1664542 - Crash in [@ mozilla::dom::`anonymous namespace'::WebProgressListener::OnStateChange]

Status: VERIFIED FIXED

(Core :: DOM: Navigation, defect, P1)

Description

[[:philipp]]

Crash report: https://crash-stats.mozilla.org/report/index/95076142-2ffd-4b49-bac7-9e99b0200911

Top 10 frames of crashing thread:

0 xul.dll mozilla::dom::`anonymous namespace'::WebProgressListener::OnStateChange dom/clients/manager/ClientOpenWindowUtils.cpp:77
1 xul.dll std::_Func_impl_no_alloc<`lambda at /builds/worker/checkouts/gecko/docshell/base/BrowsingContextWebProgress.cpp:109:7', void, nsIWebProgressListener*>::_Do_call 
2 xul.dll mozilla::dom::BrowsingContextWebProgress::UpdateAndNotifyListeners docshell/base/BrowsingContextWebProgress.cpp:93
3 xul.dll mozilla::dom::BrowsingContextWebProgress::OnStateChange docshell/base/BrowsingContextWebProgress.cpp:107
4 xul.dll mozilla::dom::BrowserParent::RecvOnStateChange dom/ipc/BrowserParent.cpp:2609
5 xul.dll mozilla::dom::PBrowserParent::OnMessageReceived ipc/ipdl/PBrowserParent.cpp:4914
6 xul.dll mozilla::dom::PContentParent::OnMessageReceived ipc/ipdl/PContentParent.cpp:6456
7 xul.dll mozilla::ipc::MessageChannel::DispatchMessage ipc/glue/MessageChannel.cpp:2074
8 xul.dll mozilla::ipc::MessageChannel::MessageTask::Run ipc/glue/MessageChannel.cpp:1953
9 xul.dll mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal xpcom/threads/TaskController.cpp:512

crash reports with this signature seem to have started in firefox 79 (most of the top frames of the stack got touched by bug 1644943).

the volume of this crash is starting to spike up today though, many comments involve push notifications from twitter, so perhaps a change by them is triggering it more frequently now.

• bp-553da54c-cdf3-46c4-b3a6-a8ade0200911: "Notification from Twitter (in a container) appeared, clicked on it, tab started to open, Firefox... Disappeared. Well, okay."
• bp-6bd06c28-5cde-4cda-a002-6123b0200911: "I clicked a toast that was supposed to take me to twitter then boom"
• bp-30573543-813e-48da-8a63-759400200911: "When I clicked on the webpush notification and tried to open twitter, my firefox suddenly went down. Why in the world?"
• bp-3eb290ca-91fd-4410-96ef-65aec0200911: "twitter notification pop up"

Comment 1

[Julien Cristau [:jcristau]]

This is spiking up on all channels in the last couple of days, can someone take a look please?

Comment 2

[Neha Kochar [:neha]]

Asked Nika to take a look.

Comment 3

[Nika Layzell [:nika] (ni? for response)]

Attachment: Bug 1664542 - Part 1: Fix client.openWindow/COOP+COEP crash,

This crash is caused by the mWebProgress field of BrowsingContext being cleared
due to Cross-Origin-Opener-Policy replacing the context on navigation. By
tracking the BrowserId of the opening tab rather than the specific
BrowsingContext, this issue can be avoided.

Comment 4

[Nika Layzell [:nika] (ni? for response)]

Attachment: Bug 1664542 - Part 2: Test client.openWindow/COOP+COEP,

Comment 5

[Ryan VanderMeulen [:RyanVM]]

Hi Nika, is this ready to land? It's showing up in the Fx81 topcrash list.

Comment 6

[Nika Layzell [:nika] (ni? for response)]

Just queued into lando, sorry about the delay.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/13ff387b07fa
Part 1: Fix client.openWindow/COOP+COEP crash, r=asuth
https://hg.mozilla.org/integration/autoland/rev/b3754ac7b886
Part 2: Test client.openWindow/COOP+COEP, r=asuth

Comment 8

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/13ff387b07fa
https://hg.mozilla.org/mozilla-central/rev/b3754ac7b886

Comment 9

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:nika, is this bug important enough to require an uplift?
If not please set status_beta to wontfix.

For more information, please visit auto_nag documentation.

Comment 10

[Nika Layzell [:nika] (ni? for response)]

Comment on attachment 9176395 [details]
Bug 1664542 - Part 1: Fix client.openWindow/COOP+COEP crash,

Beta/Release Uplift Approval Request

• User impact if declined: Crash when clicking on a notification which opens a tab with Cross-Origin-Opener-Policy (such as twitter.com)
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: Yes
• If yes, steps to reproduce: Sign into twitter, and set up push notifications. Receive a notification with your twitter tabs closed, and click on the twitter notification to open the tweet in question.

There are automated tests written for this scenario, but it may be worthwhile to verify the fix on beta after the uplift.

• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): The change has been given automated tests, and fixes a fairly well understood issue. The fix should be unlikely to lead to additional crashes.
• String changes made/needed: None

Comment 11

[Nika Layzell [:nika] (ni? for response)]

Comment on attachment 9176395 [details]
Bug 1664542 - Part 1: Fix client.openWindow/COOP+COEP crash,

See comment 10

Comment 12

[Julien Cristau [:jcristau]]

Comment on attachment 9176395 [details]
Bug 1664542 - Part 1: Fix client.openWindow/COOP+COEP crash,

approved for 82.0b5

Comment 13

[Timea Cernea [:tbabos][inactive]]

Reproduced the issue on Win 7/10 and Ubuntu 16.04 on affected Beta 82.0b4.
Verified-fixed on latest Nightly 83.0a1 (2020-09-29) (64-bit) on Windows 7/10, MacOS 10.15 and Ubuntu 16.04.
Waiting for the fix to be landed on Beta.

Comment 14

[Julien Cristau [:jcristau]]

https://hg.mozilla.org/releases/mozilla-beta/rev/4bb5e89258f0
https://hg.mozilla.org/releases/mozilla-beta/rev/e399e2a12306

Comment 15

[Timea Cernea [:tbabos][inactive]]

Verified-fixed on the latest Beta 82.0b5 on Windows 10, MacOS 10.15 and Ubuntu 16.04.

Comment 16

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9176395 [details]
Bug 1664542 - Part 1: Fix client.openWindow/COOP+COEP crash,

Topcrash fix, approved for 81.0.1.

Comment 17

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-release/rev/21e0546bb5c8
https://hg.mozilla.org/releases/mozilla-release/rev/4c98daa2974a

Comment 18

[Timea Cernea [:tbabos][inactive]]

Verified-fixed on latest Firefox Release 81.0.1 (buildID: 20200930150533) on Windows 10 x64, MacOS 10.15 and Ubuntu 16.04.