1637057 - Assertion failure: opener->mOriginAttributes.EqualsIgnoringFPD(mOriginAttributes)

Status: RESOLVED FIXED

(DevTools :: about:debugging, defect, P3)

Description

[Brian Carpenter [:geeknik]]

STR:

1. Install Firefox Nightly
2. Ensure container tabs are enabled
3. Visit about:debugging#/runtime/this-firefox in a new tab
4. Right click on about:debugging tab and click Reopen in Container and pick any container
5. Click Inspect on any listed item.

Result:

###!!! [Parent][RunMessage] Error: Channel closing: too late to send/recv, messages will be lost

Assertion failure: opener->mOriginAttributes.EqualsIgnoringFPD(mOriginAttributes), at /builds/worker/checkouts/gecko/docshell/base/BrowsingContext.cpp:1335
#01: ???[/home/geeknik/firefox/libxul.so +0xdf49ce1]
#02: ???[/home/geeknik/firefox/libxul.so +0xdf49a0c]
#03: ???[/home/geeknik/firefox/libxul.so +0x60b382b]
#04: ???[/home/geeknik/firefox/libxul.so +0x60a370f]
#05: ???[/home/geeknik/firefox/libxul.so +0x60a62d1]
#06: ???[/home/geeknik/firefox/libxul.so +0xb786dfd]
#07: ???[/home/geeknik/firefox/libxul.so +0xb7fe76d]
#08: ???[/home/geeknik/firefox/libxul.so +0x5a856ea]
#09: ???[/home/geeknik/firefox/libxul.so +0x5db5dfc]
#10: ???[/home/geeknik/firefox/libxul.so +0x60e4afc]
#11: ???[/home/geeknik/firefox/libxul.so +0x6a7022d]
#12: ???[/home/geeknik/firefox/libxul.so +0x832f145]
#13: ??? (???:???)
AddressSanitizer:DEADLYSIGNAL
Exiting due to channel error.
Exiting due to channel error.
Exiting due to channel error.
Exiting due to channel error.

ASAN:

=================================================================
==2112614==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f58be6105b8 bp 0x7fff29b7e050 sp 0x7fff29b7e030 T0)
==2112614==The signal is caused by a WRITE memory access.
==2112614==Hint: address points to the zero page.
    #0 0x7f58be6105b7 in AnnotateMozCrashReason /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:42:19
    #1 0x7f58be6105b7 in mozilla::dom::BrowsingContext::AssertCoherentLoadContext() /builds/worker/checkouts/gecko/docshell/base/BrowsingContext.cpp:1348:3
    #2 0x7f58be60ace0 in mozilla::dom::BrowsingContext::Attach(bool, mozilla::dom::ContentParent*) /builds/worker/checkouts/gecko/docshell/base/BrowsingContext.cpp:514:3
    #3 0x7f58be60aa0b in mozilla::dom::BrowsingContext::EnsureAttached() /builds/worker/checkouts/gecko/docshell/base/BrowsingContext.cpp:331:5
    #4 0x7f58b677482a in nsFrameLoader::EnsureBrowsingContextAttached() /builds/worker/checkouts/gecko/dom/base/nsFrameLoader.cpp:3553:28
    #5 0x7f58b676470e in nsFrameLoader::MaybeCreateDocShell() /builds/worker/checkouts/gecko/dom/base/nsFrameLoader.cpp:2054:8
    #6 0x7f58b67672d0 in nsFrameLoader::Show(nsSubDocumentFrame*) /builds/worker/checkouts/gecko/dom/base/nsFrameLoader.cpp:889:17
    #7 0x7f58bbe47dfc in nsSubDocumentFrame::ShowViewer() /builds/worker/checkouts/gecko/layout/generic/nsSubDocumentFrame.cpp:192:40
    #8 0x7f58bbebf76c in AsyncFrameInit::Run() /builds/worker/checkouts/gecko/layout/generic/nsSubDocumentFrame.cpp:95:60
    #9 0x7f58b61466e9 in nsContentUtils::RemoveScriptBlocker() /builds/worker/checkouts/gecko/dom/base/nsContentUtils.cpp:5342:15
    #10 0x7f58b6476dfb in mozilla::dom::Document::EndUpdate() /builds/worker/checkouts/gecko/dom/base/Document.cpp:7072:3
    #11 0x7f58b67a5afb in ~mozAutoDocUpdate /builds/worker/checkouts/gecko/dom/base/mozAutoDocUpdate.h:34:18
    #12 0x7f58b67a5afb in nsINode::ReplaceOrInsertBefore(bool, nsINode*, nsINode*, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/nsINode.cpp:2670:1
    #13 0x7f58b713122c in InsertBefore /builds/worker/checkouts/gecko/dom/base/nsINode.h:1943:12
    #14 0x7f58b713122c in AppendChild /builds/worker/checkouts/gecko/dom/base/nsINode.h:1946:12
    #15 0x7f58b713122c in mozilla::dom::Node_Binding::appendChild(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/NodeBinding.cpp:989:60
    #16 0x7f58b89f0144 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3203:13
    #17 0x1538742ab14f  (<unknown module>)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:42:19 in AnnotateMozCrashReason
==2112614==ABORTING

Comment 1

[Julian Descottes [:jdescottes]]

Looks like this is a regression from Bug 1633820.

To trigger the bug you don't have to click on Inspect, the following strs work as well:

• open a tab on about:debugging
• move this tab to a container
• click on "Debugging Support" in the bottom left

This button is just a <a> with target="_blank" that should open https://developer.mozilla.org/docs/Tools/about:debugging
It also occurs if you try to run window.open("https://developer.mozilla.org/en-US/docs/Tools/about:debugging") from the console.

I tried a bit with other about: pages. The links in about:preferences seem fine, however, trying to run window.open("https://developer.mozilla.org/en-US/docs/Tools/about:debugging") from the console on about:preferences crashes as well.

Nika, do you know if this issue is already tracked somewhere? about:debugging is a parent process about page defined at https://searchfox.org/mozilla-central/source/devtools/startup/AboutDebuggingRegistration.jsm

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1633820

Comment 3

[Nika Layzell [:nika] (ni? for response)]

I'm glad we have a reproduction! I'll look into fixing this asap.

Comment 5

[Julian Descottes [:jdescottes]]

Setting P3/S3, but that's only based on the about:debugging STRs, I don't have the full context to assess the priority/severity here.

Comment 6

[Nika Layzell [:nika] (ni? for response)]

Attachment: Bug 1637057 - Part 1: Ensure that ChromeFlags are propagated consistently between content owners,

Comment 7

[Nika Layzell [:nika] (ni? for response)]

Attachment: Bug 1637057 - Part 2: Clarify ComputeChromeFlags method names,

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/abbd82257c03
Part 1: Ensure that ChromeFlags are propagated consistently between content owners, r=kmag
https://hg.mozilla.org/integration/autoland/rev/fd9d33b42b69
Part 2: Clarify ComputeChromeFlags method names, r=kmag

Comment 9

[Dorel Luca [:dluca]]

https://hg.mozilla.org/mozilla-central/rev/abbd82257c03
https://hg.mozilla.org/mozilla-central/rev/fd9d33b42b69