademix hackademix added the bug Something isn't working label Jul 4, 2022
@hackademix hackademix self-assigned this Jul 4, 2022
@hackademix
Copy link
Owner

hackademix commented Jul 4, 2022 •
edited
Loading

Hi, thank you for the report and the reduced test case.
At first glance, it seems a lifecycle mismatch between the page retrieved from BF Cache and the extension content script.
Not your code's fault, anyway.
Investigating...

@hackademix
Copy link
Owner

Hello, I've recently made some changes to the script injection machinery recently which are likely to affect this issue.
Can you still reproduce on NoScript 11.4.19rc3?
Thanks!

@mriehm
Copy link

mriehm commented Jul 23, 2023

I have been seeing this problem in Firefox on Android.
On initial load of a Wikipedia page, tapping the article section headers successfully expands/collapses that section of the article. However, if I tap a link within the article to go to a different article, and then I use the Back button to go back to the original article, tapping the article section headers will no longer expand/collapse the section. When I attached Firefox debugging, I see that tapping the section header triggers the same 'TypeError: can't access dead object' error for the 'win' object in the line 'for (let j = 0; j in win; j++)' reported in this issue.

I am on version 11.4.25 of the extension.

@hackademix
Copy link
Owner

On initial load of a Wikipedia page

Thank you very much for this test case. I could reproduce indeed, and I'm investigating it.

hackademix added a commit that referenced this issue Jul 24, 2023
@hackademix
Prevent dead object access on BF cache (issue #4).
4aab6f6
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@hackademix hackademix

Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@hackademix @mriehm @jamhubhub