Closed Bug 1507168 Opened 1 year ago Closed 1 year ago

Assertion failure: !aOpener || (GetBrowsingContext() && GetBrowsingContext()->GetOpener() == aOpener->GetBrowsingContext()), at /builds/worker/workspace/build/src/dom/base/nsGlobalWindowOuter.cpp:2246

Categories

(Core :: DOM: Core & HTML, defect, P2)

defect

Tracking

()

RESOLVED FIXED
mozilla65
Fission Milestone M4
Tracking Status
firefox-esr60 --- unaffected
firefox63 --- unaffected
firefox64 --- unaffected
firefox65 --- fixed

People

(Reporter: jkratzer, Assigned: farre)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(3 files)

Attached file testcase.html
Testcase found while fuzzing mozilla-central rev 073045259e75.  

Steps to reproduce:
1. Testcase must be served via a local webserver in order to reproduce.
2. Point firefox at http://localhost/harness.html which calls testcase.html

Assertion failure: !aOpener || (GetBrowsingContext() && GetBrowsingContext()->GetOpener() == aOpener->GetBrowsingContext()), at /builds/worker/workspace/build/src/dom/base/nsGlobalWindowOuter.cpp:2246

rax = 0x0000000000000000   rdx = 0x0000000000000000
rcx = 0x0000000000000b40   rbx = 0x00007f63f6982920
rsi = 0x00007f6411d208b0   rdi = 0x00007f6411d1f680
rbp = 0x00007ffdd1d1ab80   rsp = 0x00007ffdd1d1ab30
r8 = 0x00007f6411d208b0    r9 = 0x00007f6412e91740
r10 = 0x0000000000000002   r11 = 0x0000000000000000
r12 = 0x00007f63f5f7c620   r13 = 0x00007ffdd1d1ab40
r14 = 0x0000000000000001   r15 = 0x00007ffdd1d1ab48
rip = 0x00007f6400f3d9a0
OS|Linux|0.0.0 Linux 4.15.0-38-generic #41-Ubuntu SMP Wed Oct 10 10:59:38 UTC 2018 x86_64
CPU|amd64|family 6 model 78 stepping 3|1
GPU|||
Crash|SIGSEGV /SEGV_MAPERR|0x0|0
0|0|libxul.so|nsGlobalWindowOuter::SetOpenerWindow(nsPIDOMWindowOuter*, bool)|hg:hg.mozilla.org/mozilla-central:dom/base/nsGlobalWindowOuter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|2275|0x18
0|1|libxul.so|nsWindowWatcher::ReadyOpenedDocShellItem(nsIDocShellTreeItem*, nsPIDOMWindowOuter*, bool, bool, mozIDOMWindowProxy**)|hg:hg.mozilla.org/mozilla-central:toolkit/components/windowwatcher/nsWindowWatcher.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|2075|0x1b
0|2|libxul.so|nsWindowWatcher::OpenWindowInternal(mozIDOMWindowProxy*, char const*, char const*, char const*, bool, bool, bool, nsIArray*, bool, bool, nsDocShellLoadState*, mozIDOMWindowProxy**)|hg:hg.mozilla.org/mozilla-central:toolkit/components/windowwatcher/nsWindowWatcher.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|999|0x1d
0|3|libxul.so|nsWindowWatcher::OpenWindow2(mozIDOMWindowProxy*, char const*, char const*, char const*, bool, bool, bool, nsISupports*, bool, bool, nsDocShellLoadState*, mozIDOMWindowProxy**)|hg:hg.mozilla.org/mozilla-central:toolkit/components/windowwatcher/nsWindowWatcher.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|416|0x18
0|4|libxul.so|nsGlobalWindowOuter::OpenInternal(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, bool, bool, bool, bool, bool, nsIArray*, nsISupports*, nsDocShellLoadState*, bool, nsPIDOMWindowOuter**)|hg:hg.mozilla.org/mozilla-central:dom/base/nsGlobalWindowOuter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|7141|0x32
0|5|libxul.so|nsGlobalWindowOuter::OpenJS(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsPIDOMWindowOuter**)|hg:hg.mozilla.org/mozilla-central:dom/base/nsGlobalWindowOuter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|5579|0x18
0|6|libxul.so|nsGlobalWindowOuter::OpenOuter(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/base/nsGlobalWindowOuter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|5545|0x15
0|7|libxul.so|nsGlobalWindowInner::Open(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/base/nsGlobalWindowInner.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|4075|0x17
0|8|libxul.so|mozilla::dom::Window_Binding::open|s3:gecko-generated-sources:11dd4d25fba36696fe57a27d54f39259aad23bc804fce55161880c1df2f082118fab343b73eefbede0245c767528299b72e86fcf3bb71460a8eee7cd87df1980/dom/bindings/WindowBinding.cpp:|2614|0x2d
0|9|libxul.so|bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::MaybeGlobalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|3374|0x9
0|10|libxul.so|CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|468|0x3
0|11|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|560|0xf
0|12|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|614|0xd
0|13|libxul.so|Interpret|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|620|0xf
0|14|libxul.so|js::RunScript(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|447|0xb
0|15|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|587|0xf
0|16|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|614|0xd
0|17|libxul.so|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|633|0x5
0|18|libxul.so|JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|2975|0x1c
0|19|libxul.so|mozilla::dom::EventListener::HandleEvent(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&)|s3:gecko-generated-sources:b504f583ed3111ab416617cd63caa012e7478d0516eb5d3bc3cd43cef007715c1a91854c0528b0ec8e85f6341ccebf73a1b2c32556687ebaf4023e3c38ff4197/dom/bindings/EventListenerBinding.cpp:|52|0x5
0|20|libxul.so|void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*)|s3:gecko-generated-sources:f3d9c01258576daaac3afc4fb3b283652e7f1168abb5287eff6775451ebd0ab6a0e4c8d88d3a67f7147042501bc091c6dfed25b4b8ccf4e4f420897b8d0ba906/dist/include/mozilla/dom/EventListenerBinding.h:|66|0x1c
0|21|libxul.so|mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|1104|0x26
0|22|libxul.so|mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|1309|0x16
0|23|libxul.so|mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.h:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|391|0x6
0|24|libxul.so|mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|678|0x12
0|25|libxul.so|mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|1165|0x1a
0|26|libxul.so|mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|1249|0x19
0|27|libxul.so|nsINode::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/base/nsINode.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|1142|0x5
0|28|libxul.so|nsContentUtils::DispatchEvent(nsIDocument*, nsISupports*, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::Cancelable, mozilla::Composed, mozilla::Trusted, bool*, mozilla::ChromeOnlyDispatch)|hg:hg.mozilla.org/mozilla-central:dom/base/nsContentUtils.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|4416|0x28
0|29|libxul.so|nsContentUtils::DispatchTrustedEvent(nsIDocument*, nsISupports*, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::Cancelable, mozilla::Composed, bool*)|hg:hg.mozilla.org/mozilla-central:dom/base/nsContentUtils.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|4379|0x10
0|30|libxul.so|nsIDocument::DispatchContentLoadedEvents()|hg:hg.mozilla.org/mozilla-central:dom/base/nsDocument.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|5225|0x5
0|31|libxul.so|mozilla::detail::RunnableMethodImpl<nsIDocument*, void (nsIDocument::*)(), true, (mozilla::RunnableKind)0>::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|1191|0x13
0|32|libxul.so|mozilla::SchedulerGroup::Runnable::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/SchedulerGroup.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|337|0x15
0|33|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|1244|0x11
0|34|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|530|0x11
0|35|libxul.so|mozilla::dom::ContentChild::ProvideWindowCommon(mozilla::dom::TabChild*, mozIDOMWindowProxy*, bool, unsigned int, bool, bool, bool, nsIURI*, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, bool, nsDocShellLoadState*, bool*, mozIDOMWindowProxy**)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|347|0xd
0|36|libxul.so|mozilla::dom::TabChild::ProvideWindow(mozIDOMWindowProxy*, unsigned int, bool, bool, bool, nsIURI*, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, bool, nsDocShellLoadState*, bool*, mozIDOMWindowProxy**)|hg:hg.mozilla.org/mozilla-central:dom/ipc/TabChild.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|1000|0x10
0|37|libxul.so|nsWindowWatcher::OpenWindowInternal(mozIDOMWindowProxy*, char const*, char const*, char const*, bool, bool, bool, nsIArray*, bool, bool, nsDocShellLoadState*, mozIDOMWindowProxy**)|hg:hg.mozilla.org/mozilla-central:toolkit/components/windowwatcher/nsWindowWatcher.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|826|0x34
0|38|libxul.so|nsWindowWatcher::OpenWindow2(mozIDOMWindowProxy*, char const*, char const*, char const*, bool, bool, bool, nsISupports*, bool, bool, nsDocShellLoadState*, mozIDOMWindowProxy**)|hg:hg.mozilla.org/mozilla-central:toolkit/components/windowwatcher/nsWindowWatcher.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|416|0x18
0|39|libxul.so|nsGlobalWindowOuter::OpenInternal(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, bool, bool, bool, bool, bool, nsIArray*, nsISupports*, nsDocShellLoadState*, bool, nsPIDOMWindowOuter**)|hg:hg.mozilla.org/mozilla-central:dom/base/nsGlobalWindowOuter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|7141|0x32
0|40|libxul.so|nsGlobalWindowOuter::OpenJS(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsPIDOMWindowOuter**)|hg:hg.mozilla.org/mozilla-central:dom/base/nsGlobalWindowOuter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|5579|0x18
0|41|libxul.so|nsGlobalWindowOuter::OpenOuter(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/base/nsGlobalWindowOuter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|5545|0x15
0|42|libxul.so|nsGlobalWindowInner::Open(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/base/nsGlobalWindowInner.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|4075|0x17
0|43|libxul.so|mozilla::dom::Window_Binding::open|s3:gecko-generated-sources:11dd4d25fba36696fe57a27d54f39259aad23bc804fce55161880c1df2f082118fab343b73eefbede0245c767528299b72e86fcf3bb71460a8eee7cd87df1980/dom/bindings/WindowBinding.cpp:|2614|0x2d
0|44|libxul.so|bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::MaybeGlobalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|3374|0x9
0|45|||||0x23e4bcab7c2b
0|46|||||0x7f63f5a58750
0|47|||||0x23e4bc8d8b04
0|48|libxul.so|EnterJit|hg:hg.mozilla.org/mozilla-central:js/src/jit/Jit.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|105|0x29
0|49|libxul.so|js::RunScript(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|432|0xb
0|50|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|587|0xf
0|51|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|614|0xd
0|52|libxul.so|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|633|0x5
0|53|libxul.so|JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|2975|0x1c
0|54|libxul.so|mozilla::dom::Function::Call(JSContext*, JS::Handle<JS::Value>, nsTArray<JS::Value> const&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&)|s3:gecko-generated-sources:8608c2289a1d9871b163cf64eb28fe0535b7c0d76562f972c9fc16519592354acf8928f3a87d7291ad2787d69def3a71373afde07f5a14adfa582e642eb71bd4/dom/bindings/FunctionBinding.cpp:|41|0x5
0|55|libxul.so|nsGlobalWindowInner::RunTimeoutHandler(mozilla::dom::Timeout*, nsIScriptContext*)|s3:gecko-generated-sources:22d0e043233e792b3171635349a7c96c260b02daf1d3a3863f1117e8ce67835c880f3e1615498f0338066a4757ac95face8a6a3a49bfe840d14f59c75432afce/dist/include/mozilla/dom/FunctionBinding.h:|73|0x23
0|56|libxul.so|mozilla::dom::TimeoutManager::RunTimeout(mozilla::TimeStamp const&, mozilla::TimeStamp const&)|hg:hg.mozilla.org/mozilla-central:dom/base/TimeoutManager.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|838|0xc
0|57|libxul.so|mozilla::dom::TimeoutExecutor::MaybeExecute()|hg:hg.mozilla.org/mozilla-central:dom/base/TimeoutExecutor.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|168|0xf
0|58|libxul.so|mozilla::dom::TimeoutExecutor::Notify(nsITimer*)|hg:hg.mozilla.org/mozilla-central:dom/base/TimeoutExecutor.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|236|0x5
0|59|libxul.so|nsTimerImpl::Fire(int)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsTimerImpl.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|687|0x11
0|60|libxul.so|nsTimerEvent::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TimerThread.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|297|0x18
0|61|libxul.so|mozilla::ThrottledEventQueue::Inner::ExecuteRunnable()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/ThrottledEventQueue.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|249|0x11
0|62|libxul.so|mozilla::ThrottledEventQueue::Inner::Executor::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/ThrottledEventQueue.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|84|0xd
0|63|libxul.so|mozilla::SchedulerGroup::Runnable::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/SchedulerGroup.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|337|0x15
0|64|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|1244|0x11
0|65|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|530|0x11
0|66|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|97|0xa
0|67|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|325|0x17
0|68|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|318|0x8
0|69|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|158|0xd
0|70|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|954|0x11
0|71|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|269|0x5
0|72|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|325|0x17
0|73|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|318|0x8
0|74|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|780|0x8
0|75|firefox-bin|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|50|0x14
0|76|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|287|0x11
0|77|libc-2.27.so||||0x21b97
0|78|firefox-bin|MOZ_ReportAssertionFailure|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|164|0x5
Flags: in-testsuite?
Attached file harness.html
Andreas, seems you touched this line last. \o/
Flags: needinfo?(afarre)
Yay! This is probably the same as Bug 1506452 but with a test!
Assignee: nobody → afarre
Flags: needinfo?(afarre)
Priority: -- → P2
Duplicate of this bug: 1506452
The reason for this asssertion is a window.open happens roughly at the same time as window goes away (for some reason) leaving the newly opened window trying to set its opener to something that is still alive (where alive means being destroyed, but the nsPIDOMWindowOuter* passed to nsGlobalWindowOuter::SetOpenerWindow still pointing to something), but the docshell of that opener has already been torn down.

What to do at this point is a bit vague. Setting an opener that is bound to go away feels shady, but the member tracking it is a weak pointer, so it will go away fairly soon.

What fails in the assert is that we try to compare:

GetBrowsingContext()->GetOpener() == aOpener->GetBrowsingContext()

which is actually:

(mDocShell ? mDocShell->mBrowsingContext : nullptr)->mOpener == (aOpener->mDocShell ? aOpener->mDocShell->mBrowsingContext ? nullptr)

What I propose to do is to add another check in the assert that checks that aOpener->mDocShell isn't null. The reasoning here is that the weak pointers are lagging behind, and will become null soon, so that assertion is only ever valid if things aren't beeing torn down, i.e. the opener has a docshell.
Pushed by afarre@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/17edafa646ae
Only assert if window isn't being torn down. r=peterv
https://hg.mozilla.org/mozilla-central/rev/17edafa646ae
Status: NEW → RESOLVED
Closed: 1 year ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla65
Is it possible/practical to land an automated test for this?
Blocks: 1502328
Flags: needinfo?(afarre)
It's bound to be intermittent I think. I can file a follow-up for it and investigate?
Flags: needinfo?(afarre)
Component: DOM → DOM: Core & HTML

Retroactively moving fixed bugs whose summaries mention "Fission" (or other Fission-related keywords) but are not assigned to a Fission Milestone to an appropriate Fission Milestone.

This will generate a lot of bugmail, so you can filter your bugmail for the following UUID and delete them en masse:

0ee3c76a-bc79-4eb2-8d12-05dc0b68e732

Fission Milestone: --- → M4
You need to log in before you can comment on or make changes to this bug.