1198308 - crash in mozilla::dom::TabChild::MaybeRequestPreinitCamera()

Status: VERIFIED FIXED

(Core :: Security: CAPS, defect)

Description

[Adam Alldredge [:AdamA][Inactive]]

This bug was filed from the Socorro interface and is 
report bp-01f19352-6e67-44d5-91ee-302992150825.
=============================================================

Description:
When user attempts to to to any website the browser will crash

Repro Steps:
1) Update a Aries to 20150825022022
2) Select Browser
3) Enter text and Search

Actual:
Browser crashes.

Expected:
Browser initiates a successful search.

Environmental Variables:
Device: Aries 2.5 Kk [Full Flahs
BuildID: 20150825022022
Gaia: b441bde54293bea5254dc340845effe951fa3906
Gecko: 04b8c412d9f5
Gonk: 2916e2368074b5383c80bf5a0fba3fc83ba310bd
Version: 43.0a1 (2.5)
Firmware Version: D5803_23.1.A.1.28_NCB.ftf
User Agent: Mozilla/5.0 (Mobile; rv:43.0) Gecko/43.0 Firefox/43.0

User Impact: Unable to search browser as desired.

Repro frequency: 5/5
See attached: Logcat & Video

Comment 1

[Adam Alldredge [:AdamA][Inactive]]

This issue DOES occur on Flame 2.5.

Environmental Variables:
Device: Flame 2.5 [Full Flash]
Build ID: 20150825064342
Gaia: b441bde54293bea5254dc340845effe951fa3906
Gecko: f3df9cd1701f
Gonk: c4779d6da0f85894b1f78f0351b43f2949e8decd
Version: 43.0a1 (2.5)
Firmware Version: v18D
User Agent: Mozilla/5.0 (Mobile; rv:43.0) Gecko/43.0 Firefox/43.0

Result:
The browser crashes.

Comment 2

[Martin Shuman [:Marty]]

This issue appears to be caused by:
Bug 1165272 - unify Get*CodebasePrincipal with createCodebasePrincipal in nsIScriptSecurityManager

Mozilla-Inbound Regression Window:

Last Working 
Environmental Variables:
Device: Flame 2.5
BuildID: 20150824053642
Gaia: d7fb5717d3e0153ac64af2c0d5c11079846d81c3
Gecko: e13c23f424f664651417fffe914efa7348106249
Version: 43.0a1 (2.5)
Firmware Version: v18D
User Agent: Mozilla/5.0 (Mobile; rv:43.0) Gecko/43.0 Firefox/43.0

First Broken 
Environmental Variables:
Device: Flame 2.5
BuildID: 20150824060139
Gaia: d7fb5717d3e0153ac64af2c0d5c11079846d81c3
Gecko: 16327a5d2961773729aca9f1928d6e7d0334e77f
Version: 43.0a1 (2.5)
Firmware Version: v18D
User Agent: Mozilla/5.0 (Mobile; rv:43.0) Gecko/43.0 Firefox/43.0

Last Working gaia / First Broken gecko - Issue DOES reproduce
Gaia: d7fb5717d3e0153ac64af2c0d5c11079846d81c3
Gecko: 16327a5d2961773729aca9f1928d6e7d0334e77f

First Broken gaia / Last Working gecko - Issue does NOT reproduce
Gaia: d7fb5717d3e0153ac64af2c0d5c11079846d81c3
Gecko: e13c23f424f664651417fffe914efa7348106249

Gecko Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=e13c23f424f664651417fffe914efa7348106249&tochange=16327a5d2961773729aca9f1928d6e7d0334e77f

Comment 3

[Jayme Mercado [:JMercado] (Inactive 3/4/2016)]

Yoshi this landing caused a sanity blocker.  Can you please get it backed out?

Comment 4

[Kartikaya Gupta (email:[e-mail])]

Attachment: Backtrace to crash

If it helps here's the backtrace to the crash in question.

Comment 5

[Ryan VanderMeulen [:RyanVM]]

The backout of bug 1165272 has been merged to trunk. The 4pm PT nightlies should contain the fix.
https://hg.mozilla.org/mozilla-central/rev/d09ccffbeb17

Comment 6

[Martin Shuman [:Marty]]

This issue is verified fixed on the latest Spark 2.5 build.
Search can be performed successfully and the search results browser page is brought up properly.

Environmental Variables:
Device: Aries 2.5
BuildID: 20150825221121
Gaia: a8a462ab783a5bbab508d3c29483cff260672e3c
Gecko: c46370eea81a9860ae77d1f0c7776c24e816138e
Gonk: 2916e2368074b5383c80bf5a0fba3fc83ba310bd
Version: 43.0a1 (2.5) 
Firmware Version: D5803_23.1.A.1.28_NCB.ftf
User Agent: Mozilla/5.0 (Mobile; rv:43.0) Gecko/43.0 Firefox/43.0