1081008 - Assertion failure: win->IsInnerWindow(), at c:\Users\mozilla\debug-builds\mozilla-central\content\base\src\File.cpp:289

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Carsten Book [:Tomcat]]

Windows 7 Debug Build from yesterday, will rebuild now 

Steps to reproduce:
-> Login to bugzilla and try to attach a testcase to a bug 
---> Assertion failure

Assertion failure: win->IsInnerWindow(), at c:\Users\mozilla\debug-builds\mozilla-central\content\base\src\File.cpp:289
#01: mozilla::dom::File::CreateFromFile (c:\users\mozilla\debug-builds\mozilla-central\content\base\src\file.cpp:236)
#02: nsBaseFilePicker::GetDomfile (c:\users\mozilla\debug-builds\mozilla-central\widget\xpwidgets\nsbasefilepicker.cpp:321)
#03: mozilla::dom::HTMLInputElement::nsFilePickerShownCallback::Done (c:\users\mozilla\debug-builds\mozilla-central\content\html\content\src\htmlinputelement.cpp:688)
#04: AsyncShowFilePicker::Run (c:\users\mozilla\debug-builds\mozilla-central\widget\xpwidgets\nsbasefilepicker.cpp:64)
#05: nsThread::ProcessNextEvent (c:\users\mozilla\debug-builds\mozilla-central\xpcom\threads\nsthread.cpp:830)
#06: NS_ProcessNextEvent (c:\users\mozilla\debug-builds\mozilla-central\xpcom\glue\nsthreadutils.cpp:265)
#07: mozilla::ipc::MessagePump::Run (c:\users\mozilla\debug-builds\mozilla-central\ipc\glue\messagepump.cpp:99)
#08: MessageLoop::RunInternal (c:\users\mozilla\debug-builds\mozilla-central\ipc\chromium\src\base\message_loop.cc:231)
#09: MessageLoop::RunHandler (c:\users\mozilla\debug-builds\mozilla-central\ipc\chromium\src\base\message_loop.cc:224)
#10: MessageLoop::Run (c:\users\mozilla\debug-builds\mozilla-central\ipc\chromium\src\base\message_loop.cc:198)
#11: nsBaseAppShell::Run (c:\users\mozilla\debug-builds\mozilla-central\widget\xpwidgets\nsbaseappshell.cpp:166)
#12: nsAppShell::Run (c:\users\mozilla\debug-builds\mozilla-central\widget\windows\nsappshell.cpp:178)
#13: nsAppStartup::Run (c:\users\mozilla\debug-builds\mozilla-central\toolkit\components\startup\nsappstartup.cpp:280)
#14: XREMain::XRE_mainRun (c:\users\mozilla\debug-builds\mozilla-central\toolkit\xre\nsapprunner.cpp:4154)
#15: XREMain::XRE_main (c:\users\mozilla\debug-builds\mozilla-central\toolkit\xre\nsapprunner.cpp:4227)
#16: XRE_main (c:\users\mozilla\debug-builds\mozilla-central\toolkit\xre\nsapprunner.cpp:4441)
#17: do_main (c:\users\mozilla\debug-builds\mozilla-central\browser\app\nsbrowserapp.cpp:290)
#18: NS_internal_main (c:\users\mozilla\debug-builds\mozilla-central\browser\app\nsbrowserapp.cpp:655)
#19: wmain (c:\users\mozilla\debug-builds\mozilla-central\toolkit\xre\nswindowswmain.cpp:113)
#20: __tmainCRTStartup (f:\dd\vctools\crt_bld\self_x86\crt\src\crt0.c:240)
#21: BaseThreadInitThunk[kernel32 +0x4ed6c]
#22: RtlInitializeExceptionChain[ntdll +0x6377b]
#23: RtlInitializeExceptionChain[ntdll +0x6374e]

Comment 1

[Carsten Book [:Tomcat]]

Attachment: windgb data win 7 trunk debug build

Comment 2

[Carsten Book [:Tomcat]]

also reproducible with hg.mozilla.org/mozilla-central/rev/50b689feab5f - 

baku: could you take a look, i guess this is a recent regression, thanks!

Comment 3

[Andrea Marchesini [:baku]]

Attachment: crash.patch

Comment 4

[Boris Zbarsky [:bzbarsky]]

Hmmm.  This somewhat worries me.  What if the page gets navigated under the filepicker?

Can we fix things so we actually have an inner window here?  At the very least, by grabbing it when the file picker is initialized or something, but better yet by passing an inner window to the filepicker to start with (and getting the outer from that as needed)?

Comment 5

[Andrea Marchesini [:baku]]

Attachment: crash.patch

What about this approach? The fact is that, passing a innerWindow means to change all the code where a nsIFilePicker is used. And this could happen in addons as well.

This is the base class for any C++ implementations of the nsIFilePickers.
Probably we could have the same issue in b2g: b2g/components/FilePicker.js

Comment 6

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 8503131 [details] [diff] [review]
crash.patch

Ok, yeah.  Looks like mParent is only used for the file creation?

Please document that mParent is an inner window and fix nsFilePickerProxy::Init in the same way.  r=me

Followup bug on adding a test would be good.

Comment 7

[Andrea Marchesini [:baku]]

Attachment: crash.patch

Pushed to try: https://treeherder.mozilla.org/ui/#/jobs?repo=try&revision=aef5f56c2880

Comment 8

[Andrea Marchesini [:baku]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/37dae39533a6

Comment 9

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/37dae39533a6