1920534 - Crash in [@ nsPIDOMWindowInner::GetOuterWindow] from CookieStore::GetInternal

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Andrew McCreight [:mccr8]]

Crash report: https://crash-stats.mozilla.org/report/index/687cd703-3b3c-4bfa-a6f9-666650240921

Reason: SIGSEGV / SEGV_MAPERR

Top 10 frames:

0  libxul.so  nsCOMPtr<nsPIDOMWindowOuter>::get() const  xpcom/base/nsCOMPtr.h:751
0  libxul.so  nsCOMPtr<nsPIDOMWindowOuter>::operator nsPIDOMWindowOuter*() const&  xpcom/base/nsCOMPtr.h:759
0  libxul.so  nsPIDOMWindowInner::GetOuterWindow() const  dom/base/nsPIDOMWindow.h:118
0  libxul.so  mozilla::dom::(anonymous namespace)::GetContextAttributes(mozilla::dom::Cooki...  dom/cookiestore/CookieStore.cpp:212
1  libxul.so  mozilla::dom::CookieStore::GetInternal(mozilla::dom::CookieStoreGetOptions co...  dom/cookiestore/CookieStore.cpp:699
1  libxul.so  mozilla::detail::RunnableFunction<mozilla::dom::CookieStore::GetInternal(mozi...  xpcom/threads/nsThreadUtils.h:548
2  libxul.so  mozilla::RunnableTask::Run()  xpcom/threads/TaskController.cpp:618
2  libxul.so  mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::det...  xpcom/threads/TaskController.cpp:945
3  libxul.so  mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detai...  xpcom/threads/TaskController.cpp:768
3  libxul.so  mozilla::TaskController::ProcessPendingMTTask(bool)  xpcom/threads/TaskController.cpp:554

Null deref. Mostly show up on Android, but maybe there's another signature for desktop? It looks like some of this CookieStore code changed recently in bug 1475599, so I'm going to assume it is a regression from that.

Comment 1

[Andrew McCreight [:mccr8]]

Setting S2 because it is a regression with a reasonably high volume, for Android.

Comment 2

[Andrew McCreight [:mccr8]]

Looks like it is under the same signature on desktop, eg: bp-1cbe3298-4d7d-42e3-805d-e9d060240923

Comment 3

[Andrew McCreight [:mccr8]]

Another signature, with only a single crash: bp-1cbe3298-4d7d-42e3-805d-e9d060240923

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1475599

:baku, since you are the author of the regressor, bug 1475599, could you take a look?

For more information, please visit BugBot documentation.

Comment 5

[Andrea Marchesini [:baku]]

Attachment: Bug 1920534 - Extra check for the window object existence in CookieStore API, r?smaug

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/8787ad76f129
Extra check for the window object existence in CookieStore API, r=smaug

Comment 7

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/8787ad76f129