2004172 - crash at null [@ mozilla::BasePrincipal::IsThirdPartyPrincipal]

Status: RESOLVED FIXED

(Core :: DOM: Navigation, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20251127-f398b25a814d (--enable-address-sanitizer --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -a --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

==330310==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x6db45de10d74 bp 0x7ffe725b3930 sp 0x7ffe725b38c0 T0)
==330310==The signal is caused by a READ memory access.
==330310==Hint: address points to the zero page.
    #0 0x6db45de10d74 in mozilla::BasePrincipal::IsThirdPartyPrincipal(nsIPrincipal*, bool*) /builds/worker/checkouts/gecko/caps/BasePrincipal.cpp:715:17
    #1 0x6db4682f42ae in nsDocShell::CompleteInitialAboutBlankLoad(nsDocShellLoadState*, nsILoadInfo*) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:11139:37
    #2 0x6db4682e9f9e in nsDocShell::DoURILoad(nsDocShellLoadState*, mozilla::Maybe<unsigned int>, nsIRequest**) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:10997:12
    #3 0x6db4681ef55e in nsDocShell::InternalLoad(nsDocShellLoadState*, mozilla::Maybe<unsigned int>) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:10031:8
    #4 0x6db4682a7b02 in nsDocShell::LoadHistoryEntry(nsDocShellLoadState*, unsigned int, bool) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:12951:10
    #5 0x6db46827d544 in nsDocShell::LoadHistoryEntry(mozilla::dom::LoadingSessionHistoryInfo const&, unsigned int, bool, bool) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:12811:10
    #6 0x6db4682794e1 in nsDocShell::LoadURI(nsDocShellLoadState*, bool, bool) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:833:12
    #7 0x6db468330fc4 in operator() /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:1104:29
    #8 0x6db468330fc4 in decltype(std::forward<nsDocShell::MaybeHandleSubframeHistory(nsDocShellLoadState*, bool)::$_0&>(fp)(std::forward<mozilla::Maybe<mozilla::dom::LoadingSessionHistoryInfo>>(fp0))) fu2::abi_400::detail::invocation::invoke<nsDocShell::MaybeHandleSubframeHistory(nsDocShellLoadState*, bool)::$_0&, mozilla::Maybe<mozilla::dom::LoadingSessionHistoryInfo>>(nsDocShell::MaybeHandleSubframeHistory(nsDocShellLoadState*, bool)::$_0&, mozilla::Maybe<mozilla::dom::LoadingSessionHistoryInfo>&&) /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:222:10
    #9 0x6db46641e7e8 in invoke<0UL, fu2::abi_400::detail::type_erasure::data_accessor *, const unsigned long &, mozilla::Maybe<mozilla::dom::LoadingSessionHistoryInfo> > /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:1046:12
    #10 0x6db46641e7e8 in invoke<0UL, fu2::abi_400::detail::type_erasure::erasure<true, fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16UL, 8UL> >, fu2::abi_400::detail::property<false, false, void (mozilla::Maybe<mozilla::dom::LoadingSessionHistoryInfo> &&)> > &, mozilla::Maybe<mozilla::dom::LoadingSessionHistoryInfo> > /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:1270:37
    #11 0x6db46641e7e8 in operator() /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:826:1
    #12 0x6db46641e7e8 in operator() /builds/worker/workspace/obj-build/ipc/ipdl/PContentChild.cpp:1689:13
    #13 0x6db46641e7e8 in decltype(std::forward<mozilla::dom::PContentChild::SendGetLoadingSessionHistoryInfoFromParent(mozilla::dom::MaybeDiscarded<mozilla::dom::BrowsingContext> const&, fu2::abi_400::detail::function<fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16ul, 8ul>>, fu2::abi_400::detail::property<false, false, void (mozilla::Maybe<mozilla::dom::LoadingSessionHistoryInfo>&&)>>&&, fu2::abi_400::detail::function<fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16ul, 8ul>>, fu2::abi_400::detail::property<false, false, void (mozilla::ipc::ResponseRejectReason)>>&&)::$_0&>(fp)(std::forward<IPC::MessageReader*>(fp0))) fu2::abi_400::detail::invocation::invoke<mozilla::dom::PContentChild::SendGetLoadingSessionHistoryInfoFromParent(mozilla::dom::MaybeDiscarded<mozilla::dom::BrowsingContext> const&, fu2::abi_400::detail::function<fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16ul, 8ul>>, fu2::abi_400::detail::property<false, false, void (mozilla::Maybe<mozilla::dom::LoadingSessionHistoryInfo>&&)>>&&, fu2::abi_400::detail::function<fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16ul, 8ul>>, fu2::abi_400::detail::property<false, false, void (mozilla::ipc::ResponseRejectReason)>>&&)::$_0&, IPC::MessageReader*>(mozilla::dom::PContentChild::SendGetLoadingSessionHistoryInfoFromParent(mozilla::dom::MaybeDiscarded<mozilla::dom::BrowsingContext> const&, fu2::abi_400::detail::function<fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16ul, 8ul>>, fu2::abi_400::detail::property<false, false, void (mozilla::Maybe<mozilla::dom::LoadingSessionHistoryInfo>&&)>>&&, fu2::abi_400::detail::function<fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16ul, 8ul>>, fu2::abi_400::detail::property<false, false, void (mozilla::ipc::ResponseRejectReason)>>&&)::$_0&, IPC::MessageReader*&&) /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:222:10
    #14 0x6db46641ebd2 in fu2::abi_400::detail::type_erasure::invocation_table::function_trait<mozilla::ipc::HasResultCodes::Result (IPC::MessageReader*)>::internal_invoker<fu2::abi_400::detail::type_erasure::box<false, mozilla::dom::PContentChild::SendGetLoadingSessionHistoryInfoFromParent(mozilla::dom::MaybeDiscarded<mozilla::dom::BrowsingContext> const&, fu2::abi_400::detail::function<fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16ul, 8ul>>, fu2::abi_400::detail::property<false, false, void (mozilla::Maybe<mozilla::dom::LoadingSessionHistoryInfo>&&)>>&&, fu2::abi_400::detail::function<fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16ul, 8ul>>, fu2::abi_400::detail::property<false, false, void (mozilla::ipc::ResponseRejectReason)>>&&)::$_0, std::allocator<mozilla::dom::PContentChild::SendGetLoadingSessionHistoryInfoFromParent(mozilla::dom::MaybeDiscarded<mozilla::dom::BrowsingContext> const&, fu2::abi_400::detail::function<fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16ul, 8ul>>, fu2::abi_400::detail::property<false, false, void (mozilla::Maybe<mozilla::dom::LoadingSessionHistoryInfo>&&)>>&&, fu2::abi_400::detail::function<fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16ul, 8ul>>, fu2::abi_400::detail::property<false, false, void (mozilla::ipc::ResponseRejectReason)>>&&)::$_0>>, false>::invoke(fu2::abi_400::detail::type_erasure::data_accessor*, unsigned long, IPC::MessageReader*) /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:638:1
    #15 0x6db45d8b80fb in invoke<0UL, fu2::abi_400::detail::type_erasure::data_accessor *, const unsigned long &, IPC::MessageReader *> /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:1046:12
    #16 0x6db45d8b80fb in invoke<0UL, fu2::abi_400::detail::type_erasure::erasure<true, fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16UL, 8UL> >, fu2::abi_400::detail::property<false, false, mozilla::ipc::HasResultCodes::Result (IPC::MessageReader *)> > &, IPC::MessageReader *> /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:1270:37
    #17 0x6db45d8b80fb in operator() /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:826:1
    #18 0x6db45d8b80fb in mozilla::ipc::IPDLAsyncReturnsCallbacks::GotReply(mozilla::ipc::IProtocol*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/ProtocolUtils.cpp:880:17
    #19 0x6db4663e4416 in mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PContentChild.cpp:14479:36
    #20 0x6db45d88f3d5 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1793:25
    #21 0x6db45d88b8c9 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, std::unique_ptr<IPC::Message, std::default_delete<IPC::Message>>) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1719:9
    #22 0x6db45d88c6e7 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1508:3
    #23 0x6db45d88dc03 in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1610:14
    #24 0x6db45c11336a in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:705:16
    #25 0x6db45c102feb in mozilla::TaskController::RunTask(mozilla::Task*) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:196:19
    #26 0x6db45c10a2ed in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:1325:20
    #27 0x6db45c107dc8 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:1148:15
    #28 0x6db45c1083e6 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:641:36
    #29 0x6db45c122914 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:336:37
    #30 0x6db45c122914 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_1>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:549:5
    #31 0x6db45c143d7a in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1164:16
    #32 0x6db45c14ec48 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:461:10
    #33 0x6db45d897f83 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:107:5
    #34 0x6db45d77aac4 in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:368:10
    #35 0x6db45d77aac4 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:361:3
    #36 0x6db45d77aac4 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:343:3
    #37 0x6db4670a7686 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:152:27
    #38 0x6db46729613b in nsAppShell::Run() /builds/worker/checkouts/gecko/widget/gtk/nsAppShell.cpp:555:33
    #39 0x6db469341dfd in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:656:20
    #40 0x6db45d77aac4 in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:368:10
    #41 0x6db45d77aac4 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:361:3
    #42 0x6db45d77aac4 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:343:3
    #43 0x6db469340db6 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:594:34
    #44 0x599e70dd430a in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:465:22

Comment 1

[Olli Pettay [:smaug][[e-mail]]]

CompleteInitialAboutBlankLoad is a new method

Comment 2

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 543435

:vhilla, since you are the author of the regressor, bug 543435, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 3

[Vincent Hilla [:vhilla]]

The crash is a bit surprising to me because this code was just moved from DoURILoad to it's own method CompleteInitialAboutBlankLoad.

toolkit/components/antitracking/test/browser/browser_aboutblank.js fails without this.

This code comment also doesn't hold anymore, the test passes without that code for me. Looking at the test, I see content.navigator.cookieEnabled and wonder whether it relates to bug 1996054.

Comment 4

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20251207212832-938b5f5e7373.
The bug appears to have been introduced in the following build range:

Start: 7f41ffc04dd6e3bc610d55ec82fe98be6963ca83 (20251124094751)
End: 5c5d6f1b875f2000e5ddb436a8eef7b756543241 (20251124061148)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=7f41ffc04dd6e3bc610d55ec82fe98be6963ca83&tochange=5c5d6f1b875f2000e5ddb436a8eef7b756543241

Comment 5

[Ryan VanderMeulen [:RyanVM]]

Bug 543435 was reverted from Fx147. Updating the flags accordingly.

Comment 6

[Vincent Hilla [:vhilla]]

(didn't mean to clear that)

Comment 7

[Bugmon [:jkratzer for issues]]

Successfully recorded a pernosco session. A link to the pernosco session will be added here shortly.

Comment 8

[Bugmon [:jkratzer for issues]]

A pernosco session for this bug can be found here.

Comment 9

[Vincent Hilla [:vhilla]]

Attachment: simplified test case

I think this crashes more reliably and better shows the problem

Comment 10

[Vincent Hilla [:vhilla]]

While on the transient about:blank, we push some history state and then reload before the iframe finishes loading. I guess it's quite unexpected to have SH state based on this transient document. But I don't understand yet how SH handles principalToInherit or what would be the right thing to do here.

Comment 11

[Vincent Hilla [:vhilla]]

( Maybe the testcase is still a bit racy, I remember getting a NS_ERROR_UNEXPECTED or so without the timeout. But now it also crashes reliably without setTimeout )

Comment 12

[Vincent Hilla [:vhilla]]

On debug it fails the "Load looks like first load but does not want principal inheritance." assert, on opt it crashes due to null ptr access. The transient about:blank in the iframe inherits it's principal from the parent. If we wouldn't crash, I expect the data load would still occur. Or we stay on the initial about:blank, but in that case the inherited principal would still be right. So this seems safe and the crash should hopefully be rare.

We should probably

• How to determine IsThirdPartyContext if there is no PrincipalToInherit. Probably, we should use the document principal. I think this third party context information is only used once we create aboutBlankChannel. So we can move this whole block to after the principalMissmatch code, then always use the document principal instead of PrincipalToInherit. That will fix this crash for opt builds.
• I'm still unsure what to do about the history state to fix the crash on debug.

Comment 13

[Vincent Hilla [:vhilla]]

Moving the IsThirdPartyContext code now won't work because we need the channel earlier for bug 2003449. But I wonder whether this relates to bug 2010596 and https://bugzilla.mozilla.org/show_bug.cgi?id=2003449#c37? Probably not, because this is about cases where aLoadState->PrincipalToInherit() is null. And bug 2010596 goes wrong earlier when we CreateAboutBlankDocumentViewer.

Comment 14

[Vincent Hilla [:vhilla]]

Perhaps we could have nsDocShell::LoadHistoryEntry do aLoadState->ProhibitInitialAboutBlankHandling()

Comment 15

[Bugmon [:jkratzer for issues]]

Testcase crashes using the initial build (mozilla-central 20251127092353-f398b25a814d) but not with tip (mozilla-central 20260626040954-020c1f7a2159.)

The bug appears to have been introduced in the following build range:

Start: 7f41ffc04dd6e3bc610d55ec82fe98be6963ca83 (20251124094751)
End: 5c5d6f1b875f2000e5ddb436a8eef7b756543241 (20251124061148)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=7f41ffc04dd6e3bc610d55ec82fe98be6963ca83&tochange=5c5d6f1b875f2000e5ddb436a8eef7b756543241

tsmith, can you confirm that the above bisection range is responsible for fixing this issue?
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 16

[Vincent Hilla [:vhilla]]

That range doesn't seem right. It's the range where bug 543435 landed and from comment 11, I'm fairly sure I reproduced it afterwards. It's possible that some change to SH means we now have aLoadState->PrincipalToInherit(). But even if that would be fixed, there should still be a crash on debug.

Comment 17

[Tyson Smith [:tsmith]]

I can't reproduce the crash but I can still trigger the assertion in bug 2021189.

Comment 18

[Tyson Smith [:tsmith]]

(In reply to Tyson Smith [:tsmith] from comment #17)

I can't reproduce the crash but I can still trigger the assertion in bug 2021189.

I take that back I was able to repro.

Comment 19

[Vincent Hilla [:vhilla]]

Attachment: Bug 2004172 - Fix crash when calling pushState on initial about:blank. r=#dom-core

Comment 20

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/cc121ee819fe
https://hg.mozilla.org/integration/autoland/rev/ccb6bbab78d1
Fix crash when calling pushState on initial about:blank. r=dom-core-reviewers,jjaschke

Comment 21

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/622e678b3982
https://hg.mozilla.org/integration/autoland/rev/8597a93edb59
Revert "Bug 2004172 - Fix crash when calling pushState on initial about:blank. r=dom-core-reviewers,jjaschke" for causing crashes on 2004172.html.

Comment 22

[Cosmin Sabou [:CosminS]]

Backed out for causing crashes on 2004172.html.

Push with failures

Failure log

Backout link

Comment 23

[Vincent Hilla [:vhilla]]

https://treeherder.mozilla.org/jobs?repo=try&revision=5ff3bd06fa4f4bdde4b46eaa91ca25eb626adf4f

It passed previously for me, I guess it's a bit flaky. The iframe doesn't need to load example.com, it just needs to start some load we can cancel. Sorry, I'll update it.

Comment 24

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/5dfd37827ff3
https://hg.mozilla.org/integration/autoland/rev/c782d9fc7a9d
Fix crash when calling pushState on initial about:blank. r=dom-core-reviewers,jjaschke

Comment 25

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/c782d9fc7a9d