2002159 - Assertion failure: aDestinationSHE->NavigationKey() == oldCurrentEntry->SessionHistoryInfo()->NavigationKey(), at /builds/worker/checkouts/gecko/dom/navigation/Navigation.cpp:384

Status: RESOLVED FIXED

(Core :: DOM: Navigation, defect)

Description

[Tyson Smith [:tsmith] (PTO)]

Found with m-c 20251124-87bd2ca15e2a (--enable-debug)

This was found by visiting a live website with a debug build.

STR:

• Launch browser and visit site
• Click invisible "skip to main content" link in the top left corner of the page

This issue was triggered by visiting http://premium.wsib.ca/. A Pernosco session is available here: https://pernos.co/debug/3hKo-FMjRkyCAiGXtHiCFA/index.html

Assertion failure: aDestinationSHE->NavigationKey() == oldCurrentEntry->SessionHistoryInfo()->NavigationKey(), at /builds/worker/checkouts/gecko/dom/navigation/Navigation.cpp:384

0|0|xul.dll|mozilla::dom::Navigation::UpdateEntriesForSameDocumentNavigation(mozilla::dom::SessionHistoryInfo*, mozilla::dom::NavigationType)|git:github.com/mozilla-firefox/firefox:dom/navigation/Navigation.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|382|0xb90
0|1|xul.dll|nsDocShell::UpdateURLAndHistory(mozilla::dom::Document*, nsIURI*, nsIStructuredCloneContainer*, mozilla::dom::NavigationHistoryBehavior, nsIURI*, bool)|git:github.com/mozilla-firefox/firefox:docshell/base/nsDocShell.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|12356|0x1290
0|2|xul.dll|nsDocShell::AddState(JS::Handle<JS::Value>, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, bool, JSContext*)|git:github.com/mozilla-firefox/firefox:docshell/base/nsDocShell.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|12106|0xbb8
0|3|xul.dll|nsHistory::PushOrReplaceState(JSContext*, JS::Handle<JS::Value>, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::dom::CallerType, mozilla::ErrorResult&, bool)|git:github.com/mozilla-firefox/firefox:dom/base/nsHistory.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|202|0x1a4
0|4|xul.dll|nsHistory::ReplaceState(JSContext*, JS::Handle<JS::Value>, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::dom::CallerType, mozilla::ErrorResult&)|git:github.com/mozilla-firefox/firefox:dom/base/nsHistory.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|164|0x2e
0|5|xul.dll|mozilla::dom::History_Binding::replaceState(JSContext*, JS::Handle<JSObject *>, void*, JSJitMethodCallArgs const&)|s3:gecko-generated-sources:afba07e4918b261f35d7af56dc0b4733832cb2fb126de552bc1cca5b41083d0b43193fd5f142e1cd51e55cea7815622fad67647d5697152193f9b78c13067b8d/dom/bindings/HistoryBinding.cpp:|424|0x2a0
0|6|xul.dll|mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy,mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*)|git:github.com/mozilla-firefox/firefox:dom/bindings/BindingUtils.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|3306|0x1bd
0|7|xul.dll|CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&)|git:github.com/mozilla-firefox/firefox:js/src/vm/Interpreter.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|490|0xf2
0|8|xul.dll|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)|git:github.com/mozilla-firefox/firefox:js/src/vm/Interpreter.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|586|0x1e3
0|9|xul.dll|js::Interpret(JSContext*, js::RunState&)|git:github.com/mozilla-firefox/firefox:js/src/vm/Interpreter.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|3272|0xb03a
0|10|xul.dll|js::RunScript(JSContext*, js::RunState&)|git:github.com/mozilla-firefox/firefox:js/src/vm/Interpreter.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|460|0x3c7
0|11|xul.dll|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)|git:github.com/mozilla-firefox/firefox:js/src/vm/Interpreter.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|618|0x2e6
0|12|xul.dll|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason)|git:github.com/mozilla-firefox/firefox:js/src/vm/Interpreter.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|685|0x12c
0|13|xul.dll|JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)|git:github.com/mozilla-firefox/firefox:js/src/vm/CallAndConstruct.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|119|0x202
0|14|xul.dll|mozilla::dom::EventHandlerNonNull::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&)|s3:gecko-generated-sources:6bb50a9febd07b2ad041cb59a1fa6678b97d5dfa7934c45cdfb310e02ee1d5fd2d0aff84c3cbda807717ae7247884aa5f52594385c678b698b0d951ba796aa45/dom/bindings/EventHandlerBinding.cpp:|65|0x2cd
0|15|xul.dll|mozilla::dom::EventHandlerNonNull::Call<nsCOMPtr<mozilla::dom::EventTarget> >(nsCOMPtr<mozilla::dom::EventTarget> const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObjectBase::ExceptionHandling, JS::Realm*)|s3:gecko-generated-sources:2c0600fb668133ec78b4dbdd71621eeefcafca4a527e24f8dcefe291fb1ae7c5c4647bce637883fe669db31805b6a9d1251a807433b4f2db5c3b207f28308026/dist/include/mozilla/dom/EventHandlerBinding.h:|82|0x13a
0|16|xul.dll|mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*)|git:github.com/mozilla-firefox/firefox:dom/events/JSEventHandler.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|201|0x62a
0|17|xul.dll|mozilla::EventListenerManager::HandleEventSingleListener(mozilla::EventListenerManager::Listener*, nsAtom*, mozilla::WidgetEvent*, mozilla::dom::Event*, mozilla::dom::EventTarget*, bool)|git:github.com/mozilla-firefox/firefox:dom/events/EventListenerManager.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|1272|0x2bf
0|18|xul.dll|mozilla::EventListenerManager::HandleEventWithListenerArray(mozilla::EventListenerManager::ListenerArray*, nsAtom*, mozilla::EventMessage, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, bool)|git:github.com/mozilla-firefox/firefox:dom/events/EventListenerManager.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|1579|0x3f6
0|19|xul.dll|mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool)|git:github.com/mozilla-firefox/firefox:dom/events/EventListenerManager.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|1484|0x17c
0|20|xul.dll|mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&)|git:github.com/mozilla-firefox/firefox:dom/events/EventDispatcher.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|364|0x1f4
0|21|xul.dll|mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&)|git:github.com/mozilla-firefox/firefox:dom/events/EventDispatcher.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|605|0x6f5
0|22|xul.dll|mozilla::EventDispatcher::Dispatch(mozilla::dom::EventTarget*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget *>*)|git:github.com/mozilla-firefox/firefox:dom/events/EventDispatcher.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|1260|0x1ab5
0|23|xul.dll|FocusBlurEvent::Run()|git:github.com/mozilla-firefox/firefox:dom/base/nsFocusManager.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|2961|0x154
0|24|xul.dll|nsContentUtils::AddScriptRunner(already_AddRefed<nsIRunnable>)|git:github.com/mozilla-firefox/firefox:dom/base/nsContentUtils.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|6979|0x30b
0|25|xul.dll|nsContentUtils::AddScriptRunner(nsIRunnable*)|git:github.com/mozilla-firefox/firefox:dom/base/nsContentUtils.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|6985|0xae
0|26|xul.dll|nsFocusManager::FireFocusOrBlurEvent(mozilla::EventMessage, mozilla::PresShell*, mozilla::dom::EventTarget*, bool, bool, mozilla::dom::EventTarget*)|git:github.com/mozilla-firefox/firefox:dom/base/nsFocusManager.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|3102|0x257
0|27|xul.dll|nsFocusManager::SendFocusOrBlurEvent(mozilla::EventMessage, mozilla::PresShell*, mozilla::dom::Document*, mozilla::dom::EventTarget*, bool, bool, mozilla::dom::EventTarget*)|git:github.com/mozilla-firefox/firefox:dom/base/nsFocusManager.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|3073|0x4bd
0|28|xul.dll|nsFocusManager::BlurImpl(mozilla::dom::BrowsingContext*, mozilla::dom::BrowsingContext*, bool, bool, bool, mozilla::dom::Element*, unsigned long long)|git:github.com/mozilla-firefox/firefox:dom/base/nsFocusManager.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|2565|0x754
0|29|xul.dll|nsFocusManager::Blur(mozilla::dom::BrowsingContext*, mozilla::dom::BrowsingContext*, bool, bool, bool, unsigned long long, mozilla::dom::Element*)|git:github.com/mozilla-firefox/firefox:dom/base/nsFocusManager.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|2383|0x3c2
0|30|xul.dll|nsFocusManager::ClearFocus(mozIDOMWindowProxy*)|git:github.com/mozilla-firefox/firefox:dom/base/nsFocusManager.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|587|0x26c
0|31|xul.dll|mozilla::PresShell::GoToAnchor(nsTSubstring<char16_t> const&, nsRange const*, bool, mozilla::ScrollFlags)|git:github.com/mozilla-firefox/firefox:layout/base/PresShell.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|3211|0x91b
0|32|xul.dll|nsDocShell::ScrollToAnchor(bool, bool, nsTSubstring<char>&, unsigned int)|git:github.com/mozilla-firefox/firefox:docshell/base/nsDocShell.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|11602|0x22b
0|33|xul.dll|nsDocShell::HandleSameDocumentNavigation(nsDocShellLoadState*, SameDocumentNavigationState&, bool&)|git:github.com/mozilla-firefox/firefox:docshell/base/nsDocShell.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|9331|0x2a6e
0|34|xul.dll|nsDocShell::InternalLoad(nsDocShellLoadState*, mozilla::Maybe<unsigned int>)|git:github.com/mozilla-firefox/firefox:docshell/base/nsDocShell.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|9699|0xd40
0|35|xul.dll|nsDocShell::OnLinkClickSync(nsIContent*, nsDocShellLoadState*, bool, nsIPrincipal*)|git:github.com/mozilla-firefox/firefox:docshell/base/nsDocShell.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|13983|0x93c
0|36|xul.dll|OnLinkClickEvent::Run()|git:github.com/mozilla-firefox/firefox:docshell/base/nsDocShell.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|13632|0x100
0|37|xul.dll|mozilla::RunnableTask::Run()|git:github.com/mozilla-firefox/firefox:xpcom/threads/TaskController.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|705|0x1d
0|38|xul.dll|mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex &> const&)|git:github.com/mozilla-firefox/firefox:xpcom/threads/TaskController.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|1325|0x6b4
0|39|xul.dll|mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex &> const&)|git:github.com/mozilla-firefox/firefox:xpcom/threads/TaskController.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|1148|0x57
0|40|xul.dll|mozilla::TaskController::ProcessPendingMTTask(bool)|git:github.com/mozilla-firefox/firefox:xpcom/threads/TaskController.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|641|0x69
0|41|xul.dll|mozilla::detail::RunnableFunction<`lambda at /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:333:7'>::Run()|git:github.com/mozilla-firefox/firefox:xpcom/threads/nsThreadUtils.h:c0447496b9e1f44ddc7836b87b8b312de49daeca|549|0x16
0|42|xul.dll|nsThread::ProcessNextEvent(bool, bool*)|git:github.com/mozilla-firefox/firefox:xpcom/threads/nsThread.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|1164|0x5d0
0|43|xul.dll|NS_ProcessNextEvent(nsIThread*, bool)|git:github.com/mozilla-firefox/firefox:xpcom/threads/nsThreadUtils.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|461|0x70
0|44|xul.dll|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|git:github.com/mozilla-firefox/firefox:ipc/glue/MessagePump.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|85|0xb7
0|45|xul.dll|MessageLoop::RunHandler()|git:github.com/mozilla-firefox/firefox:ipc/chromium/src/base/message_loop.cc:c0447496b9e1f44ddc7836b87b8b312de49daeca|361|0x3e
0|46|xul.dll|MessageLoop::Run()|git:github.com/mozilla-firefox/firefox:ipc/chromium/src/base/message_loop.cc:c0447496b9e1f44ddc7836b87b8b312de49daeca|343|0x6e
0|47|xul.dll|nsBaseAppShell::Run()|git:github.com/mozilla-firefox/firefox:widget/nsBaseAppShell.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|152|0x27
0|48|xul.dll|nsAppShell::Run()|git:github.com/mozilla-firefox/firefox:widget/windows/nsAppShell.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|673|0x17d
0|49|xul.dll|XRE_RunAppShell()|git:github.com/mozilla-firefox/firefox:toolkit/xre/nsEmbedFunctions.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|656|0x78
0|50|xul.dll|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|git:github.com/mozilla-firefox/firefox:ipc/glue/MessagePump.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|235|0x39
0|51|xul.dll|MessageLoop::RunHandler()|git:github.com/mozilla-firefox/firefox:ipc/chromium/src/base/message_loop.cc:c0447496b9e1f44ddc7836b87b8b312de49daeca|361|0x3e
0|52|xul.dll|MessageLoop::Run()|git:github.com/mozilla-firefox/firefox:ipc/chromium/src/base/message_loop.cc:c0447496b9e1f44ddc7836b87b8b312de49daeca|343|0x6e
0|53|xul.dll|XRE_InitChildProcess(int, char**, XREChildData const*)|git:github.com/mozilla-firefox/firefox:toolkit/xre/nsEmbedFunctions.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|594|0xa59
0|54|firefox.exe|NS_internal_main(int, char**, char**)|git:github.com/mozilla-firefox/firefox:browser/app/nsBrowserApp.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|465|0x235
0|55|firefox.exe|wmain(int, wchar_t**)|git:github.com/mozilla-firefox/firefox:toolkit/xre/nsWindowsWMain.cpp:c0447496b9e1f44ddc7836b87b8b312de49daeca|150|0x246

Comment 1

[Adam Vandolder [:avandolder]]

Is there any more details to the STR here? Visiting the given URL on a debug build of the latest central doesn't seem to reproduce the crash for me. The stacktrace seems to imply a link was clicked. Does this require being logged in?

Comment 2

[Tyson Smith [:tsmith] (PTO)]

Sorry about that, I've update the STR. I didn't notice that the invisible link was clicked.

FYI there is a Pernosco session available if you still cannot reproduce the issue.

Comment 3

[Adam Vandolder [:avandolder]]

Attachment: Bug 2002159 - Update the navigation API entries before scrolling during a same-document navigation. r?#dom-core

When performing a same-document navigation, we update the active entry
in the docshell and browsing context, then we call ScrollToAnchor,
and only after scrolling we call UpdateEntriesForSameDocumentNavigation.
However, ScrollToAnchor can trigger script to run, and if this script
performs a same-document replace navigation via replaceState we end up
in state where the docshell's mActiveEntry and the navigation API's
current entry are out of sync, resulting in us triggering the assertion
that guarantees replaced entries have the same navigation key as the
entry replacing them.
This patch fixes this by updating the navigation API entries before
scrolling, which more closely follows the #scroll-to-fragid steps
in the spec.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/46ea2de4d34f
https://hg.mozilla.org/integration/autoland/rev/3104f648d7ac
Update the navigation API entries before scrolling during a same-document navigation. r=dom-core,farre

Comment 5

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/3104f648d7ac