Closed Bug 1648887 Opened 5 years ago Closed 5 years ago

Assertion failure: mIsInProcess, at src/docshell/base/BrowsingContext.cpp:1109

Categories

(Core :: DOM: Navigation, defect, P3)

Product:
Core
Component:
DOM: Navigation
Type:
defect

Tracking

()

Status:
VERIFIED FIXED
Milestone:
81 Branch
Project Flags:
Fission Milestone M6b
Tracking Flags:
Tracking Status
firefox-esr68 --- unaffected
firefox-esr78 --- disabled
firefox79 --- disabled
firefox80 --- disabled
firefox81 --- verified

People

(Reporter: tsmith, Assigned: edgar)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, intermittent-failure, testcase, Whiteboard: [bugmon:bisected,confirmed])

Attachments

(3 files)

testcase.html
210 bytes, text/html
Details
Bug 1648887 - Part 1: Turn the fuzzing test script into automation test;
47 bytes, text/x-phabricator-request
Details | Review
Bug 1648887 - Part 2: Enable test_navigate_after_pagehide.html;
47 bytes, text/x-phabricator-request
Details | Review
Attached file testcase.html —

Assertion failure: mIsInProcess, at /builds/worker/checkouts/gecko/docshell/base/BrowsingContext.cpp:1109

0|0|libxul.so|mozilla::dom::BrowsingContext::HasValidTransientUserGestureActivation()|hg:hg.mozilla.org/mozilla-central:docshell/base/BrowsingContext.cpp:fe147898a052291f6796dd8ff28c80c1358899d6|1109|0x29
0|1|libxul.so|nsWindowWatcher::OpenWindowInternal(mozIDOMWindowProxy*, char const*, char const*, char const*, bool, bool, bool, nsIArray*, bool, bool, bool, nsDocShellLoadState*, mozilla::dom::BrowsingContext**)|hg:hg.mozilla.org/mozilla-central:toolkit/components/windowwatcher/nsWindowWatcher.cpp:fe147898a052291f6796dd8ff28c80c1358899d6|1146|0xd
0|2|libxul.so|nsWindowWatcher::OpenWindow2(mozIDOMWindowProxy*, char const*, char const*, char const*, bool, bool, bool, nsISupports*, bool, bool, bool, nsDocShellLoadState*, mozilla::dom::BrowsingContext**)|hg:hg.mozilla.org/mozilla-central:toolkit/components/windowwatcher/nsWindowWatcher.cpp:fe147898a052291f6796dd8ff28c80c1358899d6|374|0x41
0|3|libxul.so|nsGlobalWindowOuter::OpenInternal(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, bool, bool, bool, bool, bool, nsIArray*, nsISupports*, nsDocShellLoadState*, bool, mozilla::dom::BrowsingContext**)|hg:hg.mozilla.org/mozilla-central:dom/base/nsGlobalWindowOuter.cpp:fe147898a052291f6796dd8ff28c80c1358899d6|7112|0x64
0|4|libxul.so|nsGlobalWindowOuter::OpenOuter(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/base/nsGlobalWindowOuter.cpp:fe147898a052291f6796dd8ff28c80c1358899d6|5655|0x41
0|5|libxul.so|nsGlobalWindowInner::Open(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/base/nsGlobalWindowInner.cpp:fe147898a052291f6796dd8ff28c80c1358899d6|3757|0x27
0|6|libxul.so|mozilla::dom::Window_Binding::open(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&)|s3:gecko-generated-sources:37aa3660aac50617d07feb2e2296f7d57e2dbc351212c4da0b0841a337eac2eeba3dc80d5010e3b407c68f646f24ab1c5105bc6aaf3878de2bc08d37f3e610ae/dom/bindings/WindowBinding.cpp:|2701|0x35
0|7|libxul.so|bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::MaybeCrossOriginObjectThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:fe147898a052291f6796dd8ff28c80c1358899d6|3219|0x1e
0|8|libxul.so|CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:fe147898a052291f6796dd8ff28c80c1358899d6|486|0x12
0|9|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:fe147898a052291f6796dd8ff28c80c1358899d6|578|0xe
0|10|libxul.so|InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:fe147898a052291f6796dd8ff28c80c1358899d6|641|0x10
0|11|libxul.so|Interpret(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:fe147898a052291f6796dd8ff28c80c1358899d6|645|0xa
0|12|libxul.so|js::RunScript(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:fe147898a052291f6796dd8ff28c80c1358899d6|458|0xb
0|13|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:fe147898a052291f6796dd8ff28c80c1358899d6|613|0x8
0|14|libxul.so|InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:fe147898a052291f6796dd8ff28c80c1358899d6|641|0x10
0|15|libxul.so|<name omitted>|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:fe147898a052291f6796dd8ff28c80c1358899d6|658|0xb
0|16|libxul.so|JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:fe147898a052291f6796dd8ff28c80c1358899d6|2842|0x23
0|17|libxul.so|mozilla::dom::EventListener::HandleEvent(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&)|s3:gecko-generated-sources:2563ad09677feb8ddf64827a409899848ef6a80bfacaa11f581c512536a6fb0c779d8b29517ba6358a054c6d475f770bf7bac2913a941d0394881c5649b08603/dom/bindings/EventListenerBinding.cpp:|55|0xe
0|18|libxul.so|void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*)|s3:gecko-generated-sources:99837b3cdc69c5eb1234f9d2b3e771dcff734d56a022bedb1d00c0cf4ee6243fb5c91397a058f2ddab63bda8ed6b581ea1232a0229033866910c7289d24cbc2d/dist/include/mozilla/dom/EventListenerBinding.h:|66|0x21
0|19|libxul.so|mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:fe147898a052291f6796dd8ff28c80c1358899d6|1082|0x2c
0|20|libxul.so|mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:fe147898a052291f6796dd8ff28c80c1358899d6|1280|0x16
0|21|libxul.so|mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:fe147898a052291f6796dd8ff28c80c1358899d6|355|0xb
0|22|libxul.so|mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:fe147898a052291f6796dd8ff28c80c1358899d6|557|0x19
0|23|libxul.so|mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:fe147898a052291f6796dd8ff28c80c1358899d6|1054|0x5
0|24|libxul.so|mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:fe147898a052291f6796dd8ff28c80c1358899d6|0|0x8
0|25|libxul.so|nsINode::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/base/nsINode.cpp:fe147898a052291f6796dd8ff28c80c1358899d6|1302|0x10
0|26|libxul.so|nsContentUtils::DispatchEvent(mozilla::dom::Document*, nsISupports*, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::Cancelable, mozilla::Composed, mozilla::Trusted, bool*, mozilla::ChromeOnlyDispatch)|hg:hg.mozilla.org/mozilla-central:dom/base/nsContentUtils.cpp:fe147898a052291f6796dd8ff28c80c1358899d6|4027|0x23
0|27|libxul.so|nsContentUtils::DispatchTrustedEvent(mozilla::dom::Document*, nsISupports*, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::Cancelable, mozilla::Composed, bool*)|hg:hg.mozilla.org/mozilla-central:dom/base/nsContentUtils.cpp:fe147898a052291f6796dd8ff28c80c1358899d6|3997|0x23
0|28|libxul.so|mozilla::dom::Document::DispatchContentLoadedEvents()|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:fe147898a052291f6796dd8ff28c80c1358899d6|7175|0x21
0|29|libxul.so|mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:fe147898a052291f6796dd8ff28c80c1358899d6|1237|0x17
0|30|libxul.so|mozilla::SchedulerGroup::Runnable::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/SchedulerGroup.cpp:fe147898a052291f6796dd8ff28c80c1358899d6|146|0x11
0|31|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:fe147898a052291f6796dd8ff28c80c1358899d6|1238|0xe
0|32|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:fe147898a052291f6796dd8ff28c80c1358899d6|501|0xc
0|33|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:fe147898a052291f6796dd8ff28c80c1358899d6|87|0x7
0|34|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:fe147898a052291f6796dd8ff28c80c1358899d6|315|0x17
0|35|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:fe147898a052291f6796dd8ff28c80c1358899d6|290|0x8
0|36|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:fe147898a052291f6796dd8ff28c80c1358899d6|137|0xd
0|37|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:fe147898a052291f6796dd8ff28c80c1358899d6|913|0xe
0|38|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:fe147898a052291f6796dd8ff28c80c1358899d6|237|0x5
0|39|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:fe147898a052291f6796dd8ff28c80c1358899d6|315|0x17
0|40|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:fe147898a052291f6796dd8ff28c80c1358899d6|290|0x8
0|41|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:fe147898a052291f6796dd8ff28c80c1358899d6|744|0x5
0|42|firefox-bin|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:fe147898a052291f6796dd8ff28c80c1358899d6|56|0x11
0|43|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:fe147898a052291f6796dd8ff28c80c1358899d6|303|0x20
Flags: in-testsuite?
Whiteboard: [bugmon:bisected,confirmed]
Bugmon Analysis: Verified bug as reproducible on mozilla-central 20200626094540-9b981fcfb6ac. The bug appears to have been introduced in the following build range: > Start: 61bdbb94ab7abd434c60e2a40fa9f07b11237ebb (20200611034550) > End: 9b3cf2944aa064c840285247fa62cdf26e203935 (20200611045214) > Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=61bdbb94ab7abd434c60e2a40fa9f07b11237ebb&tochange=9b3cf2944aa064c840285247fa62cdf26e203935

A Pernosco session is available here: https://pernos.co/debug/mFqK3UERafhKvf10ZY_WBg/index.html

Edgar, could you please look into this as this assertion was added by you in bug 1577499?

Flags: needinfo?(echen)

This assertion happens when we try to reference the gesture state of a out-of-process BS, this is usually a wrong thing, so we assert it to catch possible misuse. I will take a look.

When this is fixed, the skip-if = debug annotation needs to be removed from docshell/test/mochitest/test_navigate_after_pagehide.html

In comment #0 case, we actually reference the correct BC to check the gesture state, but the mIsInProcess is reset to false before we access it due to we process navigation first in the spin event loop.

The mIsInProcess is reset in https://searchfox.org/mozilla-central/rev/8d55e18875b89cdf2a22a7cba60dc40999c18356/docshell/base/BrowsingContext.cpp#700, the stack is like

#0 0x00007f3ec689a494 in mozilla::dom::BrowsingContext::PrepareForProcessChange() (this=0x7f3eafec7800) at /home/edgar/Workspace/mercurial/mozilla-central/docshell/base/BrowsingContext.cpp:696
#1 0x00007f3ec68bb5d2 in nsDocShell::Destroy() (this=0x7f3eafec3800) at /home/edgar/Workspace/mercurial/mozilla-central/docshell/base/nsDocShell.cpp:4235
#2 0x00007f3ec6d7ecc4 in nsWebBrowser::SetDocShell(nsIDocShell*) (this=0x7f3ed7793bc0, aDocShell=0x0) at /home/edgar/Workspace/mercurial/mozilla-central/toolkit/components/browser/nsWebBrowser.cpp:1162
#3 0x00007f3ec6d7d520 in nsWebBrowser::InternalDestroy() (this=0x7f3ed7793bc0) at /home/edgar/Workspace/mercurial/mozilla-central/toolkit/components/browser/nsWebBrowser.cpp:181
#4 0x00007f3ec6d83d95 in nsWebBrowser::Destroy() (this=0x7f3ed7793bc0) at /home/edgar/Workspace/mercurial/mozilla-central/toolkit/components/browser/nsWebBrowser.cpp:873
#5 0x00007f3ec38929f7 in mozilla::dom::BrowserChild::DestroyWindow() (this=0x7f3eafe69800) at /home/edgar/Workspace/mercurial/mozilla-central/dom/ipc/BrowserChild.cpp:894
#6 0x00007f3ec389c8cc in mozilla::dom::BrowserChild::RecvDestroy() (this=0x7f3eafe69800) at /home/edgar/Workspace/mercurial/mozilla-central/dom/ipc/BrowserChild.cpp:2343

And the spin event loop is from https://searchfox.org/mozilla-central/rev/8d55e18875b89cdf2a22a7cba60dc40999c18356/toolkit/components/windowwatcher/nsWindowWatcher.cpp#836, stack is like,

#22 0x00007f3ec3853193 in mozilla::SpinEventLoopUntil<(mozilla::ProcessFailureBehavior)1, mozilla::dom::ContentChild::ProvideWindowCommon(mozilla::dom::BrowserChild*, nsIOpenWindowInfo*, unsigned int, bool, b
ool, nsIURI*, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, bool, bool, nsDocShellLoadState*, bool*, mozilla::dom::BrowsingContext**)::$_9>(mozilla::dom::ContentChild::ProvideWindowCommon(mozilla:
:dom::BrowserChild*, nsIOpenWindowInfo*, unsigned int, bool, bool, nsIURI*, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, bool, bool, nsDocShellLoadState*, bool*, mozilla::dom::BrowsingContext**):
:$_9&&, nsIThread*) (aPredicate=..., aThread=0x0) at /home/edgar/Workspace/mercurial/mozilla-central/objdir-debug/dist/include/nsThreadUtils.h:362
#23 0x00007f3ec3852513 in mozilla::dom::ContentChild::ProvideWindowCommon(mozilla::dom::BrowserChild*, nsIOpenWindowInfo*, unsigned int, bool, bool, nsIURI*, nsTSubstring<char16_t> const&, nsTSubstring<char>
const&, bool, bool, nsDocShellLoadState*, bool*, mozilla::dom::BrowsingContext**) (this=0x7f3ed77d0020, aTabOpener=0x7f3eafe69800, aOpenWindowInfo=0x7f3eb2d23e80, aChromeFlags=3163854, aCalledFromJS=true, aWi
dthSpecified=false, aURI=0x7f3eafeb8100, aName=..., aFeatures=..., aForceNoOpener=false, aForceNoReferrer=false, aLoadState=0x0, aWindowIsNew=0x7fff7fa02287, aReturn=0x7fff7fa02268)
at /home/edgar/Workspace/mercurial/mozilla-central/dom/ipc/ContentChild.cpp:1181
#24 0x00007f3ec38925a5 in mozilla::dom::BrowserChild::ProvideWindow(nsIOpenWindowInfo*, unsigned int, bool, bool, nsIURI*, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, bool, bool, nsDocShellLoadS
tate*, bool*, mozilla::dom::BrowsingContext**) (this=0x7f3eafe69800, aOpenWindowInfo=0x7f3eb2d23e80, aChromeFlags=3163854, aCalledFromJS=true, aWidthSpecified=false, aURI=0x7f3eafeb8100, aName=..., aFeatures=
..., aForceNoOpener=false, aForceNoReferrer=false, aLoadState=0x0, aWindowIsNew=0x7fff7fa02287, aReturn=0x7fff7fa02268) at /home/edgar/Workspace/mercurial/mozilla-central/dom/ipc/BrowserChild.cpp:856
#25 0x00007f3ec389272e in non-virtual thunk to mozilla::dom::BrowserChild::ProvideWindow(nsIOpenWindowInfo*, unsigned int, bool, bool, nsIURI*, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, bool,
bool, nsDocShellLoadState*, bool*, mozilla::dom::BrowsingContext**) () at /home/edgar/Workspace/mercurial/mozilla-central/objdir-debug/dist/bin/libxul.so
#26 0x00007f3ec71d334a in nsWindowWatcher::OpenWindowInternal(mozIDOMWindowProxy*, char const*, char const*, char const*, bool, bool, bool, nsIArray*, bool, bool, bool, nsDocShellLoadState*, mozilla::dom::Bro
wsingContext**) (this=0x7f3eb2df8040, aParent=0x7f3ed7798d60, aUrl=0x7f3eaff29ba8 "<r></r>", aName=0x0, aFeatures=0x7f3eaff28a68 "h", aCalledFromJS=true, aDialog=false, aNavigate=true, aArgv=0x0, aIsPopupSpam
=true, aForceNoOpener=false, aForceNoReferrer=false, aLoadState=0x0, aResult=0x7fff7fa028f8) at /home/edgar/Workspace/mercurial/mozilla-central/toolkit/components/windowwatcher/nsWindowWatcher.cpp:836
#27 0x00007f3ec71d6166 in nsWindowWatcher::OpenWindow2(mozIDOMWindowProxy*, char const*, char const*, char const*, bool, bool, bool, nsISupports*, bool, bool, bool, nsDocShellLoadState*, mozilla::dom::Browsin
gContext**) (this=0x7f3eb2df8040, aParent=0x7f3ed7798d60, aUrl=0x7f3eaff29ba8 "<r></r>", aName=0x0, aFeatures=0x7f3eaff28a68 "h", aCalledFromScript=true, aDialog=false, aNavigate=true, aArguments=0x0, aIsPopu
pSpam=true, aForceNoOpener=false, aForceNoReferrer=false, aLoadState=0x0, aResult=0x7fff7fa028f8) at /home/edgar/Workspace/mercurial/mozilla-central/toolkit/components/windowwatcher/nsWindowWatcher.cpp:374
#28 0x00007f3ec71d62fe in non-virtual thunk to nsWindowWatcher::OpenWindow2(mozIDOMWindowProxy*, char const*, char const*, char const*, bool, bool, bool, nsISupports*, bool, bool, bool, nsDocShellLoadState*,
mozilla::dom::BrowsingContext**) () at /home/edgar/Workspace/mercurial/mozilla-central/objdir-debug/dist/bin/libxul.so

The easier solution would check the gesture state earlier before the spin event loop. Not sure if docshell/test/mochitest/test_navigate_after_pagehide.html is the same case, I will check.

Assignee: nobody → echen
Flags: needinfo?(echen)
Severity: -- → S2

Tracking for Fission M6b Nightly

Fission Milestone: --- → M6b

(In reply to Edgar Chen [:edgar] from comment #7)

The easier solution would check the gesture state earlier before the spin event loop. Not sure if docshell/test/mochitest/test_navigate_after_pagehide.html is the same case, I will check.

It's not. Code from a given inner window can run after the BrowsingContext has navigated to a different origin even with nested event loops, and that code can call things like window.open which checks HasValidTransientUserGestureActivation on the caller BC, which means that it can't just assert that the BC is in process. At the least, it probably needs to check that the caller window is the currently active window for the BC, but it seems like this flag really probably belongs on the WindowContext rather than the BrowsingContext.

(In reply to Kris Maglione [:kmag] from comment #9)

but it seems like this flag really probably belongs on the WindowContext rather than the BrowsingContext.

Yeah, I plan to move the flag to WindowContext in bug 1611961.

Priority: -- → P3
Depends on: 1611961

The assertion crash found by fuzzing is fixed after moving useraction state from
BrowsingContext to WindowContext, see bug 1611961.

This is a another case that hit the same assertion, we could reenable it after
bug 1611961.

Depends on D85752

Pushed by echen@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/b7c7fcb5df37 Part 1: Turn the fuzzing test script into automation test; r=smaug https://hg.mozilla.org/integration/autoland/rev/3719f7db339d Part 2: Enable test_navigate_after_pagehide.html; r=kmag
Backout by ncsoregi@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/de5aa7dd22b5 Backed out 3 changesets (bug 1648887, bug 1611961) for assertion failures on WindowContext.cpp. CLOSED TREE
Pushed by echen@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/0c5402c6e678 Part 1: Turn the fuzzing test script into automation test; r=smaug https://hg.mozilla.org/integration/autoland/rev/040256608f33 Part 2: Enable test_navigate_after_pagehide.html; r=kmag

https://hg.mozilla.org/mozilla-central/rev/0c5402c6e678
https://hg.mozilla.org/mozilla-central/rev/040256608f33

Status: NEW → RESOLVED
Closed: 5 years ago
status-firefox81: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → 81 Branch

Since the status are different for nightly and release, what's the status for beta?
For more information, please visit auto_nag documentation.

status-firefox80: --- → ?
Status: RESOLVED → VERIFIED
status-firefox81: fixed → verified
Keywords: bugmon
Bugmon Analysis: Verified bug as fixed on rev mozilla-central 20200817214602-508a0cc2f6d4. Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: