Open jamhubhub opened 2 years ago
I found a way to reproduce the issue consistently with a minimal code example. It looks like the issue comes either from the NSCL or from Firefox / Tor Browser? Steps to reproduce the issue:
first.html
:<html>
<head>
<meta charset="UTF-8">
</head>
<body>
<button onclick="document.createElement('div').appendChild(document.createElement('div'));">
Add something to the DOM
</button>
<br/>
<a href="second.html">second.html</a>
</body>
</html>
second.html
:<html>
<head>
<meta charset="UTF-8">
</head>
<body>
</body>
</html>
Open Tor Browser 11.0.14, based on Mozilla Firefox 91.10.0esr, NoScript version 11.4.6, and set the Tor Browser security level to "Safer". Open the browser console to monitor the issue.
Open first.html
as a local file. Click the button, no issue. Click the link. Go back to the previous page using the browser "left arrow" button. Click the button again, a DOMException
is thrown. The browser console indicates the exception comes from patchWindow.js:299
. Using the browser debugger seems to indicate the initial exception comes from patchWindow.js:285
.
The issue doesn't come up when using Tor Browser security level "Normal".
Hi, thank you for the report and the reduced test case. At first glance, it seems a lifecycle mismatch between the page retrieved from BF Cache and the extension content script. Not your code's fault, anyway. Investigating...
Hello, I've recently made some changes to the script injection machinery recently which are likely to affect this issue. Can you still reproduce on NoScript 11.4.19rc3? Thanks!
I have been seeing this problem in Firefox on Android. On initial load of a Wikipedia page, tapping the article section headers successfully expands/collapses that section of the article. However, if I tap a link within the article to go to a different article, and then I use the Back button to go back to the original article, tapping the article section headers will no longer expand/collapse the section. When I attached Firefox debugging, I see that tapping the section header triggers the same 'TypeError: can't access dead object' error for the 'win' object in the line 'for (let j = 0; j in win; j++)' reported in this issue.
I am on version 11.4.25 of the extension.
On initial load of a Wikipedia page
Thank you very much for this test case. I could reproduce indeed, and I'm investigating it.
First, I apologize as I cannot reproduce consistently the issue and cannot share the code that leads to it (it is from a private website). If this bug report is useless, feel free to close it.
So, this happens on a fairly complex javascript application that manipulates the DOM and uses Web Workers. The browser used is Tor Browser 11.0.14, based on Mozilla Firefox 91.10.0esr, in its default configuration (so, noscript is enabled by default). Sometimes, when using the application, all DOM manipulations seem to stop working, and a page reload is required. Specifically, running:
document.createElement("div").appendChild(document.createElement("div"))
in the browser javascript console throws a DOMException. When catched with a try-catch block, the catched error is
undefined
. Using the browser debugger step by step shows the original exception. On line 285 of the NSCLpatchWindow.js
, this:for (let j = 0; j in win; j++) {
produces this exception:
TypeError: can't access dead object
and indeed,
win
appears asDeadObject
in the browser debugger. See MDN about dead objects:https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Errors/Dead_object
Do you know if the issue might be coming from your software or if I'm looking in the wrong direction?