2021189 - Assertion failure: mDocumentViewer->GetDocument()->NodePrincipal()->GetIsNullPrincipal() (Load looks like first load but does not want principal inheritance.), at /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:10706

Status: RESOLVED DUPLICATE of bug 2004172

(Core :: DOM: Navigation, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20260222-7be2aa792dbb (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: mDocumentViewer->GetDocument()->NodePrincipal()->GetIsNullPrincipal() (Load looks like first load but does not want principal inheritance.), at /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:10706

#0 0x7a0020a4b1ff in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:237:3
#1 0x7a0020a4b1ff in nsDocShell::ShouldDoInitialAboutBlankSyncLoad(nsIURI*, nsDocShellLoadState*, nsIPrincipal*) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:10704:5
#2 0x7a0020a43e87 in nsDocShell::DoURILoad(nsDocShellLoadState*, mozilla::Maybe<unsigned int>, nsIRequest**) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:11016:34
#3 0x7a00209ab7f3 in nsDocShell::InternalLoad(nsDocShellLoadState*, mozilla::Maybe<unsigned int>) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:10158:8
#4 0x7a0020a1a9b1 in nsDocShell::LoadHistoryEntry(nsDocShellLoadState*, unsigned int, bool) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:13130:10
#5 0x7a00209ff4d9 in nsDocShell::LoadHistoryEntry(mozilla::dom::LoadingSessionHistoryInfo const&, unsigned int, bool, bool) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:12990:10
#6 0x7a00209fcb8a in nsDocShell::LoadURI(nsDocShellLoadState*, bool, bool) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:829:12
#7 0x7a0020a72fc4 in operator() /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:1100:29
#8 0x7a0020a72fc4 in decltype(std::forward<nsDocShell::MaybeHandleSubframeHistory(nsDocShellLoadState*, bool)::$_0&>(fp)(std::forward<mozilla::Maybe<mozilla::dom::LoadingSessionHistoryInfo>>(fp0))) fu2::abi_400::detail::invocation::invoke<nsDocShell::MaybeHandleSubframeHistory(nsDocShellLoadState*, bool)::$_0&, mozilla::Maybe<mozilla::dom::LoadingSessionHistoryInfo>>(nsDocShell::MaybeHandleSubframeHistory(nsDocShellLoadState*, bool)::$_0&, mozilla::Maybe<mozilla::dom::LoadingSessionHistoryInfo>&&) /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:222:10
#9 0x7a001fa80dee in invoke<0UL, fu2::abi_400::detail::type_erasure::data_accessor *, const unsigned long &, mozilla::Maybe<mozilla::dom::LoadingSessionHistoryInfo> > /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:1046:12
#10 0x7a001fa80dee in invoke<0UL, fu2::abi_400::detail::type_erasure::erasure<true, fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16UL, 8UL> >, fu2::abi_400::detail::property<false, false, void (mozilla::Maybe<mozilla::dom::LoadingSessionHistoryInfo> &&)> > &, mozilla::Maybe<mozilla::dom::LoadingSessionHistoryInfo> > /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:1270:37
#11 0x7a001fa80dee in operator() /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:826:1
#12 0x7a001fa80dee in operator() /builds/worker/workspace/obj-build/ipc/ipdl/PContentChild.cpp:1690:13
#13 0x7a001fa80dee in decltype(std::forward<mozilla::dom::PContentChild::SendGetLoadingSessionHistoryInfoFromParent(mozilla::dom::MaybeDiscarded<mozilla::dom::BrowsingContext> const&, fu2::abi_400::detail::function<fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16ul, 8ul>>, fu2::abi_400::detail::property<false, false, void (mozilla::Maybe<mozilla::dom::LoadingSessionHistoryInfo>&&)>>&&, fu2::abi_400::detail::function<fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16ul, 8ul>>, fu2::abi_400::detail::property<false, false, void (mozilla::ipc::ResponseRejectReason)>>&&)::$_0&>(fp)(std::forward<IPC::MessageReader*>(fp0))) fu2::abi_400::detail::invocation::invoke<mozilla::dom::PContentChild::SendGetLoadingSessionHistoryInfoFromParent(mozilla::dom::MaybeDiscarded<mozilla::dom::BrowsingContext> const&, fu2::abi_400::detail::function<fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16ul, 8ul>>, fu2::abi_400::detail::property<false, false, void (mozilla::Maybe<mozilla::dom::LoadingSessionHistoryInfo>&&)>>&&, fu2::abi_400::detail::function<fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16ul, 8ul>>, fu2::abi_400::detail::property<false, false, void (mozilla::ipc::ResponseRejectReason)>>&&)::$_0&, IPC::MessageReader*>(mozilla::dom::PContentChild::SendGetLoadingSessionHistoryInfoFromParent(mozilla::dom::MaybeDiscarded<mozilla::dom::BrowsingContext> const&, fu2::abi_400::detail::function<fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16ul, 8ul>>, fu2::abi_400::detail::property<false, false, void (mozilla::Maybe<mozilla::dom::LoadingSessionHistoryInfo>&&)>>&&, fu2::abi_400::detail::function<fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16ul, 8ul>>, fu2::abi_400::detail::property<false, false, void (mozilla::ipc::ResponseRejectReason)>>&&)::$_0&, IPC::MessageReader*&&) /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:222:10
#14 0x7a001fa81077 in fu2::abi_400::detail::type_erasure::invocation_table::function_trait<mozilla::ipc::HasResultCodes::Result (IPC::MessageReader*)>::internal_invoker<fu2::abi_400::detail::type_erasure::box<false, mozilla::dom::PContentChild::SendGetLoadingSessionHistoryInfoFromParent(mozilla::dom::MaybeDiscarded<mozilla::dom::BrowsingContext> const&, fu2::abi_400::detail::function<fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16ul, 8ul>>, fu2::abi_400::detail::property<false, false, void (mozilla::Maybe<mozilla::dom::LoadingSessionHistoryInfo>&&)>>&&, fu2::abi_400::detail::function<fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16ul, 8ul>>, fu2::abi_400::detail::property<false, false, void (mozilla::ipc::ResponseRejectReason)>>&&)::$_0, std::allocator<mozilla::dom::PContentChild::SendGetLoadingSessionHistoryInfoFromParent(mozilla::dom::MaybeDiscarded<mozilla::dom::BrowsingContext> const&, fu2::abi_400::detail::function<fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16ul, 8ul>>, fu2::abi_400::detail::property<false, false, void (mozilla::Maybe<mozilla::dom::LoadingSessionHistoryInfo>&&)>>&&, fu2::abi_400::detail::function<fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16ul, 8ul>>, fu2::abi_400::detail::property<false, false, void (mozilla::ipc::ResponseRejectReason)>>&&)::$_0>>, false>::invoke(fu2::abi_400::detail::type_erasure::data_accessor*, unsigned long, IPC::MessageReader*) /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:638:1
#15 0x7a001b0197c7 in invoke<0UL, fu2::abi_400::detail::type_erasure::data_accessor *, const unsigned long &, IPC::MessageReader *> /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:1046:12
#16 0x7a001b0197c7 in invoke<0UL, fu2::abi_400::detail::type_erasure::erasure<true, fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16UL, 8UL> >, fu2::abi_400::detail::property<false, false, mozilla::ipc::HasResultCodes::Result (IPC::MessageReader *)> > &, IPC::MessageReader *> /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:1270:37
#17 0x7a001b0197c7 in operator() /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:826:1
#18 0x7a001b0197c7 in mozilla::ipc::IPDLAsyncReturnsCallbacks::GotReply(mozilla::ipc::IProtocol*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/ProtocolUtils.cpp:908:17
#19 0x7a001fa67a71 in mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PContentChild.cpp:0:13
#20 0x7a001b00048e in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1801:25
#21 0x7a001affda10 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, std::unique_ptr<IPC::Message, std::default_delete<IPC::Message>>) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1727:9
#22 0x7a001affe417 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1516:3
#23 0x7a001afff3f9 in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1618:14
#24 0x7a001a3ec947 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:721:16
#25 0x7a001a3e7014 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:1342:20
#26 0x7a001a3e5c97 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:1165:15
#27 0x7a001a3e6115 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:657:36
#28 0x7a001a3f5c89 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:352:37
#29 0x7a001a3f5c89 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_1>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:549:5
#30 0x7a001a4081c3 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1169:16
#31 0x7a001a40de1f in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:467:10
#32 0x7a001b005c83 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:107:5
#33 0x7a001af5f081 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:366:3
#34 0x7a001af5f081 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:348:3
#35 0x7a0020108828 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:152:27
#36 0x7a00201d4114 in nsAppShell::Run() /builds/worker/checkouts/gecko/widget/gtk/nsAppShell.cpp:555:33
#37 0x7a002122bf1b in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:652:20
#38 0x7a001b006b74 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:235:9
#39 0x7a001af5f081 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:366:3
#40 0x7a001af5f081 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:348:3
#41 0x7a002122b67f in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:590:34
#42 0x564db97a400c in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:467:22
#43 0x7a002bdadd8f in __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#44 0x7a002bdade3f in __libc_start_main ./csu/../csu/libc-start.c:392:3

Comment 1

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20260305002319-1d592808e38f.
The bug appears to have been introduced in the following build range:

Start: 3befa2ffc228fd4d071c8b696872a760954392fc (20251101164325)
End: 1e03cc1e2180aa3940d710bc673cd03ca9657f30 (20251101185333)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=3befa2ffc228fd4d071c8b696872a760954392fc&tochange=1e03cc1e2180aa3940d710bc673cd03ca9657f30

Comment 2

[BugBot [:suhaib / :marco]]

Based on comment #1, this bug contains a bisection range found by bugmon. However, the Regressed by field is still not filled.

:jrmuizel and :RyanVM, since you are the authors of the changes in the range, if possible, could you fill the Regressed by field and investigate this regression?

For more information, please visit BugBot documentation.

Comment 3

[Ryan VanderMeulen [:RyanVM]]

Mine was Android-only.

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

Regression range looks wrong, I mean that I couldn't see those patches affecting this stuff. Could you perhaps try to find a new one?

Comment 5

[Dianna Smith [:diannaS]]

:tsmith any update on the regression range?

Comment 6

[Tyson Smith [:tsmith]]

Attachment: prefs.js

Comment 7

[Tyson Smith [:tsmith]]

Let's try again with a dedicated prefs.js files. My guess is bugmon tripped over another issue, that said I can't repro anything around the given range.

Comment 8

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20260407131519-9b462b5d1484.
Unable to bisect testcase (Testcase reproduces on start build!):

Start: 766ad944209277a17d38ca840c526556617053de (20250408212225)
End: 7be2aa792dbbf8e4b0c834b5d43ba43a2d21c248 (20260222095748)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False, searchfox=False, afl=False)

Comment 9

[Tyson Smith [:tsmith]]

jkratzer: Something is going wrong with bugmon on this bug.

Comment 10

[Jason Kratzer [:jkratzer]]

:tsmith, unfortunately there's not much we can do here. The testcase triggered Assertion failure: aEntry, at /builds/worker/checkouts/gecko/docshell/shistory/nsSHistory.cpp:623 on 20250408212225. Bugmon doesn't differentiate between crashes because they may change over time. Also, the testcase seems fairly unreliable in those earlier builds and that's why you see the bisection range in comment 1.

Comment 11

[BugBot [:suhaib / :marco]]

The severity field is not set for this bug.
:jjaschke, could you have a look please?

For more information, please visit BugBot documentation.

Comment 12

[Vincent Hilla [:vhilla]]

The assertion was added by bug 543435, could very well be a bug related to our about:blank change. I'll try to take a look.

Comment 13

[Vincent Hilla [:vhilla]]

( It would be very helpful to have a pernosco recording or a reliable test case, let's hope we get a trace )

Comment 14

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 543435

Comment 15

[Vincent Hilla [:vhilla]]

This might be the same issue as bug 2004172.

Comment 16

[Bugmon [:jkratzer for issues]]

Successfully recorded a pernosco session. A link to the pernosco session will be added here shortly.

Comment 17

[Bugmon [:jkratzer for issues]]

A pernosco session for this bug can be found here.

Comment 18

[Bugmon [:jkratzer for issues]]

Testcase crashes using the initial build (mozilla-central 20260222095748-7be2aa792dbb) but not with tip (mozilla-central 20260718090721-1d0f3519e526.)

The bug appears to have been fixed in the following build range:

Start: 1bf94d904689bf8183401f175988178b72757a65 (20260716133921)
End: 75173f371e449d21d74fce1f7bd70a081b6ab648 (20260716154245)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=1bf94d904689bf8183401f175988178b72757a65&tochange=75173f371e449d21d74fce1f7bd70a081b6ab648

vhilla, can you confirm that the above bisection range is responsible for fixing this issue?
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 19

[Vincent Hilla [:vhilla]]

I wanted to take bug 2037346, but that turned out a bit more work and I got blocked.

I don't see anything in the build range that could've fixed this, nor do I think this is fixed. But in the meantime, I put up a patch for bug 2004172 that'll likely fix this one too.