Open Bug 1690804 Opened 3 years ago Updated 3 years ago

Assertion failure: sOpenPopupSpamCount == 0, at /builds/worker/checkouts/gecko/dom/base/PopupBlocker.cpp:413

Categories

(Core :: DOM: Core & HTML, defect)

defect

Tracking

()

Tracking Status
firefox87 --- affected

People

(Reporter: jkratzer, Unassigned)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: assertion, regression, testcase, Whiteboard: [bugmon:bisected,confirmed])

Attachments

(1 file, 2 obsolete files)

Attached file testcase.zip (obsolete) —

Testcase found while fuzzing mozilla-central rev 32690d048b75 (built with --enable-debug).

Assertion failure: sOpenPopupSpamCount == 0, at /builds/worker/checkouts/gecko/dom/base/PopupBlocker.cpp:413

    #0 0x7f12babbfefd in mozilla::dom::PopupBlocker::Shutdown() /builds/worker/checkouts/gecko/dom/base/PopupBlocker.cpp:383:3
    #1 0x7f12bdd550ec in nsLayoutStatics::Shutdown() /builds/worker/checkouts/gecko/layout/build/nsLayoutStatics.cpp:317:3
    #2 0x7f12bdd55039 in Release /builds/worker/checkouts/gecko/layout/build/nsLayoutStatics.h:44:31
    #3 0x7f12bdd55039 in Shutdown /builds/worker/checkouts/gecko/layout/build/nsLayoutModule.cpp:119:3
    #4 0x7f12bdd55039 in nsLayoutModuleDtor() /builds/worker/checkouts/gecko/layout/build/nsLayoutModule.cpp:253:3
    #5 0x7f12b8ec36e9 in nsComponentManagerImpl::Shutdown() /builds/worker/checkouts/gecko/xpcom/components/nsComponentManager.cpp:857:3
    #6 0x7f12b8f362c8 in mozilla::ShutdownXPCOM(nsIServiceManager*) /builds/worker/checkouts/gecko/xpcom/build/XPCOMInit.cpp:732:55
    #7 0x7f12bee31a1c in XRE_TermEmbedding() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:212:3
    #8 0x7f12b98174be in mozilla::ipc::ScopedXREEmbed::Stop() /builds/worker/checkouts/gecko/ipc/glue/ScopedXREEmbed.cpp:90:5
    #9 0x7f12bee32112 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:737:16
    #10 0x556bdb368f76 in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
    #11 0x556bdb368f76 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:306:18
    #12 0x7f12cdf680b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
Flags: in-testsuite?
Attached file testcase.zip (obsolete) —
Attachment #9201165 - Attachment is obsolete: true
Whiteboard: [bugmon:confirmed] → [bugmon:confirm]
Attached file testcase.zip
Attachment #9201254 - Attachment is obsolete: true
Component: Layout → DOM: Core & HTML

Hi Edgar, that assertion has been introduced by bug 1588720, so hoping this gives you some useful information.

Flags: needinfo?(echen)
Regressed by: 1588720
Has Regression Range: --- → yes

It seems like BrowsingContext somehow doesn't cleanup the IsPopupSpam field when detaching or releasing. I tried to reproduce it, but did not hit the assertion.

Jason, does this happen when closing the browser or tab? Do you have pernosco session? Thanks.

Flags: needinfo?(echen) → needinfo?(jkratzer)

FWIW, I tried to reproduce on my Linux box, it sometimes happens when the document in question is closed, but it's a bit hard to notice since even if the assertion happens, the browser process keep running the script in question, I missed the assertions at the first glance.

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20210224215151-69be3221f49a.
Failed to bisect testcase (Testcase reproduces on start build!):

Start: 7a5cb26a2d518e9cfaf512ba9a06239b573d7f0e (20200227033937)
End: 32690d048b75cc54ead9118c98333d5442d2c6be (20210204093834)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=False, coverage=False, valgrind=False)

Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]

(In reply to Edgar Chen [:edgar] from comment #5)

It seems like BrowsingContext somehow doesn't cleanup the IsPopupSpam field when detaching or releasing. I tried to reproduce it, but did not hit the assertion.

Jason, does this happen when closing the browser or tab? Do you have pernosco session? Thanks.

Edgar, this does appear to be a shutdown crash. I am trying to get a pernosco session for this issue but I'm having some difficulty as this seems to be a timing related issue and the required non optimized -o0 build under rr is significantly slower. I will add it here if and when I manage to get a recording.

Flags: needinfo?(jkratzer)
See Also: → 1407901
See Also: → 1306458
Severity: -- → S3
No longer blocks: domino
Depends on: domino
Blocks: domino
No longer depends on: domino
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: