Bug 1955324 Comment 7 Edit History

Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.

There's a similar problem in `browser_extension_migration.js` where we click an `about:blank` link in a chrome docshell. This causes us to fail
```
MOZ_ASSERT_IF(
      isAboutBlankLoadOntoInitialAboutBlank && inheritPrincipal,
      aLoadState->PrincipalToInherit()->Equals(GetDocument()->GetPrincipal()) ||
          (aLoadState->PrincipalToInherit()->GetIsNullPrincipal() &&
           GetDocument()->GetPrincipal()->GetIsNullPrincipal()));
```
as the document will have a null principal due to the code in `MaybeCreateDocShell()` while `aLoadState->PrincipalToInherit()` will be the node principal, which is a system principal.
There's a similar problem in `browser_extension_migration.js` where we click an `about:blank` link in a chrome docshell. This causes us to fail
```
MOZ_ASSERT_IF(
      isAboutBlankLoadOntoInitialAboutBlank && inheritPrincipal,
      aLoadState->PrincipalToInherit()->Equals(GetDocument()->GetPrincipal()) ||
          (aLoadState->PrincipalToInherit()->GetIsNullPrincipal() &&
           GetDocument()->GetPrincipal()->GetIsNullPrincipal()));
```
as the document will have a null principal due to the code in `MaybeCreateDocShell()` while `aLoadState->PrincipalToInherit()` will be the node principal, which is a system principal.

Minimal test case:
```
const CHROME_URI = "chrome://global/content/aboutSupport.xhtml";

add_task(async function test_chrome_blank_link() {
  // open a tab with system principal due to chrome URI
  let tab = await BrowserTestUtils.openNewForegroundTab(gBrowser, CHROME_URI);
  let browser = tab.linkedBrowser;

  const linkOpened = BrowserTestUtils.waitForNewTab(gBrowser, "about:blank");

  await SpecialPowers.spawn(browser, [], async () => {
    let bc = content.browsingContext;
    let contentPrincipal = content.document.nodePrincipal;
    Assert.ok(contentPrincipal.isSystemPrincipal, "tab has system principal");
    Assert.ok(bc.isContent, "tab BC is content");

    // within a system context, add an about:blank link
    let link = content.document.createElement("a");
    link.href = "about:blank";
    link.target = "_blank";
    content.document.documentElement.appendChild(link);
    link.click();
  });

  const blanktab = await linkOpened;

  Assert.ok(true, "did not crash from assertion failure");

  BrowserTestUtils.removeTab(blanktab);
  BrowserTestUtils.removeTab(tab);
});
```

Back to Bug 1955324 Comment 7