1645997 - Crash in [@ mozilla::dom::WindowContext::TopWindowContext]

Status: RESOLVED FIXED

(Core :: DOM: Security, defect, P1)

Description

[Alex Chronopoulos [:achronop]]

This bug is for crash report bp-6e389eff-7965-42e7-ba59-d40280200615.

Top 10 frames of crashing thread:

0 xul.dll mozilla::dom::WindowContext::TopWindowContext docshell/base/WindowContext.cpp:60
1 xul.dll mozilla::PermissionDelegateHandler::GetPermission extensions/permissions/PermissionDelegateHandler.cpp:254
2 xul.dll mozilla::MediaManager::IsActivelyCapturingOrHasAPermission dom/media/MediaManager.cpp:4041
3 xul.dll mozilla::PeerConnectionMedia::GetPrefObfuscateHostAddresses const media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.cpp:338
4 xul.dll mozilla::PeerConnectionMedia::GatherIfReady media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.cpp:449
5 xul.dll mozilla::PeerConnectionImpl::OnSetDescriptionSuccess media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp:2281
6 xul.dll mozilla::PeerConnectionImpl::SetLocalDescription media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp:1356
7 xul.dll mozilla::dom::PeerConnectionImpl_Binding::setLocalDescription dom/bindings/PeerConnectionImplBinding.cpp:236
8 xul.dll mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions> dom/bindings/BindingUtils.cpp:3219
9 xul.dll js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:578

I believe this is a regression from 1587743 because crash started right after it landed, and because those patches make use of WindowContext::TopWindowContext().

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1587743

Comment 2

[Tim Huang[:timhuang]]

I suspect that we call the WindowContext::TopWindowContext() on a nullptr. This means the document where we get the windowContext is detached from a window. This could happen, I will write a patch to fix this.

Comment 3

[Tim Huang[:timhuang]]

Attachment: Bug 1645997 - Use BrowsingContext to get the top-level window context in PermissionDelegateHandler.cpp r?baku!

We used the Document::GetWindowContext() to get the window context
related to the doucment. But, this could return a nullptr if the
document is detached from the window or the docuemnt is destoried.

We move to use the BrowsingContext instead which won't return a nullptr
in these cases.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/08c6683cd6be
Use BrowsingContext to get the top-level window context in PermissionDelegateHandler.cpp r=baku

Comment 5

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/08c6683cd6be