1690804 - Assertion failure: sOpenPopupSpamCount == 0, at /builds/worker/checkouts/gecko/dom/base/PopupBlocker.cpp:413

Status: NEW

(Core :: DOM: Core & HTML, defect)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.zip

Testcase found while fuzzing mozilla-central rev 32690d048b75 (built with --enable-debug).

Assertion failure: sOpenPopupSpamCount == 0, at /builds/worker/checkouts/gecko/dom/base/PopupBlocker.cpp:413

    #0 0x7f12babbfefd in mozilla::dom::PopupBlocker::Shutdown() /builds/worker/checkouts/gecko/dom/base/PopupBlocker.cpp:383:3
    #1 0x7f12bdd550ec in nsLayoutStatics::Shutdown() /builds/worker/checkouts/gecko/layout/build/nsLayoutStatics.cpp:317:3
    #2 0x7f12bdd55039 in Release /builds/worker/checkouts/gecko/layout/build/nsLayoutStatics.h:44:31
    #3 0x7f12bdd55039 in Shutdown /builds/worker/checkouts/gecko/layout/build/nsLayoutModule.cpp:119:3
    #4 0x7f12bdd55039 in nsLayoutModuleDtor() /builds/worker/checkouts/gecko/layout/build/nsLayoutModule.cpp:253:3
    #5 0x7f12b8ec36e9 in nsComponentManagerImpl::Shutdown() /builds/worker/checkouts/gecko/xpcom/components/nsComponentManager.cpp:857:3
    #6 0x7f12b8f362c8 in mozilla::ShutdownXPCOM(nsIServiceManager*) /builds/worker/checkouts/gecko/xpcom/build/XPCOMInit.cpp:732:55
    #7 0x7f12bee31a1c in XRE_TermEmbedding() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:212:3
    #8 0x7f12b98174be in mozilla::ipc::ScopedXREEmbed::Stop() /builds/worker/checkouts/gecko/ipc/glue/ScopedXREEmbed.cpp:90:5
    #9 0x7f12bee32112 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:737:16
    #10 0x556bdb368f76 in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
    #11 0x556bdb368f76 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:306:18
    #12 0x7f12cdf680b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16

Comment 1

[Bugmon [:jkratzer for issues]]

Bugmon Analysis:
Unable to reproduce bug using the following builds:

mozilla-central 20210204093834-32690d048b75
mozilla-central 20210204093834-32690d048b75
Removing bugmon keyword as no further action possible.
Please review the bug and re-add the keyword for further analysis.

Comment 2

[Jason Kratzer [:jkratzer]]

Attachment: testcase.zip

Comment 3

[Jason Kratzer [:jkratzer]]

Attachment: testcase.zip

Comment 4

[Jens Stutte [:jstutte]]

Hi Edgar, that assertion has been introduced by bug 1588720, so hoping this gives you some useful information.

Comment 5

[Edgar Chen [:edgar]]

It seems like BrowsingContext somehow doesn't cleanup the IsPopupSpam field when detaching or releasing. I tried to reproduce it, but did not hit the assertion.

Jason, does this happen when closing the browser or tab? Do you have pernosco session? Thanks.

Comment 6

[Hiroyuki Ikezoe (:hiro)]

FWIW, I tried to reproduce on my Linux box, it sometimes happens when the document in question is closed, but it's a bit hard to notice since even if the assertion happens, the browser process keep running the script in question, I missed the assertions at the first glance.

Comment 7

[Bugmon [:jkratzer for issues]]

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20210224215151-69be3221f49a.
Failed to bisect testcase (Testcase reproduces on start build!):

Start: 7a5cb26a2d518e9cfaf512ba9a06239b573d7f0e (20200227033937)
End: 32690d048b75cc54ead9118c98333d5442d2c6be (20210204093834)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=False, coverage=False, valgrind=False)

Comment 8

[Jason Kratzer [:jkratzer]]

(In reply to Edgar Chen [:edgar] from comment #5)

It seems like BrowsingContext somehow doesn't cleanup the IsPopupSpam field when detaching or releasing. I tried to reproduce it, but did not hit the assertion.

Jason, does this happen when closing the browser or tab? Do you have pernosco session? Thanks.

Edgar, this does appear to be a shutdown crash. I am trying to get a pernosco session for this issue but I'm having some difficulty as this seems to be a timing related issue and the required non optimized -o0 build under rr is significantly slower. I will add it here if and when I manage to get a recording.

Comment 9

[Intermittent Failures Robot]

1 failures in 3967 pushes (0.0 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• autoland: 1

Platform and build breakdown:

• linux1804-64-qr: 1
  • debug: 1

For more details, see:
https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=1690804&startday=2021-03-22&endday=2021-03-28&tree=all