Closed Bug 1320041 Opened 3 years ago Closed 3 years ago

assertion failure triggers null pointer deref and segfault in nsDocShell::CopyFavicon (nsDocShell.cpp:9560)

Categories

(Core :: DOM: Navigation, defect, critical)

53 Branch
defect
Not set
critical

Tracking

()

VERIFIED FIXED
Tracking Status
firefox50 --- unaffected
firefox51 --- unaffected
firefox52 --- unaffected
firefox53 + fixed

People

(Reporter: geeknik, Unassigned)

References

(Blocks 1 open bug)

Details

(4 keywords, Whiteboard: [userContextId][domsecurity-backlog])

Crash Data

Attachments

(1 file)

Found while fuzzing Nightly ASAN build ID 20161123153929.

STR:
1) Load about:debugging
2) Check Enable add-on debugging
3) Click Load Temporary Addon and choose ANY file (doesn't need to be a valid addon)
4) Try to click on Tabs or Workers in the about:debugging window and Firefox crashes.

Assertion failure: (BasePrincipal::Cast(aLoadingPrincipal)->OriginAttributesRef().mPrivateBrowsingId > 0) == aInPrivateBrowsing, at /home/worker/workspace/build/src/docshell/base/nsDocShell.cpp:9561
#01: ???[/home/geeknik/firefox/libxul.so +0x98f8eb5]
#02: ???[/home/geeknik/firefox/libxul.so +0x4a064b6]
#03: ???[/home/geeknik/firefox/libxul.so +0x4a0789c]
#04: ???[/home/geeknik/firefox/libxul.so +0x65c588d]
#05: ???[/home/geeknik/firefox/libxul.so +0x65e0374]
#06: ???[/home/geeknik/firefox/libxul.so +0xc960e1d]
#07: ???[/home/geeknik/firefox/libxul.so +0xc963139]
#08: ???[/home/geeknik/firefox/libxul.so +0xc6739c0]
#09: ???[/home/geeknik/firefox/libxul.so +0x65ea506]
#10: ???[/home/geeknik/firefox/libxul.so +0xc69ff72]
#11: ???[/home/geeknik/firefox/libxul.so +0xc58ab3b]
#12: ???[/home/geeknik/firefox/libxul.so +0xc6c34e6]
#13: ???[/home/geeknik/firefox/libxul.so +0xc679e76]
#14: ???[/home/geeknik/firefox/libxul.so +0xc69ff72]
#15: ???[/home/geeknik/firefox/libxul.so +0xc58ab3b]
#16: ???[/home/geeknik/firefox/libxul.so +0xc939c00]
#17: ???[/home/geeknik/firefox/libxul.so +0xc925ff7]
#18: ???[/home/geeknik/firefox/libxul.so +0xc961635]
#19: ???[/home/geeknik/firefox/libxul.so +0xd19a0ff]
#20: ??? (???:???)
ASAN:DEADLYSIGNAL
=================================================================
==103076==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fad648dd978 bp 0x7fff0da51370 sp 0x7fff0da51060 T0)
    #0 0x7fad648dd977 in nsDocShell::CopyFavicon(nsIURI*, nsIURI*, nsIPrincipal*, bool) /home/worker/workspace/build/src/docshell/base/nsDocShell.cpp:9560:3
    #1 0x7fad6487a31c in nsDocShell::InternalLoad(nsIURI*, nsIURI*, bool, nsIURI*, unsigned int, nsIPrincipal*, nsIPrincipal*, unsigned int, nsAString_internal const&, char const*, nsAString_internal const&, nsIInputStream*, nsIInputStream*, unsigned int, nsISHEntry*, bool, nsAString_internal const&, nsIDocShell*, nsIURI*, nsIDocShell**, nsIRequest**) /home/worker/workspace/build/src/docshell/base/nsDocShell.cpp:10438:7
    #2 0x7fad64872eb4 in nsDocShell::LoadURI(nsIURI*, nsIDocShellLoadInfo*, unsigned int, bool) /home/worker/workspace/build/src/docshell/base/nsDocShell.cpp:1558:10
    #3 0x7fad5f9804b5 in mozilla::dom::Location::SetURI(nsIURI*, bool) /home/worker/workspace/build/src/dom/base/Location.cpp:288:12
    #4 0x7fad5f98189b in mozilla::dom::Location::SetHash(nsAString_internal const&) /home/worker/workspace/build/src/dom/base/Location.cpp:367:10
    #5 0x7fad6153f88c in SetHash /home/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/Location.h:209:14
    #6 0x7fad6153f88c in mozilla::dom::LocationBinding::set_hash(JSContext*, JS::Handle<JSObject*>, mozilla::dom::Location*, JSJitSetterCallArgs) /home/worker/workspace/build/src/obj-firefox/dom/bindings/LocationBinding.cpp:703
    #7 0x7fad6155a373 in mozilla::dom::GenericBindingSetter(JSContext*, unsigned int, JS::Value*) /home/worker/workspace/build/src/dom/bindings/BindingUtils.cpp:2847:8
    #8 0x7fad678dae1c in CallJSNative /home/worker/workspace/build/src/js/src/jscntxtinlines.h:239:15
    #9 0x7fad678dae1c in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:447
    #10 0x7fad678dd138 in Call /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:523:10
    #11 0x7fad678dd138 in js::CallSetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<JS::Value>) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:650
    #12 0x7fad675ed9bf in js::SetPropertyIgnoringNamedGetter(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<JS::PropertyDescriptor>, JS::ObjectOpResult&) /home/worker/workspace/build/src/js/src/proxy/BaseProxyHandler.cpp:245:10
    #13 0x7fad61564505 in mozilla::dom::DOMProxyHandler::set(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) const /home/worker/workspace/build/src/dom/bindings/DOMJSProxyHandler.cpp:258:10
    #14 0x7fad67619f71 in js::Proxy::set(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) /home/worker/workspace/build/src/js/src/proxy/Proxy.cpp:333:12
    #15 0x7fad67504b3a in JSObject::nonNativeSetProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) /home/worker/workspace/build/src/js/src/jsobj.cpp:1022:12
    #16 0x7fad6763d4e5 in SetProperty /home/worker/workspace/build/src/js/src/vm/NativeObject.h:1539:16
    #17 0x7fad6763d4e5 in js::Wrapper::set(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) const /home/worker/workspace/build/src/js/src/proxy/Wrapper.cpp:152
    #18 0x7fad675f3e75 in js::CrossCompartmentWrapper::set(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) const /home/worker/workspace/build/src/js/src/proxy/CrossCompartmentWrapper.cpp:221:5
    #19 0x7fad67619f71 in js::Proxy::set(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) /home/worker/workspace/build/src/js/src/proxy/Proxy.cpp:333:12
    #20 0x7fad67504b3a in JSObject::nonNativeSetProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) /home/worker/workspace/build/src/js/src/jsobj.cpp:1022:12
    #21 0x7fad678b3bff in SetProperty /home/worker/workspace/build/src/js/src/vm/NativeObject.h:1539:16
    #22 0x7fad678b3bff in SetPropertyOperation /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:259
    #23 0x7fad678b3bff in Interpret(JSContext*, js::RunState&) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:2715
    #24 0x7fad6789fff6 in js::RunScript(JSContext*, js::RunState&) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:405:12
    #25 0x7fad678db634 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:477:15
    #26 0x7fad681140fe in js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICCall_Fallback*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /home/worker/workspace/build/src/js/src/jit/BaselineIC.cpp:6012:14
    #27 0x7fad4e6faa95  (<unknown module>)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/worker/workspace/build/src/docshell/base/nsDocShell.cpp:9560:3 in nsDocShell::CopyFavicon(nsIURI*, nsIURI*, nsIPrincipal*, bool)
==103076==ABORTING
[Child 103117] ###!!! ABORT: Aborting on channel error.: file /home/worker/workspace/build/src/ipc/glue/MessageChannel.cpp, line 2155
[Child 103117] ###!!! ABORT: Aborting on channel error.: file /home/worker/workspace/build/src/ipc/glue/MessageChannel.cpp, line 2155
ASAN:DEADLYSIGNAL
=================================================================
==103117==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x0000004e114b bp 0x7f0918968090 sp 0x7f0918968080 T2)
Crash Annotation GraphicsCriticalError: |[C0][GFX1-]: Receive IPC close with reason=AbnormalShutdown (t=408.729)     #0 0x4e114a in mozalloc_abort(char const*) /home/worker/workspace/build/src/memory/mozalloc/mozalloc_abort.cpp:33:5
    #1 0x7f091b521105 in Abort(char const*) /home/worker/workspace/build/src/xpcom/base/nsDebugImpl.cpp:449:3
    #2 0x7f091b520eac in NS_DebugBreak /home/worker/workspace/build/src/xpcom/base/nsDebugImpl.cpp:405:7
    #3 0x7f091c484f9f in mozilla::ipc::MessageChannel::OnChannelErrorFromLink() /home/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:2155:13
    #4 0x7f091c48a243 in OnChannelError /home/worker/workspace/build/src/ipc/glue/MessageLink.cpp:367:5
    #5 0x7f091c48a243 in non-virtual thunk to mozilla::ipc::ProcessLink::OnChannelError() /home/worker/workspace/build/src/ipc/glue/MessageLink.cpp:359
    #6 0x7f091c44032b in event_process_active_single_queue /home/worker/workspace/build/src/ipc/chromium/src/third_party/libevent/event.c:1350:4
    #7 0x7f091c44032b in event_process_active /home/worker/workspace/build/src/ipc/chromium/src/third_party/libevent/event.c:1420
    #8 0x7f091c44032b in event_base_loop /home/worker/workspace/build/src/ipc/chromium/src/third_party/libevent/event.c:1621
    #9 0x7f091c3ff7c1 in base::MessagePumpLibevent::Run(base::MessagePump::Delegate*) /home/worker/workspace/build/src/ipc/chromium/src/base/message_pump_libevent.cc:372:7
    #10 0x7f091c3f9c28 in RunInternal /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:232:3
    #11 0x7f091c3f9c28 in RunHandler /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:225
    #12 0x7f091c3f9c28 in MessageLoop::Run() /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:205
    #13 0x7f091c419dd1 in base::Thread::ThreadMain() /home/worker/workspace/build/src/ipc/chromium/src/base/thread.cc:180:3
    #14 0x7f091c41a92c in ThreadFunc(void*) /home/worker/workspace/build/src/ipc/chromium/src/base/platform_thread_posix.cc:38:3
    #15 0x7f0935ea70a3 in start_thread /build/glibc-daoqzt/glibc-2.19/nptl/pthread_create.c:309
    #16 0x7f0934fae62c in clone /build/glibc-daoqzt/glibc-2.19/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:111

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/worker/workspace/build/src/memory/mozalloc/mozalloc_abort.cpp:33:5 in mozalloc_abort(char const*)
Thread T2 (Chrome_ChildThr) created by T0 (Web Content) here:
    #0 0x49a869 in __interceptor_pthread_create /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:238:3
    #1 0x7f091c4199eb in CreateThread /home/worker/workspace/build/src/ipc/chromium/src/base/platform_thread_posix.cc:137:14
    #2 0x7f091c4199eb in Create /home/worker/workspace/build/src/ipc/chromium/src/base/platform_thread_posix.cc:148
    #3 0x7f091c4199eb in base::Thread::StartWithOptions(base::Thread::Options const&) /home/worker/workspace/build/src/ipc/chromium/src/base/thread.cc:98
    #4 0x7f091c48c427 in mozilla::ipc::ProcessChild::ProcessChild(int) /home/worker/workspace/build/src/ipc/glue/ProcessChild.cpp:24:5
    #5 0x7f0923c0b5fb in ContentProcess /home/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/ContentProcess.h:31:7
    #6 0x7f0923c0b5fb in XRE_InitChildProcess /home/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:660
    #7 0x4dfb5b in content_process_main /home/worker/workspace/build/src/browser/app/../../ipc/contentproc/plugin-container.cpp:115:19
    #8 0x4dfb5b in main /home/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:438
    #9 0x7f0934ee7b44 in __libc_start_main /build/glibc-daoqzt/glibc-2.19/csu/libc-start.c:287

==103117==ABORTING

real	0m22.949s
user	0m15.440s
sys	0m6.096s
Another STR:

1) Load clean profile
2) Set Preferences->Privacy->Never Save History
3) Restart Nightly
4) Click Preferences->Privacy
5) Crash


Assertion failure: (BasePrincipal::Cast(aLoadingPrincipal)->OriginAttributesRef().mPrivateBrowsingId > 0) == aInPrivateBrowsing, at /home/worker/workspace/build/src/docshell/base/nsDocShell.cpp:9561
#01: ???[/home/geeknik/firefox/libxul.so +0x99010b5]
#02: ???[/home/geeknik/firefox/libxul.so +0x4a15ab6]
#03: ???[/home/geeknik/firefox/libxul.so +0x4a16e9c]
#04: ???[/home/geeknik/firefox/libxul.so +0x65b70dd]
#05: ???[/home/geeknik/firefox/libxul.so +0x65d1bc4]
#06: ???[/home/geeknik/firefox/libxul.so +0xc971bed]
#07: ???[/home/geeknik/firefox/libxul.so +0xc973f09]
#08: ???[/home/geeknik/firefox/libxul.so +0xc6834c0]
#09: ???[/home/geeknik/firefox/libxul.so +0x65dbd56]
#10: ???[/home/geeknik/firefox/libxul.so +0xc6afae2]
#11: ???[/home/geeknik/firefox/libxul.so +0xc598dbb]
#12: ???[/home/geeknik/firefox/libxul.so +0xc94a9d0]
#13: ???[/home/geeknik/firefox/libxul.so +0xc936dc7]
#14: ???[/home/geeknik/firefox/libxul.so +0xc972405]
#15: ???[/home/geeknik/firefox/libxul.so +0xc972e73]
#16: ???[/home/geeknik/firefox/libxul.so +0xc44c35e]
#17: ???[/home/geeknik/firefox/libxul.so +0x5fe7c8d]
#18: ???[/home/geeknik/firefox/libxul.so +0x69f8183]
#19: ???[/home/geeknik/firefox/libxul.so +0x69f9bed]
#20: ???[/home/geeknik/firefox/libxul.so +0x69e4264]
#21: ???[/home/geeknik/firefox/libxul.so +0x69e7bc5]
#22: ???[/home/geeknik/firefox/libxul.so +0x69e9ef8]
#23: ???[/home/geeknik/firefox/libxul.so +0x4c97df2]
#24: ???[/home/geeknik/firefox/libxul.so +0x6a0528f]
#25: ???[/home/geeknik/firefox/libxul.so +0x60c9003]
#26: ???[/home/geeknik/firefox/libxul.so +0x60c643d]
#27: ???[/home/geeknik/firefox/libxul.so +0xc971bed]
#28: ???[/home/geeknik/firefox/libxul.so +0xc951cee]
#29: ???[/home/geeknik/firefox/libxul.so +0xc936dc7]
#30: ???[/home/geeknik/firefox/libxul.so +0xc972405]
#31: ???[/home/geeknik/firefox/libxul.so +0xc972e73]
#32: ???[/home/geeknik/firefox/libxul.so +0xc44c35e]
#33: ???[/home/geeknik/firefox/libxul.so +0x5fe4650]
#34: ???[/home/geeknik/firefox/libxul.so +0x6a2e5e2]
#35: ???[/home/geeknik/firefox/libxul.so +0x7e6e12d]
#36: ???[/home/geeknik/firefox/libxul.so +0x7e6cad2]
#37: ???[/home/geeknik/firefox/libxul.so +0x69f81ce]
#38: ???[/home/geeknik/firefox/libxul.so +0x69f9bed]
#39: ???[/home/geeknik/firefox/libxul.so +0x69e457e]
#40: ???[/home/geeknik/firefox/libxul.so +0x69e7bc5]
#41: ???[/home/geeknik/firefox/libxul.so +0x8b59d01]
#42: ???[/home/geeknik/firefox/libxul.so +0x8b56571]
#43: ???[/home/geeknik/firefox/libxul.so +0x8b57957]
#44: ???[/home/geeknik/firefox/libxul.so +0x8b5331e]
#45: ???[/home/geeknik/firefox/libxul.so +0x823c320]
#46: ???[/home/geeknik/firefox/libxul.so +0x8234089]
#47: ???[/home/geeknik/firefox/libxul.so +0x82f4129]
#48: ???[/home/geeknik/firefox/libxul.so +0x824fe91]
#49: ???[/home/geeknik/firefox/libxul.so +0x8250bc1]
#50: ???[/home/geeknik/firefox/libxul.so +0x8309de5]
#51: ???[/home/geeknik/firefox/libxul.so +0x831977d]
#52: ???[/usr/lib/x86_64-linux-gnu/libgtk-3.so.0 +0x1ed34d]
#53: g_closure_invoke[/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0 +0x10245]
#54: ???[/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0 +0x21f6c]
#55: g_signal_emit_valist[/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0 +0x2a285]
#56: g_signal_emit[/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0 +0x2a9df]
#57: ???[/usr/lib/x86_64-linux-gnu/libgtk-3.so.0 +0x31de34]
#58: ???[/usr/lib/x86_64-linux-gnu/libgtk-3.so.0 +0x33c8db]
#59: gtk_main_do_event[/usr/lib/x86_64-linux-gnu/libgtk-3.so.0 +0x1ec518]
#60: ???[/usr/lib/x86_64-linux-gnu/libgdk-3.so.0 +0x4fb72]
#61: g_main_context_dispatch[/lib/x86_64-linux-gnu/libglib-2.0.so.0 +0x49c5d]
#62: ???[/lib/x86_64-linux-gnu/libglib-2.0.so.0 +0x49f48]
#63: g_main_context_iteration[/lib/x86_64-linux-gnu/libglib-2.0.so.0 +0x49ffc]
#64: ???[/home/geeknik/firefox/libxul.so +0x83579ff]
#65: ???[/home/geeknik/firefox/libxul.so +0x82b81f9]
#66: ???[/home/geeknik/firefox/libxul.so +0x82b8860]
#67: ???[/home/geeknik/firefox/libxul.so +0x1f0870b]
#68: ???[/home/geeknik/firefox/libxul.so +0x1f8bb5d]
#69: ???[/home/geeknik/firefox/libxul.so +0x2d272d5]
#70: ???[/home/geeknik/firefox/libxul.so +0x2c96679]
#71: ???[/home/geeknik/firefox/libxul.so +0x82b7630]
#72: ???[/home/geeknik/firefox/libxul.so +0xa3183a2]
#73: ???[/home/geeknik/firefox/libxul.so +0xa4a709f]
#74: ???[/home/geeknik/firefox/libxul.so +0xa4a85b3]
#75: XRE_main[/home/geeknik/firefox/libxul.so +0xa4a946d]
#76: ???[./firefox +0xdf8cb]
#77: __libc_start_main[/lib/x86_64-linux-gnu/libc.so.6 +0x21b45]
#78: ???[./firefox +0x1ba39]
ASAN:DEADLYSIGNAL
=================================================================
==115479==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f91cf285b78 bp 0x7ffc925782d0 sp 0x7ffc92577fc0 T0)
    #0 0x7f91cf285b77 in nsDocShell::CopyFavicon(nsIURI*, nsIURI*, nsIPrincipal*, bool) /home/worker/workspace/build/src/docshell/base/nsDocShell.cpp:9560:3
    #1 0x7f91cf22251c in nsDocShell::InternalLoad(nsIURI*, nsIURI*, bool, nsIURI*, unsigned int, nsIPrincipal*, nsIPrincipal*, unsigned int, nsAString_internal const&, char const*, nsAString_internal const&, nsIInputStream*, nsIInputStream*, unsigned int, nsISHEntry*, bool, nsAString_internal const&, nsIDocShell*, nsIURI*, nsIDocShell**, nsIRequest**) /home/worker/workspace/build/src/docshell/base/nsDocShell.cpp:10438:7
    #2 0x7f91cf21b0b4 in nsDocShell::LoadURI(nsIURI*, nsIDocShellLoadInfo*, unsigned int, bool) /home/worker/workspace/build/src/docshell/base/nsDocShell.cpp:1558:10
    #3 0x7f91ca32fab5 in mozilla::dom::Location::SetURI(nsIURI*, bool) /home/worker/workspace/build/src/dom/base/Location.cpp:288:12
    #4 0x7f91ca330e9b in mozilla::dom::Location::SetHash(nsAString_internal const&) /home/worker/workspace/build/src/dom/base/Location.cpp:367:10
    #5 0x7f91cbed10dc in SetHash /home/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/Location.h:209:14
    #6 0x7f91cbed10dc in mozilla::dom::LocationBinding::set_hash(JSContext*, JS::Handle<JSObject*>, mozilla::dom::Location*, JSJitSetterCallArgs) /home/worker/workspace/build/src/obj-firefox/dom/bindings/LocationBinding.cpp:703
    #7 0x7f91cbeebbc3 in mozilla::dom::GenericBindingSetter(JSContext*, unsigned int, JS::Value*) /home/worker/workspace/build/src/dom/bindings/BindingUtils.cpp:2847:8
    #8 0x7f91d228bbec in CallJSNative /home/worker/workspace/build/src/js/src/jscntxtinlines.h:239:15
    #9 0x7f91d228bbec in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:447
    #10 0x7f91d228df08 in Call /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:523:10
    #11 0x7f91d228df08 in js::CallSetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<JS::Value>) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:650
    #12 0x7f91d1f9d4bf in js::SetPropertyIgnoringNamedGetter(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<JS::PropertyDescriptor>, JS::ObjectOpResult&) /home/worker/workspace/build/src/js/src/proxy/BaseProxyHandler.cpp:245:10
    #13 0x7f91cbef5d55 in mozilla::dom::DOMProxyHandler::set(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) const /home/worker/workspace/build/src/dom/bindings/DOMJSProxyHandler.cpp:258:10
    #14 0x7f91d1fc9ae1 in js::Proxy::set(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) /home/worker/workspace/build/src/js/src/proxy/Proxy.cpp:333:12
    #15 0x7f91d1eb2dba in JSObject::nonNativeSetProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) /home/worker/workspace/build/src/js/src/jsobj.cpp:1019:12
    #16 0x7f91d22649cf in SetProperty /home/worker/workspace/build/src/js/src/vm/NativeObject.h:1539:16
    #17 0x7f91d22649cf in SetPropertyOperation /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:259
    #18 0x7f91d22649cf in Interpret(JSContext*, js::RunState&) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:2715
    #19 0x7f91d2250dc6 in js::RunScript(JSContext*, js::RunState&) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:405:12
    #20 0x7f91d228c404 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:477:15
    #21 0x7f91d228ce72 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:523:10
    #22 0x7f91d1d6635d in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /home/worker/workspace/build/src/js/src/jsapi.cpp:2830:12
    #23 0x7f91cb901c8c in mozilla::dom::EventListener::HandleEvent(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) /home/worker/workspace/build/src/obj-firefox/dom/bindings/EventListenerBinding.cpp:47:8
    #24 0x7f91cc312182 in HandleEvent<mozilla::dom::EventTarget *> /home/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/EventListenerBinding.h:64:12
    #25 0x7f91cc312182 in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, nsIDOMEvent*, mozilla::dom::EventTarget*) /home/worker/workspace/build/src/dom/events/EventListenerManager.cpp:1129
    #26 0x7f91cc313bec in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent**, mozilla::dom::EventTarget*, nsEventStatus*) /home/worker/workspace/build/src/dom/events/EventListenerManager.cpp:1286:17
    #27 0x7f91cc2fe263 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /home/worker/workspace/build/src/dom/events/EventDispatcher.cpp:463:5
    #28 0x7f91cc301bc4 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /home/worker/workspace/build/src/dom/events/EventDispatcher.cpp:820:9
    #29 0x7f91cc303ef7 in mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, nsIDOMEvent*, nsPresContext*, nsEventStatus*) /home/worker/workspace/build/src/dom/events/EventDispatcher.cpp:889:12
    #30 0x7f91ca5b1df1 in nsINode::DispatchEvent(nsIDOMEvent*, bool*) /home/worker/workspace/build/src/dom/base/nsINode.cpp:1302:5
    #31 0x7f91cc31f28e in mozilla::dom::EventTarget::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&) /home/worker/workspace/build/src/dom/events/EventTarget.cpp:73:9
    #32 0x7f91cb9e3002 in mozilla::dom::EventTargetBinding::dispatchEvent(JSContext*, JS::Handle<JSObject*>, mozilla::dom::EventTarget*, JSJitMethodCallArgs const&) /home/worker/workspace/build/src/obj-firefox/dom/bindings/EventTargetBinding.cpp:966:15
    #33 0x7f91cb9e043c in mozilla::dom::EventTargetBinding::genericMethod(JSContext*, unsigned int, JS::Value*) /home/worker/workspace/build/src/obj-firefox/dom/bindings/EventTargetBinding.cpp:1142:13
    #34 0x7f91d228bbec in CallJSNative /home/worker/workspace/build/src/js/src/jscntxtinlines.h:239:15
    #35 0x7f91d228bbec in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:447
    #36 0x7f91d226bced in CallFromStack /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:510:12
    #37 0x7f91d226bced in Interpret(JSContext*, js::RunState&) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:2922
    #38 0x7f91d2250dc6 in js::RunScript(JSContext*, js::RunState&) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:405:12
    #39 0x7f91d228c404 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:477:15
    #40 0x7f91d228ce72 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:523:10
    #41 0x7f91d1d6635d in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /home/worker/workspace/build/src/js/src/jsapi.cpp:2830:12
    #42 0x7f91cb8fe64f in mozilla::dom::EventHandlerNonNull::Call(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /home/worker/workspace/build/src/obj-firefox/dom/bindings/EventHandlerBinding.cpp:259:37
    #43 0x7f91cc3485e1 in Call<nsISupports *> /home/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/EventHandlerBinding.h:361:12
    #44 0x7f91cc3485e1 in mozilla::JSEventHandler::HandleEvent(nsIDOMEvent*) /home/worker/workspace/build/src/dom/events/JSEventHandler.cpp:214
    #45 0x7f91cd78812c in nsXBLPrototypeHandler::ExecuteHandler(mozilla::dom::EventTarget*, nsIDOMEvent*) /home/worker/workspace/build/src/dom/xbl/nsXBLPrototypeHandler.cpp:325:3
    #46 0x7f91cd786ad1 in nsXBLEventHandler::HandleEvent(nsIDOMEvent*) /home/worker/workspace/build/src/dom/xbl/nsXBLEventHandler.cpp:49:3
    #47 0x7f91cc3121cd in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, nsIDOMEvent*, mozilla::dom::EventTarget*) /home/worker/workspace/build/src/dom/events/EventListenerManager.cpp:1133:16
    #48 0x7f91cc313bec in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent**, mozilla::dom::EventTarget*, nsEventStatus*) /home/worker/workspace/build/src/dom/events/EventListenerManager.cpp:1286:17
    #49 0x7f91cc2fe57d in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /home/worker/workspace/build/src/dom/events/EventDispatcher.cpp:487:9
    #50 0x7f91cc301bc4 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /home/worker/workspace/build/src/dom/events/EventDispatcher.cpp:820:9
    #51 0x7f91ce473d00 in PresShell::DispatchEventToDOM(mozilla::WidgetEvent*, nsEventStatus*, nsPresShellEventCB*) /home/worker/workspace/build/src/layout/base/nsPresShell.cpp:8431:7
    #52 0x7f91ce470570 in PresShell::HandleEventInternal(mozilla::WidgetEvent*, nsEventStatus*, bool) /home/worker/workspace/build/src/layout/base/nsPresShell.cpp:8304:11
    #53 0x7f91ce471956 in PresShell::HandlePositionedEvent(nsIFrame*, mozilla::WidgetGUIEvent*, nsEventStatus*) /home/worker/workspace/build/src/layout/base/nsPresShell.cpp:8129:10
    #54 0x7f91ce46d31d in PresShell::HandleEvent(nsIFrame*, mozilla::WidgetGUIEvent*, bool, nsEventStatus*, nsIContent**) /home/worker/workspace/build/src/layout/base/nsPresShell.cpp:7915:12
    #55 0x7f91cdb5631f in nsViewManager::DispatchEvent(mozilla::WidgetGUIEvent*, nsView*, nsEventStatus*) /home/worker/workspace/build/src/view/nsViewManager.cpp:815:7
    #56 0x7f91cdb4e088 in nsView::HandleEvent(mozilla::WidgetGUIEvent*, bool) /home/worker/workspace/build/src/view/nsView.cpp:1117:5
    #57 0x7f91cdc0e128 in nsWindow::DispatchEvent(mozilla::WidgetGUIEvent*, nsEventStatus&) /home/worker/workspace/build/src/widget/gtk/nsWindow.cpp:582:17
    #58 0x7f91cdb69e90 in nsBaseWidget::ProcessUntransformedAPZEvent(mozilla::WidgetInputEvent*, mozilla::layers::ScrollableLayerGuid const&, unsigned long, nsEventStatus) /home/worker/workspace/build/src/widget/nsBaseWidget.cpp:1097:3
    #59 0x7f91cdb6abc0 in nsBaseWidget::DispatchInputEvent(mozilla::WidgetInputEvent*) /home/worker/workspace/build/src/widget/nsBaseWidget.cpp:1237:14
    #60 0x7f91cdc23de4 in nsWindow::OnButtonPressEvent(_GdkEventButton*) /home/worker/workspace/build/src/widget/gtk/nsWindow.cpp:2850:5
    #61 0x7f91cdc3377c in button_press_event_cb(_GtkWidget*, _GdkEventButton*) /home/worker/workspace/build/src/widget/gtk/nsWindow.cpp:5723:5
    #62 0x7f91dc99234c in _gtk_marshal_BOOLEAN__BOXED /tmp/buildd/gtk+3.0-3.14.5/./gtk/gtkmarshalers.c:85
    #63 0x7f91d9ad7244 in g_closure_invoke (/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0+0x10244)
    #64 0x7f91d9ae8f6b  (/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0+0x21f6b)
    #65 0x7f91d9af1284 in g_signal_emit_valist (/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0+0x2a284)
    #66 0x7f91d9af19de in g_signal_emit (/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0+0x2a9de)
    #67 0x7f91dcac2e33 in gtk_widget_event_internal /tmp/buildd/gtk+3.0-3.14.5/./gtk/gtkwidget.c:7773
    #68 0x7f91dcae18da in _gtk_window_check_handle_wm_event /tmp/buildd/gtk+3.0-3.14.5/./gtk/gtkwindow.c:7725
    #69 0x7f91dc991517 in gtk_main_do_event /tmp/buildd/gtk+3.0-3.14.5/./gtk/gtkmain.c:1566
    #70 0x7f91dc539b71 in gdk_event_source_dispatch /tmp/buildd/gtk+3.0-3.14.5/./gdk/x11/gdkeventsource.c:364
    #71 0x7f91d9801c5c in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x49c5c)
    #72 0x7f91d9801f47  (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x49f47)
    #73 0x7f91d9801ffb in g_main_context_iteration (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x49ffb)
    #74 0x7f91cdc719fe in nsAppShell::ProcessNextNativeEvent(bool) /home/worker/workspace/build/src/widget/gtk/nsAppShell.cpp:270:12
    #75 0x7f91cdbd21f8 in DoProcessNextNativeEvent /home/worker/workspace/build/src/widget/nsBaseAppShell.cpp:138:17
    #76 0x7f91cdbd21f8 in nsBaseAppShell::OnProcessNextEvent(nsIThreadInternal*, bool) /home/worker/workspace/build/src/widget/nsBaseAppShell.cpp:289
    #77 0x7f91cdbd285f in non-virtual thunk to nsBaseAppShell::OnProcessNextEvent(nsIThreadInternal*, bool) /home/worker/workspace/build/src/widget/nsBaseAppShell.cpp:233:17
    #78 0x7f91c782270a in nsThread::ProcessNextEvent(bool, bool*) /home/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1186:5
    #79 0x7f91c78a5b5c in NS_ProcessNextEvent(nsIThread*, bool) /home/worker/workspace/build/src/xpcom/glue/nsThreadUtils.cpp:361:10
    #80 0x7f91c86412d4 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /home/worker/workspace/build/src/ipc/glue/MessagePump.cpp:124:5
    #81 0x7f91c85b0678 in RunInternal /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:232:3
    #82 0x7f91c85b0678 in RunHandler /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:225
    #83 0x7f91c85b0678 in MessageLoop::Run() /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:205
    #84 0x7f91cdbd162f in nsBaseAppShell::Run() /home/worker/workspace/build/src/widget/nsBaseAppShell.cpp:156:3
    #85 0x7f91cfc323a1 in nsAppStartup::Run() /home/worker/workspace/build/src/toolkit/components/startup/nsAppStartup.cpp:283:19
    #86 0x7f91cfdc109e in XREMain::XRE_mainRun() /home/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4467:10
    #87 0x7f91cfdc25b2 in XREMain::XRE_main(int, char**, nsXREAppData const*) /home/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4600:8
    #88 0x7f91cfdc346c in XRE_main /home/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4691:16
    #89 0x4df8ca in do_main /home/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:328:10
    #90 0x4df8ca in main /home/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:461
    #91 0x7f91e10b1b44 in __libc_start_main /build/glibc-daoqzt/glibc-2.19/csu/libc-start.c:287
    #92 0x41ba38 in _start (/home/geeknik/firefox/firefox+0x41ba38)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/worker/workspace/build/src/docshell/base/nsDocShell.cpp:9560:3 in nsDocShell::CopyFavicon(nsIURI*, nsIURI*, nsIPrincipal*, bool)
==115479==ABORTING
[Child 115520] ###!!! ABORT: Aborting on channel error.: file /home/worker/workspace/build/src/ipc/glue/MessageChannel.cpp, line 2155
[Child 115520] ###!!! ABORT: Aborting on channel error.: file /home/worker/workspace/build/src/ipc/glue/MessageChannel.cpp, line 2155
ASAN:DEADLYSIGNAL
=================================================================
==115520==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x0000004e114b bp 0x7f37e7de0090 sp 0x7f37e7de0080 T2)
Crash Annotation GraphicsCriticalError: |[C0][GFX1-]: Receive IPC close with reason=AbnormalShutdown (t=35.3286)     #0 0x4e114a in mozalloc_abort(char const*) /home/worker/workspace/build/src/memory/mozalloc/mozalloc_abort.cpp:33:5
    #1 0x7f37ea99f1d5 in Abort(char const*) /home/worker/workspace/build/src/xpcom/base/nsDebugImpl.cpp:449:3
    #2 0x7f37ea99ef7c in NS_DebugBreak /home/worker/workspace/build/src/xpcom/base/nsDebugImpl.cpp:405:7
    #3 0x7f37eb9039ef in mozilla::ipc::MessageChannel::OnChannelErrorFromLink() /home/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:2155:13
    #4 0x7f37eb908c93 in OnChannelError /home/worker/workspace/build/src/ipc/glue/MessageLink.cpp:367:5
    #5 0x7f37eb908c93 in non-virtual thunk to mozilla::ipc::ProcessLink::OnChannelError() /home/worker/workspace/build/src/ipc/glue/MessageLink.cpp:359
    #6 0x7f37eb8bed7b in event_process_active_single_queue /home/worker/workspace/build/src/ipc/chromium/src/third_party/libevent/event.c:1350:4
    #7 0x7f37eb8bed7b in event_process_active /home/worker/workspace/build/src/ipc/chromium/src/third_party/libevent/event.c:1420
    #8 0x7f37eb8bed7b in event_base_loop /home/worker/workspace/build/src/ipc/chromium/src/third_party/libevent/event.c:1621
    #9 0x7f37eb87e211 in base::MessagePumpLibevent::Run(base::MessagePump::Delegate*) /home/worker/workspace/build/src/ipc/chromium/src/base/message_pump_libevent.cc:372:7
    #10 0x7f37eb878678 in RunInternal /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:232:3
    #11 0x7f37eb878678 in RunHandler /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:225
    #12 0x7f37eb878678 in MessageLoop::Run() /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:205
    #13 0x7f37eb898821 in base::Thread::ThreadMain() /home/worker/workspace/build/src/ipc/chromium/src/base/thread.cc:180:3
    #14 0x7f37eb89937c in ThreadFunc(void*) /home/worker/workspace/build/src/ipc/chromium/src/base/platform_thread_posix.cc:38:3
    #15 0x7f38053390a3 in start_thread /build/glibc-daoqzt/glibc-2.19/nptl/pthread_create.c:309
    #16 0x7f380444062c in clone /build/glibc-daoqzt/glibc-2.19/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:111

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/worker/workspace/build/src/memory/mozalloc/mozalloc_abort.cpp:33:5 in mozalloc_abort(char const*)
Thread T2 (Chrome_ChildThr) created by T0 (Web Content) here:
    #0 0x49a869 in __interceptor_pthread_create /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:238:3
    #1 0x7f37eb89843b in CreateThread /home/worker/workspace/build/src/ipc/chromium/src/base/platform_thread_posix.cc:137:14
    #2 0x7f37eb89843b in Create /home/worker/workspace/build/src/ipc/chromium/src/base/platform_thread_posix.cc:148
    #3 0x7f37eb89843b in base::Thread::StartWithOptions(base::Thread::Options const&) /home/worker/workspace/build/src/ipc/chromium/src/base/thread.cc:98
    #4 0x7f37eb90ae77 in mozilla::ipc::ProcessChild::ProcessChild(int) /home/worker/workspace/build/src/ipc/glue/ProcessChild.cpp:24:5
    #5 0x7f37f308fbcb in ContentProcess /home/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/ContentProcess.h:31:7
    #6 0x7f37f308fbcb in XRE_InitChildProcess /home/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:660
    #7 0x4dfb5b in content_process_main /home/worker/workspace/build/src/browser/app/../../ipc/contentproc/plugin-container.cpp:115:19
    #8 0x4dfb5b in main /home/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:438
    #9 0x7f3804379b44 in __libc_start_main /build/glibc-daoqzt/glibc-2.19/csu/libc-start.c:287

==115520==ABORTING

real	0m52.690s
user	0m21.384s
sys	0m12.224s
Duplicate of this bug: 1320112
We've 148 crashes on nightly with build-id 20161124030208.
The regression is probably due to patch https://hg.mozilla.org/mozilla-central/rev?node=2bbc7be933e2cd52fb1e328119075cf9aab50c5f for bug 1309070.
Flags: needinfo?(huseby)
Crash Signature: nsDocShell::CopyFavicon
Crash Signature: nsDocShell::CopyFavicon → [@ nsDocShell::CopyFavicon ]
CC'ing :tanvi and :baku as well. This seems like a container issue.

STR:

* open a new PB window via Hamburger -> New Private Window
* paste "about:preferences#privacy"

Platforms Used:

* macOS 10.12.1 x64 -> Reproduced
* Win 10 x64 -> Reproduced
* Ubuntu 16.04 x64 -> Reproduced

Crashes:

* bp-fd50ce1c-48e1-46c1-8f10-7432c2161125 (macOS x64)
* bp-167bc3d6-14b6-4f1c-8914-bba742161125 (Win10 x64)
* bp-75f625e7-145e-43d2-8017-bdd722161125 (Ubuntu 16.04 x64)
Has STR: --- → yes
OS: Linux → All
Hardware: x86_64 → All
Whiteboard: [userContextId][domsecurity-backlog]
Version: Trunk → 53 Branch
CC'ing Ethan from the Taipei team as well incase someone is available to take a look at this before the folks from the US get back on Monday.
This is hitting a release assert, and looks to only relate to chrome code, so I don't think this needs to be hidden.
Group: core-security
Keywords: topcrash
[Tracking Requested - why for this release]: #1 crash on Nightly
Flags: needinfo?(ehsan)
Keywords: regression
I backed out bug 1309070 on inbound. Hopefully that will fix this.
Tracking 53+ for this new top crash.
(In reply to Andrew McCreight [:mccr8] from comment #10)
> I backed out bug 1309070 on inbound. Hopefully that will fix this.

It's present in Nightly builds 20161125030214 and 20161126030207, but is gone in 20161127030208.
Status: NEW → RESOLVED
Crash Signature: [@ nsDocShell::CopyFavicon ] → [@ nsDocShell::CopyFavicon]
Closed: 3 years ago
Resolution: --- → FIXED
I confirm that this crash is no longer reproducible on Firefox 53.0a1 (2016-11-27) under Windows 10 64-bit and Ubuntu 16.04 32-bit.
Status: RESOLVED → VERIFIED
Duplicate of this bug: 1320555
Not sure what information is requested from me.  Clearing the needinfo flag.
Flags: needinfo?(ehsan)
Clearing the flag because the backout is successful.  I have reproduced the crash with the original patch and I'm fixing it now.
Flags: needinfo?(huseby)
Updating status flags.
See Also: → 1321646
You need to log in before you can comment on or make changes to this bug.