1638793 - Crash in [@ mozilla::dom::BrowsingContext::Attach]

Status: RESOLVED FIXED

(Core :: DOM: Navigation, defect, P2)

Description

[Gabriele Svelto [:gsvelto]]

This bug is for crash report bp-5b8e6832-17ed-4403-8e3e-939f80200516.

Top 10 frames of crashing thread:

0 xul.dll mozilla::dom::BrowsingContext::Attach docshell/base/BrowsingContext.cpp:507
1 xul.dll mozilla::dom::BrowsingContext::EnsureAttached docshell/base/BrowsingContext.cpp:324
2 xul.dll mozilla::dom::ContentChild::ProvideWindowCommon dom/ipc/ContentChild.cpp:953
3 xul.dll mozilla::dom::BrowserChild::ProvideWindow dom/ipc/BrowserChild.cpp:887
4 xul.dll nsWindowWatcher::OpenWindowInternal toolkit/components/windowwatcher/nsWindowWatcher.cpp:837
5 xul.dll nsWindowWatcher::OpenWindow2 toolkit/components/windowwatcher/nsWindowWatcher.cpp:375
6 xul.dll nsGlobalWindowOuter::OpenInternal dom/base/nsGlobalWindowOuter.cpp:7123
7 xul.dll nsGlobalWindowOuter::OpenOuter dom/base/nsGlobalWindowOuter.cpp:5642
8 xul.dll nsGlobalWindowInner::Open dom/base/nsGlobalWindowInner.cpp:3749
9 xul.dll mozilla::dom::Window_Binding::open dom/bindings/WindowBinding.cpp:2701

There's two different crashes under this signature. The first seems to have started in buildid 20200514211114 and is happening in this assertion: MOZ_DIAGNOSTIC_ASSERT(opener->mPrivateBrowsingId == mPrivateBrowsingId).

The other one started in buildid 20200514211114 and is triggered by this other assertion: MOZ_DIAGNOSTIC_ASSERT(opener->mOriginAttributes.EqualsIgnoringFPD(mOriginAttributes))

Comment 1

[Chris Peterson [:cpeterson]]

dupe to bug 1637057 which Nika fixed on May 19.

The most recent crash from buildid 20200519094847 is before Nika's fix.

Comment 2

[[:philipp]]

there are still a handful of these crash reports coming in from devedition users during the 78.0b cycle.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:farre, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 4

[Chris Peterson [:cpeterson]]

We still see both crash signatures in 78.0b5. Nika will investigate since her fix for bug 1637057 didn't fix this crash.

MOZ_DIAGNOSTIC_ASSERT(opener->mPrivateBrowsingId == mPrivateBrowsingId);
bp-078e87d2-e845-4c4b-a3da-2de430200611

MOZ_DIAGNOSTIC_ASSERT(opener->mOriginAttributes.EqualsIgnoringFPD(mOriginAttributes));
bp-f0bfd3c8-910f-4a87-88d2-fe30a0200611

Looks like expanded principals are not getting copied correctly?

Comment 5

[Nika Layzell [:nika] (ni? for response)]

Attachment: Bug 1638793 - Ensure OriginAttributes is set on OpenWindowInfo for expanded principals,

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/9f2cbdd88f3d
Ensure OriginAttributes is set on OpenWindowInfo for expanded principals, r=kmag

Comment 7

[Bogdan Tara[:bogdan_tara | bogdant]]

https://hg.mozilla.org/mozilla-central/rev/9f2cbdd88f3d

Comment 8

[Julien Cristau [:jcristau]]

Does this bug have an impact (beyond the diagnostic assert crash) that warrants uplift?

Comment 9

[Nika Layzell [:nika] (ni? for response)]

Comment on attachment 9156281 [details]
Bug 1638793 - Ensure OriginAttributes is set on OpenWindowInfo for expanded principals,

Beta/Release Uplift Approval Request

• User impact if declined: I don't think this is a regression over the current state, but if we're early enough during a cycle it might be nice to uplift this patch.
  Without this patch, windows opened by an extension content script may occasionally be loaded within the wrong container.
• Is this code covered by automated tests?: Unknown
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Makes a fairly straightforward change to cover a previously unhandled edge-case.
• String changes made/needed: N/A

Comment 10

[Julien Cristau [:jcristau]]

Comment on attachment 9156281 [details]
Bug 1638793 - Ensure OriginAttributes is set on OpenWindowInfo for expanded principals,

we're about to enter RC week for 78, so probably not early enough if this isn't a new regression.

Comment 12

[Ryan VanderMeulen [:RyanVM]]

Is this something we should consider nominating for ESR78 uplift?

Comment 13

[Nika Layzell [:nika] (ni? for response)]

Comment on attachment 9156281 [details]
Bug 1638793 - Ensure OriginAttributes is set on OpenWindowInfo for expanded principals,

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: Low risk potential container mismatch if an extension content script opens a pop-up from a container tab.

I'm not certain that this is a significant enough issue to warrant an uplift, but we can.

• User impact if declined: Some extensions may subtly misbehave when opening pop-ups from container tabs
• Fix Landed on Version: 79
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Small change which has been on nightly for a while without incident
• String or UUID changes made by this patch: None

Comment 14

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9156281 [details]
Bug 1638793 - Ensure OriginAttributes is set on OpenWindowInfo for expanded principals,

Approved for 78.1esr.

Comment 15

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr78/rev/2b15c487636e