1507168 - Assertion failure: !aOpener || (GetBrowsingContext() && GetBrowsingContext()->GetOpener() == aOpener->GetBrowsingContext()), at /builds/worker/workspace/build/src/dom/base/nsGlobalWindowOuter.cpp:2246

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect, P2)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Testcase found while fuzzing mozilla-central rev 073045259e75.  

Steps to reproduce:
1. Testcase must be served via a local webserver in order to reproduce.
2. Point firefox at http://localhost/harness.html which calls testcase.html

Assertion failure: !aOpener || (GetBrowsingContext() && GetBrowsingContext()->GetOpener() == aOpener->GetBrowsingContext()), at /builds/worker/workspace/build/src/dom/base/nsGlobalWindowOuter.cpp:2246

rax = 0x0000000000000000   rdx = 0x0000000000000000
rcx = 0x0000000000000b40   rbx = 0x00007f63f6982920
rsi = 0x00007f6411d208b0   rdi = 0x00007f6411d1f680
rbp = 0x00007ffdd1d1ab80   rsp = 0x00007ffdd1d1ab30
r8 = 0x00007f6411d208b0    r9 = 0x00007f6412e91740
r10 = 0x0000000000000002   r11 = 0x0000000000000000
r12 = 0x00007f63f5f7c620   r13 = 0x00007ffdd1d1ab40
r14 = 0x0000000000000001   r15 = 0x00007ffdd1d1ab48
rip = 0x00007f6400f3d9a0
OS|Linux|0.0.0 Linux 4.15.0-38-generic #41-Ubuntu SMP Wed Oct 10 10:59:38 UTC 2018 x86_64
CPU|amd64|family 6 model 78 stepping 3|1
GPU|||
Crash|SIGSEGV /SEGV_MAPERR|0x0|0
0|0|libxul.so|nsGlobalWindowOuter::SetOpenerWindow(nsPIDOMWindowOuter*, bool)|hg:hg.mozilla.org/mozilla-central:dom/base/nsGlobalWindowOuter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|2275|0x18
0|1|libxul.so|nsWindowWatcher::ReadyOpenedDocShellItem(nsIDocShellTreeItem*, nsPIDOMWindowOuter*, bool, bool, mozIDOMWindowProxy**)|hg:hg.mozilla.org/mozilla-central:toolkit/components/windowwatcher/nsWindowWatcher.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|2075|0x1b
0|2|libxul.so|nsWindowWatcher::OpenWindowInternal(mozIDOMWindowProxy*, char const*, char const*, char const*, bool, bool, bool, nsIArray*, bool, bool, nsDocShellLoadState*, mozIDOMWindowProxy**)|hg:hg.mozilla.org/mozilla-central:toolkit/components/windowwatcher/nsWindowWatcher.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|999|0x1d
0|3|libxul.so|nsWindowWatcher::OpenWindow2(mozIDOMWindowProxy*, char const*, char const*, char const*, bool, bool, bool, nsISupports*, bool, bool, nsDocShellLoadState*, mozIDOMWindowProxy**)|hg:hg.mozilla.org/mozilla-central:toolkit/components/windowwatcher/nsWindowWatcher.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|416|0x18
0|4|libxul.so|nsGlobalWindowOuter::OpenInternal(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, bool, bool, bool, bool, bool, nsIArray*, nsISupports*, nsDocShellLoadState*, bool, nsPIDOMWindowOuter**)|hg:hg.mozilla.org/mozilla-central:dom/base/nsGlobalWindowOuter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|7141|0x32
0|5|libxul.so|nsGlobalWindowOuter::OpenJS(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsPIDOMWindowOuter**)|hg:hg.mozilla.org/mozilla-central:dom/base/nsGlobalWindowOuter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|5579|0x18
0|6|libxul.so|nsGlobalWindowOuter::OpenOuter(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/base/nsGlobalWindowOuter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|5545|0x15
0|7|libxul.so|nsGlobalWindowInner::Open(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/base/nsGlobalWindowInner.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|4075|0x17
0|8|libxul.so|mozilla::dom::Window_Binding::open|s3:gecko-generated-sources:11dd4d25fba36696fe57a27d54f39259aad23bc804fce55161880c1df2f082118fab343b73eefbede0245c767528299b72e86fcf3bb71460a8eee7cd87df1980/dom/bindings/WindowBinding.cpp:|2614|0x2d
0|9|libxul.so|bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::MaybeGlobalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|3374|0x9
0|10|libxul.so|CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|468|0x3
0|11|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|560|0xf
0|12|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|614|0xd
0|13|libxul.so|Interpret|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|620|0xf
0|14|libxul.so|js::RunScript(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|447|0xb
0|15|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|587|0xf
0|16|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|614|0xd
0|17|libxul.so|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|633|0x5
0|18|libxul.so|JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|2975|0x1c
0|19|libxul.so|mozilla::dom::EventListener::HandleEvent(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&)|s3:gecko-generated-sources:b504f583ed3111ab416617cd63caa012e7478d0516eb5d3bc3cd43cef007715c1a91854c0528b0ec8e85f6341ccebf73a1b2c32556687ebaf4023e3c38ff4197/dom/bindings/EventListenerBinding.cpp:|52|0x5
0|20|libxul.so|void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*)|s3:gecko-generated-sources:f3d9c01258576daaac3afc4fb3b283652e7f1168abb5287eff6775451ebd0ab6a0e4c8d88d3a67f7147042501bc091c6dfed25b4b8ccf4e4f420897b8d0ba906/dist/include/mozilla/dom/EventListenerBinding.h:|66|0x1c
0|21|libxul.so|mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|1104|0x26
0|22|libxul.so|mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|1309|0x16
0|23|libxul.so|mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.h:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|391|0x6
0|24|libxul.so|mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|678|0x12
0|25|libxul.so|mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|1165|0x1a
0|26|libxul.so|mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|1249|0x19
0|27|libxul.so|nsINode::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/base/nsINode.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|1142|0x5
0|28|libxul.so|nsContentUtils::DispatchEvent(nsIDocument*, nsISupports*, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::Cancelable, mozilla::Composed, mozilla::Trusted, bool*, mozilla::ChromeOnlyDispatch)|hg:hg.mozilla.org/mozilla-central:dom/base/nsContentUtils.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|4416|0x28
0|29|libxul.so|nsContentUtils::DispatchTrustedEvent(nsIDocument*, nsISupports*, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::Cancelable, mozilla::Composed, bool*)|hg:hg.mozilla.org/mozilla-central:dom/base/nsContentUtils.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|4379|0x10
0|30|libxul.so|nsIDocument::DispatchContentLoadedEvents()|hg:hg.mozilla.org/mozilla-central:dom/base/nsDocument.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|5225|0x5
0|31|libxul.so|mozilla::detail::RunnableMethodImpl<nsIDocument*, void (nsIDocument::*)(), true, (mozilla::RunnableKind)0>::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|1191|0x13
0|32|libxul.so|mozilla::SchedulerGroup::Runnable::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/SchedulerGroup.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|337|0x15
0|33|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|1244|0x11
0|34|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|530|0x11
0|35|libxul.so|mozilla::dom::ContentChild::ProvideWindowCommon(mozilla::dom::TabChild*, mozIDOMWindowProxy*, bool, unsigned int, bool, bool, bool, nsIURI*, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, bool, nsDocShellLoadState*, bool*, mozIDOMWindowProxy**)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|347|0xd
0|36|libxul.so|mozilla::dom::TabChild::ProvideWindow(mozIDOMWindowProxy*, unsigned int, bool, bool, bool, nsIURI*, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, bool, nsDocShellLoadState*, bool*, mozIDOMWindowProxy**)|hg:hg.mozilla.org/mozilla-central:dom/ipc/TabChild.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|1000|0x10
0|37|libxul.so|nsWindowWatcher::OpenWindowInternal(mozIDOMWindowProxy*, char const*, char const*, char const*, bool, bool, bool, nsIArray*, bool, bool, nsDocShellLoadState*, mozIDOMWindowProxy**)|hg:hg.mozilla.org/mozilla-central:toolkit/components/windowwatcher/nsWindowWatcher.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|826|0x34
0|38|libxul.so|nsWindowWatcher::OpenWindow2(mozIDOMWindowProxy*, char const*, char const*, char const*, bool, bool, bool, nsISupports*, bool, bool, nsDocShellLoadState*, mozIDOMWindowProxy**)|hg:hg.mozilla.org/mozilla-central:toolkit/components/windowwatcher/nsWindowWatcher.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|416|0x18
0|39|libxul.so|nsGlobalWindowOuter::OpenInternal(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, bool, bool, bool, bool, bool, nsIArray*, nsISupports*, nsDocShellLoadState*, bool, nsPIDOMWindowOuter**)|hg:hg.mozilla.org/mozilla-central:dom/base/nsGlobalWindowOuter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|7141|0x32
0|40|libxul.so|nsGlobalWindowOuter::OpenJS(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsPIDOMWindowOuter**)|hg:hg.mozilla.org/mozilla-central:dom/base/nsGlobalWindowOuter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|5579|0x18
0|41|libxul.so|nsGlobalWindowOuter::OpenOuter(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/base/nsGlobalWindowOuter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|5545|0x15
0|42|libxul.so|nsGlobalWindowInner::Open(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/base/nsGlobalWindowInner.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|4075|0x17
0|43|libxul.so|mozilla::dom::Window_Binding::open|s3:gecko-generated-sources:11dd4d25fba36696fe57a27d54f39259aad23bc804fce55161880c1df2f082118fab343b73eefbede0245c767528299b72e86fcf3bb71460a8eee7cd87df1980/dom/bindings/WindowBinding.cpp:|2614|0x2d
0|44|libxul.so|bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::MaybeGlobalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|3374|0x9
0|45|||||0x23e4bcab7c2b
0|46|||||0x7f63f5a58750
0|47|||||0x23e4bc8d8b04
0|48|libxul.so|EnterJit|hg:hg.mozilla.org/mozilla-central:js/src/jit/Jit.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|105|0x29
0|49|libxul.so|js::RunScript(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|432|0xb
0|50|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|587|0xf
0|51|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|614|0xd
0|52|libxul.so|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|633|0x5
0|53|libxul.so|JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|2975|0x1c
0|54|libxul.so|mozilla::dom::Function::Call(JSContext*, JS::Handle<JS::Value>, nsTArray<JS::Value> const&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&)|s3:gecko-generated-sources:8608c2289a1d9871b163cf64eb28fe0535b7c0d76562f972c9fc16519592354acf8928f3a87d7291ad2787d69def3a71373afde07f5a14adfa582e642eb71bd4/dom/bindings/FunctionBinding.cpp:|41|0x5
0|55|libxul.so|nsGlobalWindowInner::RunTimeoutHandler(mozilla::dom::Timeout*, nsIScriptContext*)|s3:gecko-generated-sources:22d0e043233e792b3171635349a7c96c260b02daf1d3a3863f1117e8ce67835c880f3e1615498f0338066a4757ac95face8a6a3a49bfe840d14f59c75432afce/dist/include/mozilla/dom/FunctionBinding.h:|73|0x23
0|56|libxul.so|mozilla::dom::TimeoutManager::RunTimeout(mozilla::TimeStamp const&, mozilla::TimeStamp const&)|hg:hg.mozilla.org/mozilla-central:dom/base/TimeoutManager.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|838|0xc
0|57|libxul.so|mozilla::dom::TimeoutExecutor::MaybeExecute()|hg:hg.mozilla.org/mozilla-central:dom/base/TimeoutExecutor.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|168|0xf
0|58|libxul.so|mozilla::dom::TimeoutExecutor::Notify(nsITimer*)|hg:hg.mozilla.org/mozilla-central:dom/base/TimeoutExecutor.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|236|0x5
0|59|libxul.so|nsTimerImpl::Fire(int)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsTimerImpl.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|687|0x11
0|60|libxul.so|nsTimerEvent::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TimerThread.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|297|0x18
0|61|libxul.so|mozilla::ThrottledEventQueue::Inner::ExecuteRunnable()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/ThrottledEventQueue.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|249|0x11
0|62|libxul.so|mozilla::ThrottledEventQueue::Inner::Executor::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/ThrottledEventQueue.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|84|0xd
0|63|libxul.so|mozilla::SchedulerGroup::Runnable::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/SchedulerGroup.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|337|0x15
0|64|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|1244|0x11
0|65|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|530|0x11
0|66|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|97|0xa
0|67|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|325|0x17
0|68|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|318|0x8
0|69|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|158|0xd
0|70|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|954|0x11
0|71|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|269|0x5
0|72|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|325|0x17
0|73|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|318|0x8
0|74|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|780|0x8
0|75|firefox-bin|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|50|0x14
0|76|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|287|0x11
0|77|libc-2.27.so||||0x21b97
0|78|firefox-bin|MOZ_ReportAssertionFailure|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|164|0x5

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: harness.html

Comment 2

[Anne (:annevk)]

Andreas, seems you touched this line last. \o/

Comment 3

[Andreas Farre [:farre]]

Yay! This is probably the same as Bug 1506452 but with a test!

Comment 5

[Andreas Farre [:farre]]

The reason for this asssertion is a window.open happens roughly at the same time as window goes away (for some reason) leaving the newly opened window trying to set its opener to something that is still alive (where alive means being destroyed, but the nsPIDOMWindowOuter* passed to nsGlobalWindowOuter::SetOpenerWindow still pointing to something), but the docshell of that opener has already been torn down.

What to do at this point is a bit vague. Setting an opener that is bound to go away feels shady, but the member tracking it is a weak pointer, so it will go away fairly soon.

What fails in the assert is that we try to compare:

GetBrowsingContext()->GetOpener() == aOpener->GetBrowsingContext()

which is actually:

(mDocShell ? mDocShell->mBrowsingContext : nullptr)->mOpener == (aOpener->mDocShell ? aOpener->mDocShell->mBrowsingContext ? nullptr)

What I propose to do is to add another check in the assert that checks that aOpener->mDocShell isn't null. The reasoning here is that the weak pointers are lagging behind, and will become null soon, so that assertion is only ever valid if things aren't beeing torn down, i.e. the opener has a docshell.

Comment 6

[Andreas Farre [:farre]]

Attachment: Bug 1507168 - Only assert if window isn't being torn down. r=peterv

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/17edafa646ae
Only assert if window isn't being torn down. r=peterv

Comment 8

[Razvan Maries]

https://hg.mozilla.org/mozilla-central/rev/17edafa646ae

Comment 9

[Ryan VanderMeulen [:RyanVM]]

Is it possible/practical to land an automated test for this?

Comment 10

[Andreas Farre [:farre]]

It's bound to be intermittent I think. I can file a follow-up for it and investigate?

Comment 11

[Chris Peterson [:cpeterson]]

Retroactively moving fixed bugs whose summaries mention "Fission" (or other Fission-related keywords) but are not assigned to a Fission Milestone to an appropriate Fission Milestone.

This will generate a lot of bugmail, so you can filter your bugmail for the following UUID and delete them en masse:

0ee3c76a-bc79-4eb2-8d12-05dc0b68e732