Closed Bug 1419902 Opened 8 years ago Closed 8 years ago

Assertion failure: mRawPtr != nullptr (You can't dereference a NULL nsCOMPtr with operator->().), at /builds/worker/workspace/build/src/obj-firefox/dist/include/nsCOMPtr.h:801

Categories

(Core :: DOM: Core & HTML, defect, P2)

Product:
Core
Component:
DOM: Core & HTML
Version:
52 Branch
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla59
Tracking Flags:
Tracking Status
firefox-esr52 --- unaffected
firefox57 --- unaffected
firefox58 --- disabled
firefox59 --- fixed

People

(Reporter: jkratzer, Assigned: ckerschb)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, regression, testcase, Whiteboard: [domsecurity-active])

Attachments

(5 files, 2 obsolete files)

trigger.html
450 bytes, text/html
Details
prefs.js
9.90 KB, application/javascript
Details
asan_opt_log.txt
3.75 KB, text/plain
Details
bug_1419902_check_if_doc_exists.patch
2.46 KB, patch
smaug
: review+
Details | Diff | Splinter Review
bug_1419902_crashtest.patch
1.66 KB, patch
RyanVM
: review+
Details | Diff | Splinter Review
Attached file trigger.html —
Testcase found while fuzzing mozilla-central rev 5378dcb45044. OS|Linux|0.0.0 Linux 4.4.0-98-generic #121-Ubuntu SMP Tue Oct 10 14:24:03 UTC 2017 x86_64 CPU|amd64|family 6 model 78 stepping 3|1 GPU||| Crash|SIGSEGV|0x0|0 0|0|libxul.so|nsCOMPtr<nsIDocument>::operator->|hg:hg.mozilla.org/mozilla-central:xpcom/base/nsCOMPtr.h:5378dcb45044|800|0x5 0|1|libxul.so|nsGlobalWindowOuter::CloseOuter|hg:hg.mozilla.org/mozilla-central:dom/base/nsGlobalWindowOuter.cpp:5378dcb45044|6087|0x9 0|2|libxul.so|nsGlobalWindowOuter::Close|hg:hg.mozilla.org/mozilla-central:dom/base/nsGlobalWindowOuter.cpp:5378dcb45044|6135|0x5 0|3|libxul.so|MaybeCloseWindowHelper::Notify|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDSURIContentListener.cpp:5378dcb45044|78|0x18 0|4|libxul.so|nsTimerImpl::Fire|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsTimerImpl.cpp:5378dcb45044|704|0x11 0|5|libxul.so|nsTimerEvent::Run|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TimerThread.cpp:5378dcb45044|286|0x18 0|6|libxul.so|nsThread::ProcessNextEvent|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:5378dcb45044|1037|0x15 0|7|libxul.so|NS_ProcessNextEvent|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:5378dcb45044|513|0x11 0|8|libxul.so|mozilla::dom::ContentChild::ProvideWindowCommon|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:5378dcb45044|323|0xd 0|9|libxul.so|mozilla::dom::TabChild::ProvideWindow|hg:hg.mozilla.org/mozilla-central:dom/ipc/TabChild.cpp:5378dcb45044|1073|0x10 0|10|libxul.so|nsWindowWatcher::OpenWindowInternal|hg:hg.mozilla.org/mozilla-central:toolkit/components/windowwatcher/nsWindowWatcher.cpp:5378dcb45044|856|0x29 0|11|libxul.so|nsWindowWatcher::OpenWindow2|hg:hg.mozilla.org/mozilla-central:toolkit/components/windowwatcher/nsWindowWatcher.cpp:5378dcb45044|447|0x18 0|12|libxul.so|nsGlobalWindowOuter::OpenInternal|hg:hg.mozilla.org/mozilla-central:dom/base/nsGlobalWindowOuter.cpp:5378dcb45044|7332|0x2b 0|13|libxul.so|nsGlobalWindowOuter::OpenJS|hg:hg.mozilla.org/mozilla-central:dom/base/nsGlobalWindowOuter.cpp:5378dcb45044|5712|0x1b 0|14|libxul.so|nsGlobalWindowOuter::OpenOuter|hg:hg.mozilla.org/mozilla-central:dom/base/nsGlobalWindowOuter.cpp:5378dcb45044|5677|0x15 0|15|libxul.so|nsGlobalWindowInner::Open|hg:hg.mozilla.org/mozilla-central:dom/base/nsGlobalWindowInner.cpp:5378dcb45044|3631|0x17 0|16|libxul.so|mozilla::dom::WindowBinding::open|s3:gecko-generated-sources:fa9d3b5a62bbb7c8516d40865ce3e1a7ded042ef80ad94bc7ff84af35ae3e8742e079b705c675143183d72b61bf28473ebc30a485281408e38d9c5e51dd51741/dom/bindings/WindowBinding.cpp:|2190|0x2d 0|17|libxul.so|mozilla::dom::WindowBinding::genericMethod|s3:gecko-generated-sources:fa9d3b5a62bbb7c8516d40865ce3e1a7ded042ef80ad94bc7ff84af35ae3e8742e079b705c675143183d72b61bf28473ebc30a485281408e38d9c5e51dd51741/dom/bindings/WindowBinding.cpp:|15333|0x9 0|18|||||0x1862d6a174b1 0|19|||||0x7fe2548c9470 0|20|||||0x1862d695dadd 0|21|libxul.so|EnterJit|hg:hg.mozilla.org/mozilla-central:js/src/jit/Jit.cpp:5378dcb45044|101|0x22 0|22|libxul.so|js::RunScript|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5378dcb45044|408|0xb 0|23|libxul.so|js::InternalCallOrConstruct|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5378dcb45044|495|0xf 0|24|libxul.so|InternalConstruct|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5378dcb45044|570|0x11 0|25|libxul.so|js::Construct|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5378dcb45044|619|0xb 0|26|libxul.so|JS::Construct|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:5378dcb45044|3080|0x18 0|27|libxul.so|mozilla::dom::CustomElementConstructor::Construct|hg:hg.mozilla.org/mozilla-central:dom/base/CustomElementRegistry.cpp:5378dcb45044|79|0x28 0|28|libxul.so|NS_NewHTMLElement|hg:hg.mozilla.org/mozilla-central:dom/html/nsHTMLContentSink.cpp:5378dcb45044|232|0x2b 0|29|libxul.so|NS_NewElement|hg:hg.mozilla.org/mozilla-central:dom/base/nsNameSpaceManager.cpp:5378dcb45044|182|0x5 0|30|libxul.so|nsDocument::CreateElem|hg:hg.mozilla.org/mozilla-central:dom/base/nsDocument.cpp:5378dcb45044|8938|0x18 0|31|libxul.so|nsDocument::CreateElement|hg:hg.mozilla.org/mozilla-central:dom/base/nsDocument.cpp:5378dcb45044|6105|0x2b 0|32|libxul.so|mozilla::dom::DocumentBinding::createElement|s3:gecko-generated-sources:a5664d63bd63cbec66bc9f9537f00b7f65d807bf8661c3ad42fde176c4c8f0488b86c7a491d512ea856ac4c102fa576fd17424948bb73d3869541008b137b3dd/dom/bindings/DocumentBinding.cpp:|1224|0x2e 0|33|libxul.so|mozilla::dom::GenericBindingMethod|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:5378dcb45044|3040|0x9 0|34|||||0x1862d6a174b1 0|35|||||0x7fe2548c9350 0|36|||||0x1862d695dadd 0|37|libxul.so|EnterJit|hg:hg.mozilla.org/mozilla-central:js/src/jit/Jit.cpp:5378dcb45044|101|0x22 0|38|libxul.so|js::RunScript|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5378dcb45044|408|0xb 0|39|libxul.so|js::InternalCallOrConstruct|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5378dcb45044|495|0xf 0|40|libxul.so|InternalConstruct|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5378dcb45044|570|0x11 0|41|libxul.so|js::Construct|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5378dcb45044|619|0xb 0|42|libxul.so|JS::Construct|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:5378dcb45044|3080|0x18 0|43|libxul.so|mozilla::dom::CustomElementConstructor::Construct|hg:hg.mozilla.org/mozilla-central:dom/base/CustomElementRegistry.cpp:5378dcb45044|79|0x28 0|44|libxul.so|NS_NewHTMLElement|hg:hg.mozilla.org/mozilla-central:dom/html/nsHTMLContentSink.cpp:5378dcb45044|232|0x2b 0|45|libxul.so|NS_NewElement|hg:hg.mozilla.org/mozilla-central:dom/base/nsNameSpaceManager.cpp:5378dcb45044|182|0x5 0|46|libxul.so|nsDocument::CreateElem|hg:hg.mozilla.org/mozilla-central:dom/base/nsDocument.cpp:5378dcb45044|8938|0x18 0|47|libxul.so|nsDocument::CreateElement|hg:hg.mozilla.org/mozilla-central:dom/base/nsDocument.cpp:5378dcb45044|6105|0x2b 0|48|libxul.so|mozilla::dom::DocumentBinding::createElement|s3:gecko-generated-sources:a5664d63bd63cbec66bc9f9537f00b7f65d807bf8661c3ad42fde176c4c8f0488b86c7a491d512ea856ac4c102fa576fd17424948bb73d3869541008b137b3dd/dom/bindings/DocumentBinding.cpp:|1224|0x2e 0|49|libxul.so|mozilla::dom::GenericBindingMethod|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:5378dcb45044|3040|0x9 0|50|||||0x1862d6a174b1 0|51|||||0x7fe2548c9350 0|52|||||0x1862d695dadd 0|53|libxul.so|EnterJit|hg:hg.mozilla.org/mozilla-central:js/src/jit/Jit.cpp:5378dcb45044|101|0x22 0|54|libxul.so|js::RunScript|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5378dcb45044|408|0xb 0|55|libxul.so|js::InternalCallOrConstruct|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5378dcb45044|495|0xf 0|56|libxul.so|InternalConstruct|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5378dcb45044|570|0x11 0|57|libxul.so|js::Construct|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5378dcb45044|619|0xb 0|58|libxul.so|JS::Construct|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:5378dcb45044|3080|0x18 0|59|libxul.so|mozilla::dom::CustomElementConstructor::Construct|hg:hg.mozilla.org/mozilla-central:dom/base/CustomElementRegistry.cpp:5378dcb45044|79|0x28 0|60|libxul.so|NS_NewHTMLElement|hg:hg.mozilla.org/mozilla-central:dom/html/nsHTMLContentSink.cpp:5378dcb45044|232|0x2b 0|61|libxul.so|NS_NewElement|hg:hg.mozilla.org/mozilla-central:dom/base/nsNameSpaceManager.cpp:5378dcb45044|182|0x5 0|62|libxul.so|nsDocument::CreateElem|hg:hg.mozilla.org/mozilla-central:dom/base/nsDocument.cpp:5378dcb45044|8938|0x18 0|63|libxul.so|nsDocument::CreateElement|hg:hg.mozilla.org/mozilla-central:dom/base/nsDocument.cpp:5378dcb45044|6105|0x2b 0|64|libxul.so|mozilla::dom::DocumentBinding::createElement|s3:gecko-generated-sources:a5664d63bd63cbec66bc9f9537f00b7f65d807bf8661c3ad42fde176c4c8f0488b86c7a491d512ea856ac4c102fa576fd17424948bb73d3869541008b137b3dd/dom/bindings/DocumentBinding.cpp:|1224|0x2e 0|65|libxul.so|mozilla::dom::GenericBindingMethod|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:5378dcb45044|3040|0x9 0|66|||||0x1862d6a174b1 0|67|||||0x7fe2548c9350 0|68|||||0x1862d695dadd 0|69|libxul.so|EnterJit|hg:hg.mozilla.org/mozilla-central:js/src/jit/Jit.cpp:5378dcb45044|101|0x22 0|70|libxul.so|js::RunScript|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5378dcb45044|408|0xb 0|71|libxul.so|js::InternalCallOrConstruct|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5378dcb45044|495|0xf 0|72|libxul.so|InternalConstruct|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5378dcb45044|570|0x11 0|73|libxul.so|js::Construct|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5378dcb45044|619|0xb 0|74|libxul.so|JS::Construct|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:5378dcb45044|3080|0x18 0|75|libxul.so|mozilla::dom::CustomElementConstructor::Construct|hg:hg.mozilla.org/mozilla-central:dom/base/CustomElementRegistry.cpp:5378dcb45044|79|0x28 0|76|libxul.so|NS_NewHTMLElement|hg:hg.mozilla.org/mozilla-central:dom/html/nsHTMLContentSink.cpp:5378dcb45044|232|0x2b 0|77|libxul.so|NS_NewElement|hg:hg.mozilla.org/mozilla-central:dom/base/nsNameSpaceManager.cpp:5378dcb45044|182|0x5 0|78|libxul.so|nsDocument::CreateElem|hg:hg.mozilla.org/mozilla-central:dom/base/nsDocument.cpp:5378dcb45044|8938|0x18 0|79|libxul.so|nsDocument::CreateElement|hg:hg.mozilla.org/mozilla-central:dom/base/nsDocument.cpp:5378dcb45044|6105|0x2b 0|80|libxul.so|mozilla::dom::DocumentBinding::createElement|s3:gecko-generated-sources:a5664d63bd63cbec66bc9f9537f00b7f65d807bf8661c3ad42fde176c4c8f0488b86c7a491d512ea856ac4c102fa576fd17424948bb73d3869541008b137b3dd/dom/bindings/DocumentBinding.cpp:|1224|0x2e 0|81|libxul.so|mozilla::dom::GenericBindingMethod|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:5378dcb45044|3040|0x9 0|82|||||0x1862d6a174b1 0|83|||||0x7fe2548c9350 0|84|||||0x1862d695dadd 0|85|libxul.so|EnterJit|hg:hg.mozilla.org/mozilla-central:js/src/jit/Jit.cpp:5378dcb45044|101|0x22 0|86|libxul.so|js::RunScript|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5378dcb45044|408|0xb 0|87|libxul.so|js::InternalCallOrConstruct|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5378dcb45044|495|0xf 0|88|libxul.so|InternalConstruct|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5378dcb45044|570|0x11 0|89|libxul.so|js::Construct|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5378dcb45044|619|0xb 0|90|libxul.so|JS::Construct|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:5378dcb45044|3080|0x18 0|91|libxul.so|mozilla::dom::CustomElementConstructor::Construct|hg:hg.mozilla.org/mozilla-central:dom/base/CustomElementRegistry.cpp:5378dcb45044|79|0x28 0|92|libxul.so|NS_NewHTMLElement|hg:hg.mozilla.org/mozilla-central:dom/html/nsHTMLContentSink.cpp:5378dcb45044|232|0x2b 0|93|libxul.so|NS_NewElement|hg:hg.mozilla.org/mozilla-central:dom/base/nsNameSpaceManager.cpp:5378dcb45044|182|0x5 0|94|libxul.so|nsDocument::CreateElem|hg:hg.mozilla.org/mozilla-central:dom/base/nsDocument.cpp:5378dcb45044|8938|0x18 0|95|libxul.so|nsDocument::CreateElement|hg:hg.mozilla.org/mozilla-central:dom/base/nsDocument.cpp:5378dcb45044|6105|0x2b 0|96|libxul.so|mozilla::dom::DocumentBinding::createElement|s3:gecko-generated-sources:a5664d63bd63cbec66bc9f9537f00b7f65d807bf8661c3ad42fde176c4c8f0488b86c7a491d512ea856ac4c102fa576fd17424948bb73d3869541008b137b3dd/dom/bindings/DocumentBinding.cpp:|1224|0x2e 0|97|libxul.so|mozilla::dom::GenericBindingMethod|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:5378dcb45044|3040|0x9 0|98|||||0x1862d6a174b1 0|99|||||0x7fe2548c9350 0|100|||||0x1862d695dadd 0|101|libxul.so|EnterJit|hg:hg.mozilla.org/mozilla-central:js/src/jit/Jit.cpp:5378dcb45044|101|0x22 0|102|libxul.so|js::RunScript|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5378dcb45044|408|0xb 0|103|libxul.so|js::InternalCallOrConstruct|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5378dcb45044|495|0xf 0|104|libxul.so|InternalConstruct|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5378dcb45044|570|0x11 0|105|libxul.so|js::Construct|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5378dcb45044|619|0xb
Edgar/John, I guess we would need to at least check this first before shipping CE.
Priority: -- → P2
mozregression on my side: 13:58.89 INFO: Last good revision: c0a99f75e8fcc36143d4066351ab3ffc5e84556e 13:58.89 INFO: First bad revision: b66649cd261a06335e8b052b1cab15b78744465e 13:58.89 INFO: Pushlog: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=c0a99f75e8fcc36143d4066351ab3ffc5e84556e&tochange=b66649cd261a06335e8b052b1cab15b78744465e
(In reply to Edgar Chen [:edgar] from comment #3) > 13:58.89 INFO: Last good revision: c0a99f75e8fcc36143d4066351ab3ffc5e84556e > 13:58.89 INFO: First bad revision: b66649cd261a06335e8b052b1cab15b78744465e > 13:58.89 INFO: Pushlog: > https://hg.mozilla.org/integration/mozilla-inbound/ > pushloghtml?fromchange=c0a99f75e8fcc36143d4066351ab3ffc5e84556e&tochange=b666 > 49cd261a06335e8b052b1cab15b78744465e Hi Christoph, it looks like a regression of data URI navigation changes, could you take a look? Step to reproduce, 1. set "dom.webcomponents.customelements.enabled" pref to true. 2. change setting to allow popups. 3. load test script (attachment #8931091 [details])
Flags: needinfo?(ckerschb)
I can't right now but I'll take a look ASAP.
Assignee: nobody → ckerschb
Flags: needinfo?(ckerschb)
Attached file prefs.js —
Required prefs
Attached file asan_opt_log.txt —
Crash logs requested by ckerschb, collected from m-c ASan opt build Changeset: 7d191882de19faa537753b2deaea9444277a6533 Build ID: 20171204202120
Hey Smaug, I am not entirely sure what's happening here, maybe you can help me out. When I run the testcase 'trigger.html' (see attachments) using the userprefs.js (see attachments) then we get a nullptr deref when accessing mDoc within nsGlobalWindowOuter::CloseOuter(). A simple nullptr check fixes the problem. Acceptable?
Attachment #8934951 - Flags: review?(bugs)
Status: NEW → ASSIGNED
Whiteboard: [domsecurity-active]
Comment on attachment 8934951 [details] [diff] [review] bug_1419902_check_if_doc_exists.patch I think this should be fine. mDoc is not guaranteed to be non-null. Perhaps we haven't even created the initial about:blank or so.
Attachment #8934951 - Flags: review?(bugs) → review+
Pushed by ryanvm@gmail.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/b21f6172b460 Check if doc exists before quering document URI within CloseOuter. r=smaug
Keywords: checkin-needed
https://hg.mozilla.org/mozilla-central/rev/b21f6172b460
Status: ASSIGNED → RESOLVED
Closed: 8 years ago
status-firefox59: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla59
Please request Beta approval on this when you get a chance. Also, can the attached testcase be landed as a crashtest as well?
Blocks: 1403814
status-firefox57: --- → unaffected
status-firefox58: --- → affected
status-firefox-esr52: --- → unaffected
Flags: needinfo?(ckerschb)
Attached patch bug_1419902_crashtest.patch (obsolete) — — Splinter Review
(In reply to Edgar Chen [:edgar] from comment #4) > Step to reproduce, > 1. set "dom.webcomponents.customelements.enabled" pref to true. > 2. change setting to allow popups. > 3. load test script (attachment #8931091 [details]) Hey Edgar, were you really able to reproduce the problem by just using those steps to reproduce? That actually didn't work for me, I had to use the prefs.js provided (see attachment) to reproduce the problem. Knowing the exact prefs we need to flip seems essential to land the crashtest. I am attaching what I got so far, but we need to know exactly what prefs we need to flip so we can land an actual useful crashtest. Any thoughts?
Flags: needinfo?(echen)
(In reply to Ryan VanderMeulen [:RyanVM] from comment #12) > Please request Beta approval on this when you get a chance. Also, can the > attached testcase be landed as a crashtest as well? As agreed on IRC, for the problem to be triggerable an end user would have to flip a serious of non standard prefs (see fundamental crashtest). Because of that we think it's not worth uplifting the fix. However, we want the crashtest to land.
Flags: needinfo?(ckerschb)
(In reply to Christoph Kerschbaumer [:ckerschb] from comment #13) > Knowing the exact prefs we need to flip seems essential to land the > crashtest. I am attaching what I got so far, but we need to know exactly > what prefs we need to flip so we can land an actual useful crashtest. Any > thoughts? I was able to reproduce the problem by - enabling custom elements: dom.webcomponents.customelements.enabled=true - disabling popup blocker: dom.disable_open_during_load=false Could you try if adding dom.disable_open_during_load=false helps?
Flags: needinfo?(echen)
Attached patch bug_1419902_crashtest.patch (obsolete) — — Splinter Review
(In reply to Edgar Chen [:edgar] from comment #15) > Could you try if adding dom.disable_open_during_load=false helps? Yep, that seems to work - thanks!
Attachment #8936474 - Attachment is obsolete: true
Attachment #8936666 - Flags: review?(bugs)
Comment on attachment 8936666 [details] [diff] [review] bug_1419902_crashtest.patch rs+
Attachment #8936666 - Flags: review?(bugs) → review+
Ryan, could you check in the crashtest for me please? Thanks!
Flags: needinfo?(ryanvm)
Flags: needinfo?(ryanvm)
Pushed by ryanvm@gmail.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/8a16779be2fb Add crashtest for nullptr deref of doc within nsGlobalWindowOuter::CloseOuter. r=smaug
(In reply to Andreea Pavel [:apavel] from comment #20) > Backed out for crashtest failures e.g. > /build/tests/reftest/tests/gfx/tests/crashtests/1343666.html r=backout > a=backout on a CLOSED TREE I have never seen such an error before. Ryan, do you have any idea what might go wrong here? Does it mean the crashtest runs successfully on other platforms but just not on Windows?
Flags: needinfo?(ckerschb) → needinfo?(ryanvm)
I was a bit stumped by that yesterday too. It was Windows non-e10s only (the only platform we're running non-e10s tests on anymore), and pretty far downstream from when this test actually ran. I did notice that the test is pretty spammy (search for it in the raw log), but didn't really get much further than that.
Flags: needinfo?(ryanvm)
(In reply to Ryan VanderMeulen [:RyanVM] from comment #22) > I was a bit stumped by that yesterday too. It was Windows non-e10s only (the > only platform we're running non-e10s tests on anymore), and pretty far > downstream from when this test actually ran. I did notice that the test is > pretty spammy (search for it in the raw log), but didn't really get much > further than that. Ryan, would you be fine with just skipping the test on non-e10s builds? I suppose !browserIsRemote is flag that provides that bit of information. Acceptable?
Attachment #8936666 - Attachment is obsolete: true
Attachment #8937968 - Flags: review?(ryanvm)
Comment on attachment 8937968 [details] [diff] [review] bug_1419902_crashtest.patch Review of attachment 8937968 [details] [diff] [review]: ----------------------------------------------------------------- Fine by me.
Attachment #8937968 - Flags: review?(ryanvm) → review+
Just the testcase from comment 23 that needs to be checked in here - thanks!
Keywords: checkin-needed
Pushed by ryanvm@gmail.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/6fda621a4e3b Add crashtest for nullptr deref of doc within nsGlobalWindowOuter::CloseOuter. r=smaug,ryanvm
Keywords: checkin-needed
Component: DOM → DOM: Core & HTML
See Also: → 1524493

Bugbug thinks this bug is a regression, but please revert this change in case of error.

Keywords: regression
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: