Assertion failure: win->IsInnerWindow(), at c:\Users\mozilla\debug-builds\mozilla-central\content\base\src\File.cpp:289

RESOLVED FIXED in mozilla35

Status

()

--
critical
RESOLVED FIXED
4 years ago
4 years ago

People

(Reporter: cbook, Assigned: baku)

Tracking

(Blocks: 1 bug, {assertion, regression})

Trunk
mozilla35
x86
Windows 7
assertion, regression
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(2 attachments, 2 obsolete attachments)

(Reporter)

Description

4 years ago
Windows 7 Debug Build from yesterday, will rebuild now 

Steps to reproduce:
-> Login to bugzilla and try to attach a testcase to a bug 
---> Assertion failure

Assertion failure: win->IsInnerWindow(), at c:\Users\mozilla\debug-builds\mozilla-central\content\base\src\File.cpp:289
#01: mozilla::dom::File::CreateFromFile (c:\users\mozilla\debug-builds\mozilla-central\content\base\src\file.cpp:236)
#02: nsBaseFilePicker::GetDomfile (c:\users\mozilla\debug-builds\mozilla-central\widget\xpwidgets\nsbasefilepicker.cpp:321)
#03: mozilla::dom::HTMLInputElement::nsFilePickerShownCallback::Done (c:\users\mozilla\debug-builds\mozilla-central\content\html\content\src\htmlinputelement.cpp:688)
#04: AsyncShowFilePicker::Run (c:\users\mozilla\debug-builds\mozilla-central\widget\xpwidgets\nsbasefilepicker.cpp:64)
#05: nsThread::ProcessNextEvent (c:\users\mozilla\debug-builds\mozilla-central\xpcom\threads\nsthread.cpp:830)
#06: NS_ProcessNextEvent (c:\users\mozilla\debug-builds\mozilla-central\xpcom\glue\nsthreadutils.cpp:265)
#07: mozilla::ipc::MessagePump::Run (c:\users\mozilla\debug-builds\mozilla-central\ipc\glue\messagepump.cpp:99)
#08: MessageLoop::RunInternal (c:\users\mozilla\debug-builds\mozilla-central\ipc\chromium\src\base\message_loop.cc:231)
#09: MessageLoop::RunHandler (c:\users\mozilla\debug-builds\mozilla-central\ipc\chromium\src\base\message_loop.cc:224)
#10: MessageLoop::Run (c:\users\mozilla\debug-builds\mozilla-central\ipc\chromium\src\base\message_loop.cc:198)
#11: nsBaseAppShell::Run (c:\users\mozilla\debug-builds\mozilla-central\widget\xpwidgets\nsbaseappshell.cpp:166)
#12: nsAppShell::Run (c:\users\mozilla\debug-builds\mozilla-central\widget\windows\nsappshell.cpp:178)
#13: nsAppStartup::Run (c:\users\mozilla\debug-builds\mozilla-central\toolkit\components\startup\nsappstartup.cpp:280)
#14: XREMain::XRE_mainRun (c:\users\mozilla\debug-builds\mozilla-central\toolkit\xre\nsapprunner.cpp:4154)
#15: XREMain::XRE_main (c:\users\mozilla\debug-builds\mozilla-central\toolkit\xre\nsapprunner.cpp:4227)
#16: XRE_main (c:\users\mozilla\debug-builds\mozilla-central\toolkit\xre\nsapprunner.cpp:4441)
#17: do_main (c:\users\mozilla\debug-builds\mozilla-central\browser\app\nsbrowserapp.cpp:290)
#18: NS_internal_main (c:\users\mozilla\debug-builds\mozilla-central\browser\app\nsbrowserapp.cpp:655)
#19: wmain (c:\users\mozilla\debug-builds\mozilla-central\toolkit\xre\nswindowswmain.cpp:113)
#20: __tmainCRTStartup (f:\dd\vctools\crt_bld\self_x86\crt\src\crt0.c:240)
#21: BaseThreadInitThunk[kernel32 +0x4ed6c]
#22: RtlInitializeExceptionChain[ntdll +0x6377b]
#23: RtlInitializeExceptionChain[ntdll +0x6374e]
(Reporter)

Comment 1

4 years ago
Created attachment 8503056 [details]
windgb data win 7 trunk debug build
(Reporter)

Comment 2

4 years ago
also reproducible with hg.mozilla.org/mozilla-central/rev/50b689feab5f - 

baku: could you take a look, i guess this is a recent regression, thanks!
Severity: normal → critical
Flags: needinfo?(amarchesini)
Keywords: regression
(Assignee)

Comment 3

4 years ago
Created attachment 8503081 [details] [diff] [review]
crash.patch
Attachment #8503081 - Flags: review?(bzbarsky)
Flags: needinfo?(amarchesini)
(Assignee)

Updated

4 years ago
Assignee: nobody → amarchesini
Hmmm.  This somewhat worries me.  What if the page gets navigated under the filepicker?

Can we fix things so we actually have an inner window here?  At the very least, by grabbing it when the file picker is initialized or something, but better yet by passing an inner window to the filepicker to start with (and getting the outer from that as needed)?
Flags: needinfo?(amarchesini)
(Assignee)

Comment 5

4 years ago
Created attachment 8503131 [details] [diff] [review]
crash.patch

What about this approach? The fact is that, passing a innerWindow means to change all the code where a nsIFilePicker is used. And this could happen in addons as well.

This is the base class for any C++ implementations of the nsIFilePickers.
Probably we could have the same issue in b2g: b2g/components/FilePicker.js
Attachment #8503081 - Attachment is obsolete: true
Attachment #8503081 - Flags: review?(bzbarsky)
Attachment #8503131 - Flags: review?(bzbarsky)
Flags: needinfo?(amarchesini)
Comment on attachment 8503131 [details] [diff] [review]
crash.patch

Ok, yeah.  Looks like mParent is only used for the file creation?

Please document that mParent is an inner window and fix nsFilePickerProxy::Init in the same way.  r=me

Followup bug on adding a test would be good.
Attachment #8503131 - Flags: review?(bzbarsky) → review+
https://hg.mozilla.org/mozilla-central/rev/37dae39533a6
Status: NEW → RESOLVED
Last Resolved: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla35
You need to log in before you can comment on or make changes to this bug.