I recently landed broken JS in an onfoo inline event handler attribute. We should catch that type of mistake, like we do in HTML.

I'm deliberately proposing a pretty rudimentary patch. It solves some of the more annoying problems (like preprocessing) but doesn't address inline <script>s, and just turns off no-undef for XUL files to avoid having to do global processing. If we want to fix either of those things we can do so in follow-ups, I think.

This generally works OK, and found a few minor issues. I also verified it correctly flagged up the issue from bug 1536514 if reintroduced. The main issue I'm aware of is that we have no column information, and line information is restricted to the closing '>' of the node in which an attribute occurs (which can be confusing if the attribute is not on that line). Unfortunately, it doesn't seem like sax.js provides the information we need to do better here.

I also have to admit that although line numbers are correct in every other file I've tried, in browser.xul they seem to be slightly off in some cases. I haven't been able to figure out why exactly (possibly something to do with the gazillion (and nested) includes), but IMO that doesn't need to block this landing given that, when modifying code, it should be fairly obvious where any new issues are anyway.

Depends on D24297

https://hg.mozilla.org/mozilla-central/rev/f88912387010
https://hg.mozilla.org/mozilla-central/rev/3bf1176d151b