1588926 - Enable dom/tests/mochitest/bugs/test_bug260264_nested.html on Fission

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, task, P2)

Description

[Edgar Chen [:edgar] (PTO until 02/09)]

I got assertion crash on Fission.

0:48.98 GECKO(20024) Assertion failure: opener->TabGroup() == mTabGroup, at /home/edgar/Workspace/mercurial/mozilla-central/dom/base/nsGlobalWindowOuter.cpp:7749
1:06.25 GECKO(20024) #01: nsGlobalWindowOuter::TabGroupOuter() (/home/edgar/Workspace/mercurial/mozilla-central/dom/base/nsGlobalWindowOuter.cpp:7748)
1:06.25 GECKO(20024) #02: nsPIDOMWindowOuter::TabGroup() (/home/edgar/Workspace/mercurial/mozilla-central/dom/base/nsGlobalWindowOuter.cpp:7817)
1:06.25 GECKO(20024) #03: nsGlobalWindowOuter::SetIsBackgroundInternal(bool) (/home/edgar/Workspace/mercurial/mozilla-central/dom/base/nsGlobalWindowOuter.cpp:6847)
1:06.25 GECKO(20024) #04: nsGlobalWindowOuter::SetIsBackground(bool) (/home/edgar/Workspace/mercurial/mozilla-central/dom/base/nsGlobalWindowOuter.cpp:6815)
1:08.48 GECKO(20024) #05: nsDocShell::SetIsActive(bool) (/home/edgar/Workspace/mercurial/mozilla-central/docshell/base/nsDocShell.cpp:5206)
1:08.49 GECKO(20024) #06: nsDocShell::SetIsActive(bool) (/home/edgar/Workspace/mercurial/mozilla-central/docshell/base/nsDocShell.cpp:5246)
1:08.88 GECKO(20024) #07: mozilla::dom::BrowserChild::MakeHidden() (/home/edgar/Workspace/mercurial/mozilla-central/dom/ipc/BrowserChild.cpp:2883)
1:08.88 GECKO(20024) #08: mozilla::dom::BrowserChild::UpdateVisibility() (/home/edgar/Workspace/mercurial/mozilla-central/dom/ipc/BrowserChild.cpp:2803)
1:08.89 GECKO(20024) #09: mozilla::dom::BrowserChild::RecvRenderLayers(bool const&, mozilla::layers::LayersObserverEpoch const&) (/home/edgar/Workspace/mercurial/mozilla-central/dom/ipc/BrowserChild.cpp:2522)

Comment 1

[Edgar Chen [:edgar] (PTO until 02/09)]

(In reply to Edgar Chen [:edgar] from comment #0)

I got assertion crash on Fission.

0:48.98 GECKO(20024) Assertion failure: opener->TabGroup() == mTabGroup, at /home/edgar/Workspace/mercurial/mozilla-central/dom/base/nsGlobalWindowOuter.cpp:7749
1:06.25 GECKO(20024) #01: nsGlobalWindowOuter::TabGroupOuter() (/home/edgar/Workspace/mercurial/mozilla-central/dom/base/nsGlobalWindowOuter.cpp:7748)
1:06.25 GECKO(20024) #02: nsPIDOMWindowOuter::TabGroup() (/home/edgar/Workspace/mercurial/mozilla-central/dom/base/nsGlobalWindowOuter.cpp:7817)
1:06.25 GECKO(20024) #03: nsGlobalWindowOuter::SetIsBackgroundInternal(bool) (/home/edgar/Workspace/mercurial/mozilla-central/dom/base/nsGlobalWindowOuter.cpp:6847)
1:06.25 GECKO(20024) #04: nsGlobalWindowOuter::SetIsBackground(bool) (/home/edgar/Workspace/mercurial/mozilla-central/dom/base/nsGlobalWindowOuter.cpp:6815)
1:08.48 GECKO(20024) #05: nsDocShell::SetIsActive(bool) (/home/edgar/Workspace/mercurial/mozilla-central/docshell/base/nsDocShell.cpp:5206)
1:08.49 GECKO(20024) #06: nsDocShell::SetIsActive(bool) (/home/edgar/Workspace/mercurial/mozilla-central/docshell/base/nsDocShell.cpp:5246)
1:08.88 GECKO(20024) #07: mozilla::dom::BrowserChild::MakeHidden() (/home/edgar/Workspace/mercurial/mozilla-central/dom/ipc/BrowserChild.cpp:2883)
1:08.88 GECKO(20024) #08: mozilla::dom::BrowserChild::UpdateVisibility() (/home/edgar/Workspace/mercurial/mozilla-central/dom/ipc/BrowserChild.cpp:2803)
1:08.89 GECKO(20024) #09: mozilla::dom::BrowserChild::RecvRenderLayers(bool const&, mozilla::layers::LayersObserverEpoch const&) (/home/edgar/Workspace/mercurial/mozilla-central/dom/ipc/BrowserChild.cpp:2522)

:kmag, is this something will be solved by the upcoming removal of TabGroups (bug 1561715), maybe? Thanks.

Comment 2

[Edgar Chen [:edgar] (PTO until 02/09)]

(redirect ni? to :nika given that :kmag is unavailable at the moment)

Comment 3

[Nika Layzell [:nika] (ni? for response)]

Given that there is no assertion with the BrowsingContextGroup, I am inclined to believe this is somehow related to TabGroup selection being wrong. That would imply that there's a chance the issue will be fixed by the removal of TabGroups.

That being said, in general this assertion failing means that browsing context isolation has been violated in some way. I would believe that with fission process switches it is possible to violate this old logic though.

Comment 4

[Edgar Chen [:edgar] (PTO until 02/09)]

(In reply to :Nika Layzell (ni? for response) from comment #3)

Given that there is no assertion with the BrowsingContextGroup, I am inclined to believe this is somehow related to TabGroup selection being wrong. That would imply that there's a chance the issue will be fixed by the removal of TabGroups.

That being said, in general this assertion failing means that browsing context isolation has been violated in some way. I would believe that with fission process switches it is possible to violate this old logic though.

Thanks for the comment, let's wait for bug 1561715 to get fixed first.

Comment 5

[Chris Peterson [:cpeterson]]

Tentatively moving all bugs whose summaries mention "Fission" (or other Fission-related keywords) but are not assigned to a Fission Milestone to the "?" triage milestone.

This will generate a lot of bugmail, so you can filter your bugmail for the following UUID and delete them en masse:

0ee3c76a-bc79-4eb2-8d12-05dc0b68e732

Comment 6

[Edgar Chen [:edgar] (PTO until 02/09)]

I tested recent m-c again and the test gets passed If we skip the assertion (It was still got failed maybe a few weeks ago). I guess something gets fixed recently. And after discussing with :farre, I think this bug doesn't need to be blocked by bug 1561715. We could tweak the assertion to make it more sense for Fission, I guess.

Comment 7

[Edgar Chen [:edgar] (PTO until 02/09)]

I debugged this a bit, the test page is doing something like,

a.com/main.html --- <iframe> ---> b.com/child.html --- <iframe> ---> a.com/grandchild.html. And a.com/grandchild.html reference back to the toplevel window (a.com/main.html) via window.open.

And the assertion happens when checking the tabgroup between a.com/grandchild.html and a.com/main.html.
With Fission enabled, we will do process switching for a.com/grandchild.html which will be moved from the process of b.com/child.html to the process of a.com/main.html and it setup tabgroup from BrowserChild, but we always pass 0 for aSameTabGroupAs in https://searchfox.org/mozilla-central/rev/652014ca1183c56bc5f04daf01af180d4e50a91c/dom/ipc/BrowserBridgeParent.cpp#85, so a.com/grandchild.html ends up not in the same tabgroup as a.com/main.html.

Comment 8

[Edgar Chen [:edgar] (PTO until 02/09)]

Attachment: Bug 1588926 - Disable opener tabgroup check in fission mode;

Comment 9

[Edgar Chen [:edgar] (PTO until 02/09)]

Attachment: Bug 1588926 - Enable test_bug260264_nested.html on Fission

Comment 10

[Chris Peterson [:cpeterson]]

Hsin-Yi says this bug depends on BrowsingContextGroup bug 1561715.

Comment 11

[Edgar Chen [:edgar] (PTO until 02/09)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=ad6f4b28fd2b39ce0a8320ca814c4dc8c6b829c7

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/d0d4f71bf26e
Disable opener tabgroup check in fission mode; r=farre
https://hg.mozilla.org/integration/autoland/rev/e29eecc5147c
Enable test_bug260264_nested.html on Fission r=farre

Comment 13

[Stefan Hindli [:stefan_hindli]]

https://hg.mozilla.org/mozilla-central/rev/d0d4f71bf26e
https://hg.mozilla.org/mozilla-central/rev/e29eecc5147c