Closed Bug 1081008 Opened 5 years ago Closed 5 years ago

Assertion failure: win->IsInnerWindow(), at c:\Users\mozilla\debug-builds\mozilla-central\content\base\src\File.cpp:289

Categories

(Core :: DOM: Core & HTML, defect, critical)

x86
Windows 7
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla35

People

(Reporter: cbook, Assigned: baku)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, regression)

Attachments

(2 files, 2 obsolete files)

Windows 7 Debug Build from yesterday, will rebuild now 

Steps to reproduce:
-> Login to bugzilla and try to attach a testcase to a bug 
---> Assertion failure

Assertion failure: win->IsInnerWindow(), at c:\Users\mozilla\debug-builds\mozilla-central\content\base\src\File.cpp:289
#01: mozilla::dom::File::CreateFromFile (c:\users\mozilla\debug-builds\mozilla-central\content\base\src\file.cpp:236)
#02: nsBaseFilePicker::GetDomfile (c:\users\mozilla\debug-builds\mozilla-central\widget\xpwidgets\nsbasefilepicker.cpp:321)
#03: mozilla::dom::HTMLInputElement::nsFilePickerShownCallback::Done (c:\users\mozilla\debug-builds\mozilla-central\content\html\content\src\htmlinputelement.cpp:688)
#04: AsyncShowFilePicker::Run (c:\users\mozilla\debug-builds\mozilla-central\widget\xpwidgets\nsbasefilepicker.cpp:64)
#05: nsThread::ProcessNextEvent (c:\users\mozilla\debug-builds\mozilla-central\xpcom\threads\nsthread.cpp:830)
#06: NS_ProcessNextEvent (c:\users\mozilla\debug-builds\mozilla-central\xpcom\glue\nsthreadutils.cpp:265)
#07: mozilla::ipc::MessagePump::Run (c:\users\mozilla\debug-builds\mozilla-central\ipc\glue\messagepump.cpp:99)
#08: MessageLoop::RunInternal (c:\users\mozilla\debug-builds\mozilla-central\ipc\chromium\src\base\message_loop.cc:231)
#09: MessageLoop::RunHandler (c:\users\mozilla\debug-builds\mozilla-central\ipc\chromium\src\base\message_loop.cc:224)
#10: MessageLoop::Run (c:\users\mozilla\debug-builds\mozilla-central\ipc\chromium\src\base\message_loop.cc:198)
#11: nsBaseAppShell::Run (c:\users\mozilla\debug-builds\mozilla-central\widget\xpwidgets\nsbaseappshell.cpp:166)
#12: nsAppShell::Run (c:\users\mozilla\debug-builds\mozilla-central\widget\windows\nsappshell.cpp:178)
#13: nsAppStartup::Run (c:\users\mozilla\debug-builds\mozilla-central\toolkit\components\startup\nsappstartup.cpp:280)
#14: XREMain::XRE_mainRun (c:\users\mozilla\debug-builds\mozilla-central\toolkit\xre\nsapprunner.cpp:4154)
#15: XREMain::XRE_main (c:\users\mozilla\debug-builds\mozilla-central\toolkit\xre\nsapprunner.cpp:4227)
#16: XRE_main (c:\users\mozilla\debug-builds\mozilla-central\toolkit\xre\nsapprunner.cpp:4441)
#17: do_main (c:\users\mozilla\debug-builds\mozilla-central\browser\app\nsbrowserapp.cpp:290)
#18: NS_internal_main (c:\users\mozilla\debug-builds\mozilla-central\browser\app\nsbrowserapp.cpp:655)
#19: wmain (c:\users\mozilla\debug-builds\mozilla-central\toolkit\xre\nswindowswmain.cpp:113)
#20: __tmainCRTStartup (f:\dd\vctools\crt_bld\self_x86\crt\src\crt0.c:240)
#21: BaseThreadInitThunk[kernel32 +0x4ed6c]
#22: RtlInitializeExceptionChain[ntdll +0x6377b]
#23: RtlInitializeExceptionChain[ntdll +0x6374e]
also reproducible with hg.mozilla.org/mozilla-central/rev/50b689feab5f - 

baku: could you take a look, i guess this is a recent regression, thanks!
Severity: normal → critical
Flags: needinfo?(amarchesini)
Keywords: regression
Attached patch crash.patch (obsolete) — Splinter Review
Attachment #8503081 - Flags: review?(bzbarsky)
Flags: needinfo?(amarchesini)
Assignee: nobody → amarchesini
Hmmm.  This somewhat worries me.  What if the page gets navigated under the filepicker?

Can we fix things so we actually have an inner window here?  At the very least, by grabbing it when the file picker is initialized or something, but better yet by passing an inner window to the filepicker to start with (and getting the outer from that as needed)?
Flags: needinfo?(amarchesini)
Attached patch crash.patch (obsolete) — Splinter Review
What about this approach? The fact is that, passing a innerWindow means to change all the code where a nsIFilePicker is used. And this could happen in addons as well.

This is the base class for any C++ implementations of the nsIFilePickers.
Probably we could have the same issue in b2g: b2g/components/FilePicker.js
Attachment #8503081 - Attachment is obsolete: true
Attachment #8503081 - Flags: review?(bzbarsky)
Attachment #8503131 - Flags: review?(bzbarsky)
Flags: needinfo?(amarchesini)
Comment on attachment 8503131 [details] [diff] [review]
crash.patch

Ok, yeah.  Looks like mParent is only used for the file creation?

Please document that mParent is an inner window and fix nsFilePickerProxy::Init in the same way.  r=me

Followup bug on adding a test would be good.
Attachment #8503131 - Flags: review?(bzbarsky) → review+
https://hg.mozilla.org/mozilla-central/rev/37dae39533a6
Status: NEW → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla35
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.