Bug 1666843 Comment 8 Edit History

Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.

It seems the issue happens when focus is in OOP iframe and the process of parent window won't clear `mFocusedWindow` when blur, looks like a bug?

Waht the test does is to create a new tab that loads a page contains an OOP iframe, and sythesizes a mouse down event to the OOP iframe, so the focus moves to OOP iframe and then preform some pointer lock test. After finish, test will [remove the new created tab](https://searchfox.org/mozilla-central/rev/222e4f64b769413ac1a1991d2397b13a0acb5d9d/dom/tests/browser/browser_pointerlock_warning.js#70), then [tabbrowser try to blur current focued XULFrame first](https://searchfox.org/mozilla-central/rev/222e4f64b769413ac1a1991d2397b13a0acb5d9d/browser/base/content/tabbrowser.js#1265) which trigger [sending a Deactivate IPC to the process of test page and also the process of OOP iframe](https://searchfox.org/mozilla-central/rev/222e4f64b769413ac1a1991d2397b13a0acb5d9d/dom/base/nsFocusManager.cpp#2242).

When process of test page receive Deactivate IPC,  it try to [lower the window](https://searchfox.org/mozilla-central/rev/222e4f64b769413ac1a1991d2397b13a0acb5d9d/toolkit/components/browser/nsWebBrowser.cpp#1216) which calls [nsFocusManager::Blur](https://searchfox.org/mozilla-central/rev/222e4f64b769413ac1a1991d2397b13a0acb5d9d/dom/base/nsFocusManager.cpp#859), but doesn't run the [blur steps](https://searchfox.org/mozilla-central/rev/222e4f64b769413ac1a1991d2397b13a0acb5d9d/dom/base/nsFocusManager.cpp#2064-2080) given the `mFocusedBrowsingContextInContent` is the OOP iframe one, not an in-process bc. So mFocusedWindow won't be cleared. Is this intentional?

Furthermore, process of test page receives Destroy IPC later soon while tab is really being removed, which is from https://searchfox.org/mozilla-central/rev/222e4f64b769413ac1a1991d2397b13a0acb5d9d/dom/ipc/BrowserParent.cpp#616 due to https://searchfox.org/mozilla-central/rev/222e4f64b769413ac1a1991d2397b13a0acb5d9d/browser/base/content/tabbrowser.js#3703, but mFocusedWindow still won't be cleared.

Most of case, we don't get leak is because focus moves to in-process about:blank and make the mFocusedWindow could be cleared properly. But if that does not happen, then we get a leaked window. Henri, do you have any ideas about what should we do for this? Thanks!
It seems the issue happens when focus is in OOP iframe and the process of parent window won't clear `mFocusedWindow` when blur, looks like a bug?

What the test does is to create a new tab that loads a page contains an OOP iframe, and sythesizes a mouse down event to the OOP iframe, so the focus moves to OOP iframe and then preform some pointer lock test. After finish, test will [remove the new created tab](https://searchfox.org/mozilla-central/rev/222e4f64b769413ac1a1991d2397b13a0acb5d9d/dom/tests/browser/browser_pointerlock_warning.js#70), then [tabbrowser try to blur current focued XULFrame first](https://searchfox.org/mozilla-central/rev/222e4f64b769413ac1a1991d2397b13a0acb5d9d/browser/base/content/tabbrowser.js#1265) which trigger [sending a Deactivate IPC to the process of test page and also the process of OOP iframe](https://searchfox.org/mozilla-central/rev/222e4f64b769413ac1a1991d2397b13a0acb5d9d/dom/base/nsFocusManager.cpp#2242).

When process of test page receive Deactivate IPC,  it try to [lower the window](https://searchfox.org/mozilla-central/rev/222e4f64b769413ac1a1991d2397b13a0acb5d9d/toolkit/components/browser/nsWebBrowser.cpp#1216) which calls [nsFocusManager::Blur](https://searchfox.org/mozilla-central/rev/222e4f64b769413ac1a1991d2397b13a0acb5d9d/dom/base/nsFocusManager.cpp#859), but doesn't run the [blur steps](https://searchfox.org/mozilla-central/rev/222e4f64b769413ac1a1991d2397b13a0acb5d9d/dom/base/nsFocusManager.cpp#2064-2080) given the `mFocusedBrowsingContextInContent` is the OOP iframe one, not an in-process bc. So mFocusedWindow won't be cleared. Is this intentional?

Furthermore, process of test page receives Destroy IPC later soon while tab is really being removed, which is from https://searchfox.org/mozilla-central/rev/222e4f64b769413ac1a1991d2397b13a0acb5d9d/dom/ipc/BrowserParent.cpp#616 due to https://searchfox.org/mozilla-central/rev/222e4f64b769413ac1a1991d2397b13a0acb5d9d/browser/base/content/tabbrowser.js#3703, but mFocusedWindow still won't be cleared.

Most of case, we don't get leak is because focus moves to in-process about:blank and make the mFocusedWindow could be cleared properly. But if that does not happen, then we get a leaked window. Henri, do you have any ideas about what should we do for this? Thanks!

Back to Bug 1666843 Comment 8