Closed Bug 1507168 Opened 6 years ago Closed 6 years ago

Assertion failure: !aOpener || (GetBrowsingContext() && GetBrowsingContext()->GetOpener() == aOpener->GetBrowsingContext()), at /builds/worker/workspace/build/src/dom/base/nsGlobalWindowOuter.cpp:2246

Categories

(Core :: DOM: Core & HTML, defect, P2)

Product:
Core
Component:
DOM: Core & HTML
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla65
Project Flags:
Fission Milestone M4
Tracking Flags:
Tracking Status
firefox-esr60 --- unaffected
firefox63 --- unaffected
firefox64 --- unaffected
firefox65 --- fixed

People

(Reporter: jkratzer, Assigned: farre)

References

(Blocks 2 open bugs)

Details

(Keywords: assertion, testcase)

Attachments

(3 files)

testcase.html
337 bytes, text/html
Details
harness.html
313 bytes, text/html
Details
Bug 1507168 - Only assert if window isn't being torn down. r=peterv
47 bytes, text/x-phabricator-request
Details | Review
Attached file testcase.html —
Testcase found while fuzzing mozilla-central rev 073045259e75. Steps to reproduce: 1. Testcase must be served via a local webserver in order to reproduce. 2. Point firefox at http://localhost/harness.html which calls testcase.html Assertion failure: !aOpener || (GetBrowsingContext() && GetBrowsingContext()->GetOpener() == aOpener->GetBrowsingContext()), at /builds/worker/workspace/build/src/dom/base/nsGlobalWindowOuter.cpp:2246 rax = 0x0000000000000000 rdx = 0x0000000000000000 rcx = 0x0000000000000b40 rbx = 0x00007f63f6982920 rsi = 0x00007f6411d208b0 rdi = 0x00007f6411d1f680 rbp = 0x00007ffdd1d1ab80 rsp = 0x00007ffdd1d1ab30 r8 = 0x00007f6411d208b0 r9 = 0x00007f6412e91740 r10 = 0x0000000000000002 r11 = 0x0000000000000000 r12 = 0x00007f63f5f7c620 r13 = 0x00007ffdd1d1ab40 r14 = 0x0000000000000001 r15 = 0x00007ffdd1d1ab48 rip = 0x00007f6400f3d9a0 OS|Linux|0.0.0 Linux 4.15.0-38-generic #41-Ubuntu SMP Wed Oct 10 10:59:38 UTC 2018 x86_64 CPU|amd64|family 6 model 78 stepping 3|1 GPU||| Crash|SIGSEGV /SEGV_MAPERR|0x0|0 0|0|libxul.so|nsGlobalWindowOuter::SetOpenerWindow(nsPIDOMWindowOuter*, bool)|hg:hg.mozilla.org/mozilla-central:dom/base/nsGlobalWindowOuter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|2275|0x18 0|1|libxul.so|nsWindowWatcher::ReadyOpenedDocShellItem(nsIDocShellTreeItem*, nsPIDOMWindowOuter*, bool, bool, mozIDOMWindowProxy**)|hg:hg.mozilla.org/mozilla-central:toolkit/components/windowwatcher/nsWindowWatcher.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|2075|0x1b 0|2|libxul.so|nsWindowWatcher::OpenWindowInternal(mozIDOMWindowProxy*, char const*, char const*, char const*, bool, bool, bool, nsIArray*, bool, bool, nsDocShellLoadState*, mozIDOMWindowProxy**)|hg:hg.mozilla.org/mozilla-central:toolkit/components/windowwatcher/nsWindowWatcher.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|999|0x1d 0|3|libxul.so|nsWindowWatcher::OpenWindow2(mozIDOMWindowProxy*, char const*, char const*, char const*, bool, bool, bool, nsISupports*, bool, bool, nsDocShellLoadState*, mozIDOMWindowProxy**)|hg:hg.mozilla.org/mozilla-central:toolkit/components/windowwatcher/nsWindowWatcher.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|416|0x18 0|4|libxul.so|nsGlobalWindowOuter::OpenInternal(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, bool, bool, bool, bool, bool, nsIArray*, nsISupports*, nsDocShellLoadState*, bool, nsPIDOMWindowOuter**)|hg:hg.mozilla.org/mozilla-central:dom/base/nsGlobalWindowOuter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|7141|0x32 0|5|libxul.so|nsGlobalWindowOuter::OpenJS(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsPIDOMWindowOuter**)|hg:hg.mozilla.org/mozilla-central:dom/base/nsGlobalWindowOuter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|5579|0x18 0|6|libxul.so|nsGlobalWindowOuter::OpenOuter(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/base/nsGlobalWindowOuter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|5545|0x15 0|7|libxul.so|nsGlobalWindowInner::Open(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/base/nsGlobalWindowInner.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|4075|0x17 0|8|libxul.so|mozilla::dom::Window_Binding::open|s3:gecko-generated-sources:11dd4d25fba36696fe57a27d54f39259aad23bc804fce55161880c1df2f082118fab343b73eefbede0245c767528299b72e86fcf3bb71460a8eee7cd87df1980/dom/bindings/WindowBinding.cpp:|2614|0x2d 0|9|libxul.so|bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::MaybeGlobalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|3374|0x9 0|10|libxul.so|CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|468|0x3 0|11|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|560|0xf 0|12|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|614|0xd 0|13|libxul.so|Interpret|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|620|0xf 0|14|libxul.so|js::RunScript(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|447|0xb 0|15|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|587|0xf 0|16|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|614|0xd 0|17|libxul.so|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|633|0x5 0|18|libxul.so|JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|2975|0x1c 0|19|libxul.so|mozilla::dom::EventListener::HandleEvent(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&)|s3:gecko-generated-sources:b504f583ed3111ab416617cd63caa012e7478d0516eb5d3bc3cd43cef007715c1a91854c0528b0ec8e85f6341ccebf73a1b2c32556687ebaf4023e3c38ff4197/dom/bindings/EventListenerBinding.cpp:|52|0x5 0|20|libxul.so|void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*)|s3:gecko-generated-sources:f3d9c01258576daaac3afc4fb3b283652e7f1168abb5287eff6775451ebd0ab6a0e4c8d88d3a67f7147042501bc091c6dfed25b4b8ccf4e4f420897b8d0ba906/dist/include/mozilla/dom/EventListenerBinding.h:|66|0x1c 0|21|libxul.so|mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|1104|0x26 0|22|libxul.so|mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|1309|0x16 0|23|libxul.so|mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.h:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|391|0x6 0|24|libxul.so|mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|678|0x12 0|25|libxul.so|mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|1165|0x1a 0|26|libxul.so|mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|1249|0x19 0|27|libxul.so|nsINode::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/base/nsINode.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|1142|0x5 0|28|libxul.so|nsContentUtils::DispatchEvent(nsIDocument*, nsISupports*, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::Cancelable, mozilla::Composed, mozilla::Trusted, bool*, mozilla::ChromeOnlyDispatch)|hg:hg.mozilla.org/mozilla-central:dom/base/nsContentUtils.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|4416|0x28 0|29|libxul.so|nsContentUtils::DispatchTrustedEvent(nsIDocument*, nsISupports*, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::Cancelable, mozilla::Composed, bool*)|hg:hg.mozilla.org/mozilla-central:dom/base/nsContentUtils.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|4379|0x10 0|30|libxul.so|nsIDocument::DispatchContentLoadedEvents()|hg:hg.mozilla.org/mozilla-central:dom/base/nsDocument.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|5225|0x5 0|31|libxul.so|mozilla::detail::RunnableMethodImpl<nsIDocument*, void (nsIDocument::*)(), true, (mozilla::RunnableKind)0>::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|1191|0x13 0|32|libxul.so|mozilla::SchedulerGroup::Runnable::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/SchedulerGroup.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|337|0x15 0|33|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|1244|0x11 0|34|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|530|0x11 0|35|libxul.so|mozilla::dom::ContentChild::ProvideWindowCommon(mozilla::dom::TabChild*, mozIDOMWindowProxy*, bool, unsigned int, bool, bool, bool, nsIURI*, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, bool, nsDocShellLoadState*, bool*, mozIDOMWindowProxy**)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|347|0xd 0|36|libxul.so|mozilla::dom::TabChild::ProvideWindow(mozIDOMWindowProxy*, unsigned int, bool, bool, bool, nsIURI*, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, bool, nsDocShellLoadState*, bool*, mozIDOMWindowProxy**)|hg:hg.mozilla.org/mozilla-central:dom/ipc/TabChild.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|1000|0x10 0|37|libxul.so|nsWindowWatcher::OpenWindowInternal(mozIDOMWindowProxy*, char const*, char const*, char const*, bool, bool, bool, nsIArray*, bool, bool, nsDocShellLoadState*, mozIDOMWindowProxy**)|hg:hg.mozilla.org/mozilla-central:toolkit/components/windowwatcher/nsWindowWatcher.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|826|0x34 0|38|libxul.so|nsWindowWatcher::OpenWindow2(mozIDOMWindowProxy*, char const*, char const*, char const*, bool, bool, bool, nsISupports*, bool, bool, nsDocShellLoadState*, mozIDOMWindowProxy**)|hg:hg.mozilla.org/mozilla-central:toolkit/components/windowwatcher/nsWindowWatcher.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|416|0x18 0|39|libxul.so|nsGlobalWindowOuter::OpenInternal(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, bool, bool, bool, bool, bool, nsIArray*, nsISupports*, nsDocShellLoadState*, bool, nsPIDOMWindowOuter**)|hg:hg.mozilla.org/mozilla-central:dom/base/nsGlobalWindowOuter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|7141|0x32 0|40|libxul.so|nsGlobalWindowOuter::OpenJS(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsPIDOMWindowOuter**)|hg:hg.mozilla.org/mozilla-central:dom/base/nsGlobalWindowOuter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|5579|0x18 0|41|libxul.so|nsGlobalWindowOuter::OpenOuter(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/base/nsGlobalWindowOuter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|5545|0x15 0|42|libxul.so|nsGlobalWindowInner::Open(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/base/nsGlobalWindowInner.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|4075|0x17 0|43|libxul.so|mozilla::dom::Window_Binding::open|s3:gecko-generated-sources:11dd4d25fba36696fe57a27d54f39259aad23bc804fce55161880c1df2f082118fab343b73eefbede0245c767528299b72e86fcf3bb71460a8eee7cd87df1980/dom/bindings/WindowBinding.cpp:|2614|0x2d 0|44|libxul.so|bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::MaybeGlobalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|3374|0x9 0|45|||||0x23e4bcab7c2b 0|46|||||0x7f63f5a58750 0|47|||||0x23e4bc8d8b04 0|48|libxul.so|EnterJit|hg:hg.mozilla.org/mozilla-central:js/src/jit/Jit.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|105|0x29 0|49|libxul.so|js::RunScript(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|432|0xb 0|50|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|587|0xf 0|51|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|614|0xd 0|52|libxul.so|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|633|0x5 0|53|libxul.so|JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|2975|0x1c 0|54|libxul.so|mozilla::dom::Function::Call(JSContext*, JS::Handle<JS::Value>, nsTArray<JS::Value> const&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&)|s3:gecko-generated-sources:8608c2289a1d9871b163cf64eb28fe0535b7c0d76562f972c9fc16519592354acf8928f3a87d7291ad2787d69def3a71373afde07f5a14adfa582e642eb71bd4/dom/bindings/FunctionBinding.cpp:|41|0x5 0|55|libxul.so|nsGlobalWindowInner::RunTimeoutHandler(mozilla::dom::Timeout*, nsIScriptContext*)|s3:gecko-generated-sources:22d0e043233e792b3171635349a7c96c260b02daf1d3a3863f1117e8ce67835c880f3e1615498f0338066a4757ac95face8a6a3a49bfe840d14f59c75432afce/dist/include/mozilla/dom/FunctionBinding.h:|73|0x23 0|56|libxul.so|mozilla::dom::TimeoutManager::RunTimeout(mozilla::TimeStamp const&, mozilla::TimeStamp const&)|hg:hg.mozilla.org/mozilla-central:dom/base/TimeoutManager.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|838|0xc 0|57|libxul.so|mozilla::dom::TimeoutExecutor::MaybeExecute()|hg:hg.mozilla.org/mozilla-central:dom/base/TimeoutExecutor.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|168|0xf 0|58|libxul.so|mozilla::dom::TimeoutExecutor::Notify(nsITimer*)|hg:hg.mozilla.org/mozilla-central:dom/base/TimeoutExecutor.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|236|0x5 0|59|libxul.so|nsTimerImpl::Fire(int)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsTimerImpl.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|687|0x11 0|60|libxul.so|nsTimerEvent::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TimerThread.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|297|0x18 0|61|libxul.so|mozilla::ThrottledEventQueue::Inner::ExecuteRunnable()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/ThrottledEventQueue.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|249|0x11 0|62|libxul.so|mozilla::ThrottledEventQueue::Inner::Executor::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/ThrottledEventQueue.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|84|0xd 0|63|libxul.so|mozilla::SchedulerGroup::Runnable::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/SchedulerGroup.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|337|0x15 0|64|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|1244|0x11 0|65|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|530|0x11 0|66|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|97|0xa 0|67|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|325|0x17 0|68|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|318|0x8 0|69|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|158|0xd 0|70|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|954|0x11 0|71|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|269|0x5 0|72|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|325|0x17 0|73|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|318|0x8 0|74|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|780|0x8 0|75|firefox-bin|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|50|0x14 0|76|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|287|0x11 0|77|libc-2.27.so||||0x21b97 0|78|firefox-bin|MOZ_ReportAssertionFailure|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|164|0x5
Flags: in-testsuite?
Attached file harness.html —
Andreas, seems you touched this line last. \o/
Flags: needinfo?(afarre)
Yay! This is probably the same as Bug 1506452 but with a test!
Assignee: nobody → afarre
Flags: needinfo?(afarre)
Priority: -- → P2
The reason for this asssertion is a window.open happens roughly at the same time as window goes away (for some reason) leaving the newly opened window trying to set its opener to something that is still alive (where alive means being destroyed, but the nsPIDOMWindowOuter* passed to nsGlobalWindowOuter::SetOpenerWindow still pointing to something), but the docshell of that opener has already been torn down. What to do at this point is a bit vague. Setting an opener that is bound to go away feels shady, but the member tracking it is a weak pointer, so it will go away fairly soon. What fails in the assert is that we try to compare: GetBrowsingContext()->GetOpener() == aOpener->GetBrowsingContext() which is actually: (mDocShell ? mDocShell->mBrowsingContext : nullptr)->mOpener == (aOpener->mDocShell ? aOpener->mDocShell->mBrowsingContext ? nullptr) What I propose to do is to add another check in the assert that checks that aOpener->mDocShell isn't null. The reasoning here is that the weak pointers are lagging behind, and will become null soon, so that assertion is only ever valid if things aren't beeing torn down, i.e. the opener has a docshell.
Pushed by afarre@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/17edafa646ae Only assert if window isn't being torn down. r=peterv
https://hg.mozilla.org/mozilla-central/rev/17edafa646ae
Status: NEW → RESOLVED
Closed: 6 years ago
status-firefox65: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla65
Is it possible/practical to land an automated test for this?
Blocks: 1502328
status-firefox63: --- → unaffected
status-firefox64: --- → unaffected
status-firefox-esr60: --- → unaffected
Flags: needinfo?(afarre)
It's bound to be intermittent I think. I can file a follow-up for it and investigate?
Flags: needinfo?(afarre)
Component: DOM → DOM: Core & HTML

Retroactively moving fixed bugs whose summaries mention "Fission" (or other Fission-related keywords) but are not assigned to a Fission Milestone to an appropriate Fission Milestone.

This will generate a lot of bugmail, so you can filter your bugmail for the following UUID and delete them en masse:

0ee3c76a-bc79-4eb2-8d12-05dc0b68e732

Fission Milestone: --- → M4
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: