New issue
Advanced search Search tips

Issue 825844 link

Starred by 1 user

Issue metadata

Status: Duplicate
Owner:
Closed: May 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Windows , Mac
Pri: 1
Type: Bug-Regression



Sign in to add a comment

Debugging JS (in dev tools) dealing with shadowRoot seems to throw an 'Uncaught TypeError' unexpectedly but consistently.

Reported by jon...@gmail.com, Mar 26 2018

Issue description

UserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.45 Safari/537.36

Steps to reproduce the problem:
1. Within a shadow DOM context (ie web-component) run a bunch of this.shadowRoot.querySelector('something') calls and an 'Uncaught TypeError' exception should be thrown after around 42 lines.

Runnable example test code - use dropdown to select test to run, some cause the error (_Fail) and others don't (_NoFail) even though using similar code:
https://jsfiddle.net/g0eprkmh/9/

Sample code for reference (pulled from above test code url):
<crash-test></crash-test>
<script>
class CrashTest extends HTMLElement {
  test() {
    this.shadowRoot.querySelector('foobar0');
    this.shadowRoot.querySelector('foobar1');
    this.shadowRoot.querySelector('foobar2');
    ... // Fill in the rest 3-40
    this.shadowRoot.querySelector('foobar41');
    this.shadowRoot.querySelector('foobar42'); // In my test (using this code) the exception occurs on this line consistantly.
    this.shadowRoot.querySelector('foobar43');
  }
}
customElements.define('crash-test', CrashTest);
</script>

What is the expected behavior?
I see no reason for the exception to be thrown, and only occurs while debugging in dev tools.
Expected behavior is no exception at all.

What went wrong?
An exception was thrown that was not expected.
For me it has always been an 'Uncaught TypeError' exception, usually 'Uncaught TypeError: Cannot convert undefined or null to object' though I believe I also got 'Uncaught TypeError: Cannot convert object to primitive value' as well (but not in the tests I've provided here).

Did this work before? Yes 65

Chrome version: 66.0.3359.45  Channel: beta
OS Version: 10.0
Flash Version: 

* Dev tools sometimes/often disconnects after the exception.
* Other non-shadowRoot lines of code can affect where the exception is thrown, though I don't quite understand which do and why.
* shadowRoot.querySelector and shadowRoot.getElementById both cause the error, maybe simply interacting with the shadowRoot in general? maybe it's not shadowRoot itself but that's where I've been able to reproduce the issue.
* I tried document.querySelector/getElementById (without shadow DOM) and the issue did NOT occur.
* Code runs fine when not debugging.
* Tested on my own machine and a fresh machine instance with fresh installs of Chrome and issue was reproduced. My machine is Windows-10 Pro with Chrome Beta (66.0.3359.45), and the 'fresh' machine is Windows Server 2016 with Chrome Canary (67.0.3379.0) and Chrome Release (65.0.3325.181).
* Firefox does not exhibit this issue. I did not test Safari or Edge.
 

Comment 1 by jon...@gmail.com, Mar 26 2018

Just to be clear:
Chrome Beta (66.0.3359.45) and Canary (67.0.3379.0) exhibit the issue, Chrome Release (65.0.3325.181) does not, nor does Firefox.
Labels: Needs-Bisect Needs-Triage-M66
Labels: Triaged-ET Needs-Feedback
Tested the issue on chrome reported version 66.0.3359.45 using Windows-10 with steps mentioned below:
1) Launched chrome reported version and opened the jsfiddle: https://jsfiddle.net/g0eprkmh/9/
2) Opened Devtools, selected testLooping_NoFail from the drop down and clicked on "RUN"
3) In "Source" tab it shows with some code under "Index" and didn't observed any error message in console tab.
Observations: Tested the issue on chrome version# 65.0.3325.181 and observed the same as mentioned above

@Reporter: Please find the attached screen cast for your reference and let us know if we missed anything in reproducing the issue, provide your feedback on it which helps us in further triaging it. If possible could you please provide the screen cast of the issue for better understanding.

Thanks!
825844.mp4
1.8 MB View Download

Comment 4 by jon...@gmail.com, Mar 27 2018

The above test (video) didn't actually step through to the line that causes the exception.

My tests were not as clear as they should have been, my apologies...

I've simplified the test and provided clearer instructions (in the test):
https://jsfiddle.net/g0eprkmh/15/

Project Member

Comment 5 by sheriffbot@chromium.org, Mar 27 2018

Cc: viswa.karala@chromium.org
Labels: -Needs-Feedback
Thank you for providing more feedback. Adding the requester to the cc list.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 6 by jon...@gmail.com, Mar 27 2018

Here is a video of me using the test (https://jsfiddle.net/g0eprkmh/15/) to produce the error.

Note that in this test/video the devtools disconnected at the end, this commonly happens after this error is generated, though not always (at least not immediately).

Whereas the exception DOES always occur.
Chrome Devtools Bug.mp4
1.6 MB View Download
Components: Blink>JavaScript
Labels: -Pri-2 -Needs-Bisect hasbisect-per-revision Target-67 Target-66 M-66 FoundIn-66 FoundIn-67 ReleaseBlock-Stable RegressedIn-66 OS-Linux OS-Mac Pri-1
Owner: ahaas@chromium.org
Status: Assigned (was: Unconfirmed)
Able to reproduce the issue on reported chrome version 66.0.3359.45 using Windows-10, Mac 10.12.6 & Ubuntu 14.04  hence providing Bisect Info
Bisect Info:
================
Good build: 66.0.3328.0
Bad build: 66.0.3329.0

You are probably looking for a change made after 530866 (known good), but no later than 530867 (first known bad).

https://chromium.googlesource.com/chromium/src/+log/782ebe9982e515ab6234c5a40f037d710d89a18c..5c1799f9843b0ccfedd45c837bdd9f08e6982e25

We are not 100% sure about the suspect, but tentatively suspecting as mentioned below 
Commit: https://chromium.googlesource.com/v8/v8/+/56fe24372cbba2a6ef8a2934e6410eb432d8c92f

Reviewed-on: https://chromium-review.googlesource.com/876091

@Andreas Haas: Could you please take a look at the issue and help in re-assigning if it is not related to your change.
Adding ReleaseBlock-Stable as it is seems a recent break, feel free to remove it if not applicable.

Thanks!
Friendly ping to get an update on this issue as it is marked as RB stable for M66.

Thanks..!
Just a heads up, M66 Stable cut is on April 12th, 10 days away. This issue is marked as RB-Stable for 66. Please make sure to address this issue prior to stable cut. Thanks! 
Status: Started (was: Assigned)
Owner: leszeks@chromium.org
Status: Assigned (was: Started)
Thanks for the great repro, this was really helpful.

According to my bisection this issue was introduced by https://crrev.com/5cef3ddd5f46c63deafe10270974bea06f7c4868.

Leszek, could you please take a look?
Cc: kozyatinskiy@chromium.org
Yes, I can repro this on current cannary (M67). I can also similarly repro by running "this.shadowRoot" twice in the console after the debugger break -- the second prints undefined for some reason:

> this.shadowRoot
$ #shadow-root (open)<button>​Run​</button>​
> this.shadowRoot
$ undefined

Bit strange, nothing in that code is generators so I wouldn't have expected a generator change to break it. +kozyatinskiy who might have some ideas.
Owner: kozyatinskiy@chromium.org
Friendly ping to get an update on this issue as it is marked as stable blocker & M66 Stable cut is on April 12th.

Thanks..! 
Reminder: Please note that M66 Stable is only 7 days away. This bug has been marked as ReleaseBlock Stable for M66. So please take a look and appropriately address this bug. 
Gentle ping to get an update on this issue ASAP as M66 stable cut is tomorrow and this bug is marked as stable blocker.

Thanks..!

*Stable release
Labels: -M-66 -Target-66 M-67
Let's target this for 67. 
M67 Stable promotion is coming soon. Your bug is labelled as Stable ReleaseBlock, pls make sure to land the fix and request a merge into the release branch ASAP. Thank you.


Comment 20 by kozy@chromium.org, May 2 2018

Cc: -kozyatinskiy@chromium.org leszeks@chromium.org kozy@chromium.org
Owner: kozy@chromium.org
I believe that actual issue is here might be related to  crbug.com/v8/7673 

Which was originally introduced as part of big cleanup: https://chromium-review.googlesource.com/c/v8/v8/+/722959

@leszeks, may mentioned CL be related?

Comment 21 by kozy@chromium.org, May 2 2018

Cc: yangguo@chromium.org
+Yang, I believe your CL [1] might fix this issue as well. I will try as soon as your CL is merged.

[1] https://chromium-review.googlesource.com/c/v8/v8/+/1032430
*** Bulk Edit ***
M67 Stable promotion is coming soon. Your bug is labelled as Stable ReleaseBlock, pls make sure to land the fix and request a merge into the release branch ASAP. 

If fix is already merged to M67 and nothing else is pending, pls mark the bug as fixed. Thank you.
*** Bulk Edit ***
M67 Stable promotion is coming VERY soon. Your bug is labelled as Stable ReleaseBlock, pls make sure to land the fix and request a merge into the release branch ASAP. 

If fix is already merged to M67 and nothing else is pending, pls mark the bug as fixed. Thank you.

Comment 24 by kozy@chromium.org, May 7 2018

Mergedinto: 835973
Status: Duplicate (was: Assigned)

Sign in to add a comment