Closed Bug 1510928 Opened 1 year ago Closed 1 year ago

Assertion: !aOriginalOpener || !aOpener || aOpener->GetBrowsingContext() == GetBrowsingContext()->GetOpener()

Categories

(Core :: DOM: Core & HTML, defect, P2)

65 Branch
defect

Tracking

()

RESOLVED FIXED
mozilla65
Tracking Status
firefox-esr60 --- unaffected
firefox63 --- unaffected
firefox64 --- unaffected
firefox65 --- fixed

People

(Reporter: nils, Assigned: farre)

References

Details

(Keywords: assertion, regression)

Attachments

(4 files)

The following testcase crashes the latest ASAN build of Firefox 65.0a1 (SourceStamp=5972866ac7daab2749b0fc47378169e210367a7f) with the following Assertion:

Assertion failure: !aOriginalOpener || !aOpener || aOpener->GetBrowsingContext() == GetBrowsingContext()->GetOpener(), at /builds/worker/workspace/build/src/dom/base/nsGlobalWindowOuter.cpp:2365

crash.html:
<script>
function start() {
	o33=document.createElementNS('http://www.w3.org/1999/xhtml','iframe');
	o33.addEventListener('load', fun0,false);
	document.body.appendChild(o33);
	o34=document.createElementNS('http://www.w3.org/1999/xhtml','iframe');
	o34.addEventListener('load', fun1,false);
	document.body.appendChild(o34);
	o36=window.document;
}
function fun0() {
	o38=o33.contentWindow;
	o50=o38.open('about:blank','popup64','left=2,centerscreen,toolbar,scrollbars');
}
function fun1() {
	o126=o36.writeln('');
}
</script>
<body onload="start()"></body>

ASAN stack:
Assertion failure: !aOriginalOpener || !aOpener || aOpener->GetBrowsingContext() == GetBrowsingContext()->GetOpener(), at /builds/worker/workspace/build/src/dom/base/nsGlobalWindowOuter.cpp:2365
AddressSanitizer:DEADLYSIGNAL
=================================================================
==19736==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000001 (pc 0x7f090ef8fc71 bp 0x7ffedeb4f910 sp 0x7ffedeb4f8d0 T0)
==19736==The signal is caused by a WRITE memory access.
==19736==Hint: address points to the zero page.
    #0 0x7f090ef8fc70 in AssertSafeToAccessFromNonOwningThread /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/WeakPtr.h:149:5
    #1 0x7f090ef8fc70 in get /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/WeakPtr.h:167
    #2 0x7f090ef8fc70 in operator mozilla::dom::BrowsingContext * /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/WeakPtr.h:276
    #3 0x7f090ef8fc70 in GetOpener /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/BrowsingContext.h:118
    #4 0x7f090ef8fc70 in nsGlobalWindowOuter::SetOpenerWindow(nsPIDOMWindowOuter*, bool) /builds/worker/workspace/build/src/dom/base/nsGlobalWindowOuter.cpp:2346
    #5 0x7f09147b8379 in operator() /builds/worker/workspace/build/src/dom/ipc/ContentChild.cpp:1055:14
    #6 0x7f09147b8379 in std::_Function_handler<void (mozilla::dom::CreatedWindowInfo&&), mozilla::dom::ContentChild::ProvideWindowCommon(mozilla::dom::TabChild*, mozIDOMWindowProxy*, bool, unsigned int, bool, bool, bool, nsIURI*, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, bool, nsDocShellLoadState*, bool*, mozIDOMWindowProxy**)::$_0>::_M_invoke(std::_Any_data const&, mozilla::dom::CreatedWindowInfo&&) /builds/worker/workspace/build/src/clang/bin/../lib/gcc/x86_64-unknown-linux-gnu/4.9.4/../../../../include/c++/4.9.4/functional:2039
    #7 0x7f090c586717 in operator() /builds/worker/workspace/build/src/clang/bin/../lib/gcc/x86_64-unknown-linux-gnu/4.9.4/../../../../include/c++/4.9.4/functional:2440:14
    #8 0x7f090c586717 in Resolve /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/ipc/MessageChannel.h:141
    #9 0x7f090c586717 in mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/build/src/obj-firefox/ipc/ipdl/PContentChild.cpp:9485
    #10 0x7f090c2900b9 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) /builds/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:2245:25
    #11 0x7f090c28ba3a in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) /builds/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:2172:17
    #12 0x7f090c28dc41 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:2009:5
    #13 0x7f090c28eb07 in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:2042:15
    #14 0x7f090b014928 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1244:14
    #15 0x7f090b01d6dd in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:530:10
    #16 0x7f091479d1b4 in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/dom/ipc/ContentChild.cpp:1163:24)> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:347:25
    #17 0x7f091479d1b4 in mozilla::dom::ContentChild::ProvideWindowCommon(mozilla::dom::TabChild*, mozIDOMWindowProxy*, bool, unsigned int, bool, bool, bool, nsIURI*, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, bool, nsDocShellLoadState*, bool*, mozIDOMWindowProxy**) /builds/worker/workspace/build/src/dom/ipc/ContentChild.cpp:1163
    #18 0x7f09148901f5 in mozilla::dom::TabChild::ProvideWindow(mozIDOMWindowProxy*, unsigned int, bool, bool, bool, nsIURI*, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, bool, nsDocShellLoadState*, bool*, mozIDOMWindowProxy**) /builds/worker/workspace/build/src/dom/ipc/TabChild.cpp:978:16
    #19 0x7f0919bcb85d in nsWindowWatcher::OpenWindowInternal(mozIDOMWindowProxy*, char const*, char const*, char const*, bool, bool, bool, nsIArray*, bool, bool, nsDocShellLoadState*, mozIDOMWindowProxy**) /builds/worker/workspace/build/src/toolkit/components/windowwatcher/nsWindowWatcher.cpp:821:24
    #20 0x7f0919bce333 in OpenWindow2 /builds/worker/workspace/build/src/toolkit/components/windowwatcher/nsWindowWatcher.cpp:413:10
    #21 0x7f0919bce333 in non-virtual thunk to nsWindowWatcher::OpenWindow2(mozIDOMWindowProxy*, char const*, char const*, char const*, bool, bool, bool, nsISupports*, bool, bool, nsDocShellLoadState*, mozIDOMWindowProxy**) /builds/worker/workspace/build/src/toolkit/components/windowwatcher/nsWindowWatcher.cpp
    #22 0x7f090efbb9ab in nsGlobalWindowOuter::OpenInternal(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, bool, bool, bool, bool, bool, nsIArray*, nsISupports*, nsDocShellLoadState*, bool, nsPIDOMWindowOuter**) /builds/worker/workspace/build/src/dom/base/nsGlobalWindowOuter.cpp:7244:21
    #23 0x7f090efba4b6 in OpenJS /builds/worker/workspace/build/src/dom/base/nsGlobalWindowOuter.cpp:5673:10
    #24 0x7f090efba4b6 in nsGlobalWindowOuter::OpenOuter(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&) /builds/worker/workspace/build/src/dom/base/nsGlobalWindowOuter.cpp:5648
    #25 0x7f091156210c in mozilla::dom::Window_Binding::open(JSContext*, JS::Handle<JSObject*>, nsGlobalWindowInner*, JSJitMethodCallArgs const&) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/WindowBinding.cpp:2655:56
    #26 0x7f09124e86c1 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::MaybeGlobalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/dom/bindings/BindingUtils.cpp:3377:13
    #27 0x7f091ba9975d in CallJSNative /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:468:15
    #28 0x7f091ba9975d in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:560
    #29 0x7f091ba9bd82 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:634:10
    #30 0x7f091ab39ba1 in js::ForwardingProxyHandler::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) const /builds/worker/workspace/build/src/js/src/proxy/Wrapper.cpp:178:12
    #31 0x7f091aaf1331 in js::CrossCompartmentWrapper::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) const /builds/worker/workspace/build/src/js/src/proxy/CrossCompartmentWrapper.cpp:355:23
    #32 0x7f091ab176c1 in js::Proxy::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) /builds/worker/workspace/build/src/js/src/proxy/Proxy.cpp:560:21
    #33 0x7f091ba9a7fc in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:535:20
    #34 0x7f091ba833e7 in CallFromStack /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:620:12
    #35 0x7f091ba833e7 in Interpret(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:3494
    #36 0x7f091ba669a6 in js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:447:12
    #37 0x7f091ba9a101 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:587:15
    #38 0x7f091ba9bd82 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:634:10
    #39 0x7f091aa5ea66 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/jsapi.cpp:2996:12
    #40 0x7f0911af9a89 in mozilla::dom::EventListener::HandleEvent(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/EventListenerBinding.cpp:52:8
    #41 0x7f0912d3b3d2 in HandleEvent<mozilla::dom::EventTarget *> /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/EventListenerBinding.h:66:12
    #42 0x7f0912d3b3d2 in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) /builds/worker/workspace/build/src/dom/events/EventListenerManager.cpp:1112
    #43 0x7f0912d3da03 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /builds/worker/workspace/build/src/dom/events/EventListenerManager.cpp:1317:15
    #44 0x7f0912d1e3d6 in HandleEvent /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/EventListenerManager.h:390:5
    #45 0x7f0912d1e3d6 in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /builds/worker/workspace/build/src/dom/events/EventDispatcher.cpp:425
    #46 0x7f0912d1c658 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /builds/worker/workspace/build/src/dom/events/EventDispatcher.cpp:642:16
    #47 0x7f0912d230b0 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /builds/worker/workspace/build/src/dom/events/EventDispatcher.cpp:1164:11
    #48 0x7f090ef13073 in nsGlobalWindowInner::PostHandleEvent(mozilla::EventChainPostVisitor&) /builds/worker/workspace/build/src/dom/base/nsGlobalWindowInner.cpp:2127:7
    #49 0x7f0912d1c783 in PostHandleEvent /builds/worker/workspace/build/src/dom/events/EventDispatcher.cpp:530:12
    #50 0x7f0912d1c783 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /builds/worker/workspace/build/src/dom/events/EventDispatcher.cpp:645
    #51 0x7f0912d1d3c6 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /builds/worker/workspace/build/src/dom/events/EventDispatcher.cpp:722:5
    #52 0x7f0912d230b0 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /builds/worker/workspace/build/src/dom/events/EventDispatcher.cpp:1164:11
    #53 0x7f0915ad25fe in nsDocumentViewer::LoadComplete(nsresult) /builds/worker/workspace/build/src/layout/base/nsDocumentViewer.cpp:1164:7
    #54 0x7f0918e75a93 in nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) /builds/worker/workspace/build/src/docshell/base/nsDocShell.cpp:7045:21
    #55 0x7f0918e712c0 in nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /builds/worker/workspace/build/src/docshell/base/nsDocShell.cpp:6836:7
    #56 0x7f0918e7a0b7 in non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /builds/worker/workspace/build/src/docshell/base/nsDocShell.cpp
    #57 0x7f090d984fe5 in nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) /builds/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp:1310:3
    #58 0x7f090d983bcc in nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) /builds/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp:853:14
    #59 0x7f090d97f518 in nsDocLoader::DocLoaderIsEmpty(bool) /builds/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp:742:9
    #60 0x7f090d981e6e in nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, nsresult) /builds/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp:631:5
    #61 0x7f090d9836f4 in non-virtual thunk to nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, nsresult) /builds/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp
    #62 0x7f090b29d1c7 in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) /builds/worker/workspace/build/src/netwerk/base/nsLoadGroup.cpp:628:28
    #63 0x7f090f3bccf7 in DoUnblockOnload /builds/worker/workspace/build/src/dom/base/nsDocument.cpp:8492:18
    #64 0x7f090f3bccf7 in nsDocument::UnblockOnload(bool) /builds/worker/workspace/build/src/dom/base/nsDocument.cpp:8414
    #65 0x7f090f3968d9 in nsIDocument::DispatchContentLoadedEvents() /builds/worker/workspace/build/src/dom/base/nsDocument.cpp:5293:3
    #66 0x7f090f4f706b in applyImpl<nsIDocument, void (nsIDocument::*)()> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1191:12
    #67 0x7f090f4f706b in apply<nsIDocument, void (nsIDocument::*)()> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1197
    #68 0x7f090f4f706b in mozilla::detail::RunnableMethodImpl<nsIDocument*, void (nsIDocument::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1242
    #69 0x7f090afd74e5 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:337:32
    #70 0x7f090b014928 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1244:14
    #71 0x7f090b01d6dd in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:530:10
    #72 0x7f090c29946f in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:97:21
    #73 0x7f090c190c0e in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:325:10
    #74 0x7f090c190c0e in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:318
    #75 0x7f090c190c0e in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:298
    #76 0x7f091522ea93 in nsBaseAppShell::Run() /builds/worker/workspace/build/src/widget/nsBaseAppShell.cpp:158:27
    #77 0x7f0919c7fc8e in XRE_RunAppShell() /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:951:22
    #78 0x7f090c190c0e in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:325:10
    #79 0x7f090c190c0e in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:318
    #80 0x7f090c190c0e in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:298
    #81 0x7f0919c7ecde in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:777:34
    #82 0x563597cf4864 in content_process_main /builds/worker/workspace/build/src/browser/app/../../ipc/contentproc/plugin-container.cpp:50:30
    #83 0x563597cf4864 in main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:287
    #84 0x7f092e97db96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    #85 0x563597c19eec in _start (/home/nils/fuzzer3/firefox/firefox+0x2deec)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/WeakPtr.h:149:5 in AssertSafeToAccessFromNonOwningThread
==19736==ABORTING
Attached file asan.txt
Assertion was added in bug 1502330.
Assignee: nobody → afarre
Blocks: 1502330
Group: core-security → dom-core-security
Flags: needinfo?(afarre)
Is this really a security bug? It's a failing MOZ_DIAGNOSTIC_ASSERT (which I'm by the way super excited about there being a test case for, since we see the same issue over in thunderbird bug 1510382).

This is definitely my priority to fix in any case, but it would be good to know if removing the assert is a good enough fix. The assert is for code running, but not actually code being used.
Flags: needinfo?(afarre)
Per comment 3 and IRC discussion with Andreas, this isn't a security-sensitive assertion. Opening the bug.
Group: dom-core-security
Priority: -- → P2
I managed to clean up the test case a bit, but there are some things I don't understand, for example why the cleanup doesn't work, and why the order of load events are in the order

1) 'load' for the 2nd frame
2) 'load' for the 1st frame

I definitely expected to see the events in insertion order.
Status: NEW → ASSIGNED
Attachment #9028913 - Attachment description: Bug 1510928 - Don't assert when setting opener to closed window. r=peterv → Bug 1510928 - Don't assert when setting opener to closed window.
Pushed by afarre@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/6f780fe1f6cc
Don't assert when setting opener to closed window. r=peterv
https://hg.mozilla.org/mozilla-central/rev/6f780fe1f6cc
Status: ASSIGNED → RESOLVED
Closed: 1 year ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla65
You need to log in before you can comment on or make changes to this bug.