Closed Bug 1653530 Opened 4 years ago Closed 4 years ago

Add a regression test to ensure that calling window.open() from a content script in a private tab does not trigger a crash

Categories

(WebExtensions :: General, task, P2)

78 Branch
task

Tracking

(firefox78 wontfix, firefox79 unaffected, firefox80 unaffected, firefox81 fixed)

RESOLVED FIXED
81 Branch
Tracking Status
firefox78 --- wontfix
firefox79 --- unaffected
firefox80 --- unaffected
firefox81 --- fixed

People

(Reporter: CoolCmd, Assigned: rpl)

References

Details

Attachments

(2 files)

Attached file bug1-1-fx.xpi

User Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:78.0) Gecko/20100101 Firefox/78.0

Steps to reproduce:

  1. install attached extension
  2. allow the extension to run in private windows
  3. open https://example.com in private window
  4. click the page

Actual results:

tab crashed

Expected results:

a new tab should open

Hello,

I’ve managed to reproduce the issue only on the latest Release (78.0.2/20200708170202) under Windows 10 Pro 64-bit and Ubuntu 16.04 LTS. The latest Nightly (80.0a1/20200719185002) and Beta (79.0b9/20200717001501) are unaffected by the bug.

I’ve also run a bisection and narrowed it down to https://bugzilla.mozilla.org/show_bug.cgi?id=1611310 (2020-07-20T14:30:22.885000: DEBUG : Found commit message: Backed out changeset 717f97c0d871 (bug 1611310) for causing mass build bustages CLOSED TREE).
This is the corresponding pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=698a0b5420c6dbac37b5d53ed988dcfe0b843f22&tochange=ab5d839fd72dc77633dc58103df5234ba645b1e0 .

Status: UNCONFIRMED → NEW
Has Regression Range: --- → yes
Has STR: --- → yes
Ever confirmed: true

i can confirm that FF 79 does not have this bug

I’ve also run a bisection and narrowed it down to https://bugzilla.mozilla.org/show_bug.cgi?id=1611310 (2020-07-20T14:30:22.885000: DEBUG : Found commit message: Backed out changeset 717f97c0d871 (bug 1611310) for causing mass build bustages CLOSED TREE).
This is the corresponding pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=698a0b5420c6dbac37b5d53ed988dcfe0b843f22&tochange=ab5d839fd72dc77633dc58103df5234ba645b1e0 .

Unless the extension uses XRInputSource the backout from bug 1511310 seems unlikely. But there's a huge change from bug 1616353 in that list, which seems like a much more likely regressor.

Marking the most likely regressor so it shows up as this is likely not an actual WebExtensions problem.

Regressed by: 1616353

Hey Nika, can you please check if this is related to 1616353?

Flags: needinfo?(nika)

Given this is fixed in 79, I'm guessing this is the issue from bug 1638793, which was a fix for a crash introduced via bug 1616353.

Flags: needinfo?(nika)
See Also: → 1638793

With the bug being fixed by bug 1638793, what remains is to write a regression test.

Assignee: nobody → lgreco
Severity: -- → N/A
Type: defect → task
Depends on: 1638793
Priority: -- → P2
Type: task → defect
Type: defect → task
Type: task → defect

Why is the bug bot aggressively changing the task type to "defect" despite my insistence on this bug being a "task"?

Flags: needinfo?(mcastelluccio)
Summary: Private tab crashes on window.open() in content script → Add a regression test to ensure that calling window.open() from a content script in a private tab does not trigger a crash
Type: defect → task

I did verify that the test case attached does trigger the crash and fail when running on an older artifact build that doesn't include the fix introduced in Bug 1638793, and then verified that it does pass successfully when the same test does run on mozilla-central tip where the bug is already fixed.

I did push the attached patch to try here to double-check that it does pass TV job also when running on the build infrastucture:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=7b4707f1e3bd0e40cd3c9f3168a38ced67a66602

Status: NEW → ASSIGNED
Type: task → defect
Pushed by luca.greco@alcacoop.it: https://hg.mozilla.org/integration/autoland/rev/b3b3ebe25dc3 Add an explicit regression test to ensure that a content script can successfully use window.open in a private tab. r=robwu

(In reply to Rob Wu [:robwu] from comment #8)

Why is the bug bot aggressively changing the task type to "defect" despite my insistence on this bug being a "task"?

There is a contradiction in the bug: the bug is set as a regression, but its type is "task". A regression can't be a "task", it must be a "defect".
I'm moving the regression keyword (and the other linked fields) to bug 1638793 where you fixed the actual bug, since this bug is now just tracking adding a test.

Note: it would have been better to duplicate this bug to bug 1638793 instead of morphing it, then file a new bug for adding the test.

Type: defect → task
Has Regression Range: yes → ---
Has STR: yes → ---
Flags: needinfo?(mcastelluccio)
Keywords: regression
No longer regressed by: 1616353
Status: ASSIGNED → RESOLVED
Closed: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → 81 Branch
See Also: → 1605518
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: