1950897 - Crash in mozilla::dom::NavigationHistoryEntry::Key()

Status: NEW

(Core :: DOM: Navigation, defect)

Description

[Andreas Farre [:farre]]

mozilla::UniquePtr<mozilla::dom::SessionHistoryInfo, mozilla::DefaultDelete<mozilla::dom::SessionHistoryInfo> >::get() const (mfbt/UniquePtr.h:287)
mozilla::UniquePtr<mozilla::dom::SessionHistoryInfo, mozilla::DefaultDelete<mozilla::dom::SessionHistoryInfo> >::operator->() const (mfbt/UniquePtr.h:282)
mozilla::dom::NavigationHistoryEntry::Key() const (dom/navigation/NavigationHistoryEntry.cpp:134)
mozilla::dom::Navigation::UpdateEntriesForSameDocumentNavigation(mozilla::dom::SessionHistoryInfo*, mozilla::dom::NavigationType) (dom/navigation/Navigation.cpp:182)
nsDocShell::HandleSameDocumentNavigation(nsDocShellLoadState*, SameDocumentNavigationState&, bool&) (docshell/base/nsDocShell.cpp:9074)
nsDocShell::InternalLoad(nsDocShellLoadState*, mozilla::Maybe<unsigned int>) (docshell/base/nsDocShell.cpp:9322)
nsDocShell::LoadURI(nsDocShellLoadState*, bool, bool) (docshell/base/nsDocShell.cpp:855)
nsDocShell::LoadURI(nsDocShellLoadState*, bool) (docshell/base/nsDocShell.cpp:686)
mozilla::dom::BrowsingContext::LoadURI(nsDocShellLoadState*, bool) (docshell/base/BrowsingContext.cpp:2009)
...

There are different ways of getting into BrowsingContext::LoadURI causing the top of this crash (setting location.href, calling window.open, etc).

/navigation-api/navigate-event/cross-window/location-samedocument-crossorigin-sameorigindomain.sub.html
/navigation-api/navigate-event/cross-window/location-samedocument-crossorigin.html
/navigation-api/navigate-event/cross-window/location-samedocument-sameorigin.html
/navigation-api/navigate-event/cross-window/open-samedocument-crossorigin-sameorigindomain.sub.html
/navigation-api/navigate-event/cross-window/open-samedocument-crossorigin.html
/navigation-api/navigate-event/cross-window/open-samedocument-sameorigin.html
/navigation-api/navigate-event/navigate-iframe-location.html
/navigation-api/navigate-event/navigate-window-open.html
/navigation-api/navigate-event/replaceState-in-unload-then-remove-iframe.html

Comment 1

[Andreas Farre [:farre]]

This is actually turning out to be several bugs crashing here. Will update accordingly.