[Bug]: Firefox — driver crashes with unhandled TypeError when a page error has no `location`

[dimirey]

[Bug]: Firefox — driver process crashes with unhandled TypeError when a page error has no location

Summary

When a page emits an uncaught JS error whose location is undefined, Playwright's
BrowserContextDispatcher dereferences pageError.location.url without a null-check, throwing an
unhandled TypeError inside the Node driver process. This crashes the entire browser server —
it does not surface as a catchable client-side error, and no page.on('pageerror') handler can
intercept it (the crash is upstream of event dispatch). Introduced by #39767 (shipped 1.60.0).

Stack trace

TypeError: Cannot read properties of undefined (reading 'url')
    at FFBrowserContext.<anonymous> (.../playwright/driver/package/lib/coreBundle.js  [BrowserContextDispatcher PageError listener])
    at FFBrowserContext.emit (node:events:509:28)
    at _Page.emitOnContext (.../coreBundle.js)
    at _Page.addPageError (.../coreBundle.js)
    at FFPage._onUncaughtError (.../coreBundle.js)
Node.js v24.17.0

Root cause

packages/playwright-core/src/server/dispatchers/browserContextDispatcher.ts (~L115–128):

this.addObjectListener(BrowserContext.Events.PageError, (pageError: PageError, page: Page) => {
  this._dispatchEvent('pageError', {
    error: serializeError(pageError.error),
    page: PageDispatcher.from(this, page),
    location: {
      url: pageError.location.url,        // <- pageError.location may be undefined
      line: pageError.location.lineNumber,
      column: pageError.location.columnNumber,
    },
  });
});

ffPage._onUncaughtError forwards params.location straight through to page.addPageError, and the
Firefox protocol can deliver an uncaught error with no location. The dispatcher then crashes.

Reproduction

Reliably reproducible with a Firefox build that emits locationless uncaught errors — e.g. the
Camoufox Firefox build — loading a page that throws an uncaught
error with no location (e.g. https://jp.mercari.com/search?keyword=test, which triggers a minified
React #418). Same playwright==1.61.0 with stock playwright-firefox does not crash, because
stock Firefox includes a location — but the dispatcher should never crash the driver process on
absent protocol data regardless of the Firefox build.

Related: downstream tracking in daijro/camoufox#617, worked around in daijro/camoufox#625.

Proposed fix (one line, defensive)

     location: {
-      url: pageError.location.url,
-      line: pageError.location.lineNumber,
-      column: pageError.location.columnNumber,
+      url: pageError.location?.url ?? '',
+      line: pageError.location?.lineNumber ?? 0,
+      column: pageError.location?.columnNumber ?? 0,
     },

Environment

• Playwright: 1.61.0
• Browser: Firefox (Camoufox build v135.0.1-beta.24)
• OS: macOS 15 (Apple Silicon), Node.js v24.17.0

[ATKasem]

I would like to take this one.

I checked current main and the crash path is still present: Firefox forwards params.location from FFPage._onUncaughtError() into Page.addPageError(), and BrowserContextDispatcher later serializes pageError.location.url. The same PageError.location shape is also used by tracing, so I think the cleaner fix is to normalize missing locations at the Page.addPageError() boundary rather than only guard the dispatcher.

Planned fix: use the same empty-location fallback shape Chromium already uses when no stack frame is available ({ url: "", lineNumber: 0, columnNumber: 0 }), plus focused regression coverage for a locationless page error. Could this be assigned to me?