Crash report: https://crash-stats.mozilla.org/report/index/e3799b4d-4405-4f7c-ac7c-5dc1c0260713

This is coming from a different check than bug 2048851. That bug was regressed by bug 2045635, which is only in Nightly so far, it's fixed and the crash rate in nightly goes down. But we also see an increase in crashes on beta.

The crashes on beta all go through ipc/ipdl/PBrowserBridgeParent.cpp:471, which is PBrowserBridge::Msg_LoadURL__ID. The three ESR ones are PNecko::Msg_PDocumentChannelConstructor__ID.

I hope the crash volume won't increase too much. I don't know how these crashes occur, a reproducible example would be helpful. If the rate increases, we could early return in release builds before SendLoadURL to at least avoid content crashes. Maybe someone can have a look at protected data, i.e. what pages are crashing?

https://treeherder.mozilla.org/jobs?repo=try&revision=0d9e2f99fe671561174db92d011ef4f81f5cc4d3

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/61403 for changes under testing/web-platform/tests

https://hg.mozilla.org/mozilla-central/rev/6d74d59dc69b

Upstream PR merged by moz-wptsync-bot

Upstream PR merged

:vhilla did you want to uplift this to 154 beta? If so, please add uplift requests

STR

• Go to https://example.com
• In the console, enter document.body.append(Object.assign(document.createElement("iframe"), { src: "https://example.org" }));
• In the console, enter document.querySelector("iframe").src = "javascript:0;"

Original Revision: https://phabricator.services.mozilla.com/D312706

firefox-beta Uplift Approval Request

• User impact if declined/Reason for urgency: parent-process crash
• Code covered by automated testing?: yes
• Fix verified in Nightly?: yes
• Needs manual QE testing?: no
• Steps to reproduce for manual QE testing: See comment 12
• Risk associated with taking this patch: low
• Explanation of risk level: Reject cross origin javascript URIs through iframe.src in content, as we already do for window.open and location. The parent would reject these anyway.
• String changes made/needed?: No
• Is Android affected?: yes

firefox-esr115 Uplift Approval Request

• User impact if declined/Reason for urgency: parent-process crash
• Code covered by automated testing?: yes
• Fix verified in Nightly?: yes
• Needs manual QE testing?: no
• Steps to reproduce for manual QE testing: See comment 12
• Risk associated with taking this patch: low
• Explanation of risk level: Reject cross origin javascript URIs through iframe.src in content, as we already do for window.open and location. The parent would reject these anyway.
• String changes made/needed?: No
• Is Android affected?: yes

Original Revision: https://phabricator.services.mozilla.com/D312706

Original Revision: https://phabricator.services.mozilla.com/D312706

firefox-esr140 Uplift Approval Request

• User impact if declined/Reason for urgency: parent-process crash
• Code covered by automated testing?: yes
• Fix verified in Nightly?: yes
• Needs manual QE testing?: no
• Steps to reproduce for manual QE testing: See comment 12
• Risk associated with taking this patch: low
• Explanation of risk level: Reject cross origin javascript URIs through iframe.src in content, as we already do for window.open and location. The parent would reject these anyway.
• String changes made/needed?: No
• Is Android affected?: yes

Original Revision: https://phabricator.services.mozilla.com/D312706

firefox-esr153 Uplift Approval Request

• User impact if declined/Reason for urgency: parent-process crash
• Code covered by automated testing?: yes
• Fix verified in Nightly?: yes
• Needs manual QE testing?: no
• Steps to reproduce for manual QE testing: See comment 12
• Risk associated with taking this patch: low
• Explanation of risk level: Reject cross origin javascript URIs through iframe.src in content, as we already do for window.open and location. The parent would reject these anyway.
• String changes made/needed?: No
• Is Android affected?: yes

Original Revision: https://phabricator.services.mozilla.com/D312706

firefox-release Uplift Approval Request

• User impact if declined/Reason for urgency: parent-process crash
• Code covered by automated testing?: yes
• Fix verified in Nightly?: yes
• Needs manual QE testing?: no
• Steps to reproduce for manual QE testing: See comment 12
• Risk associated with taking this patch: low
• Explanation of risk level: Reject cross origin javascript URIs through iframe.src in content, as we already do for window.open and location. The parent would reject these anyway.
• String changes made/needed?: No
• Is Android affected?: yes

To clarify, html spec step 4 rejects cross origin javascript URIs, Chrome and Firefox do too. Web pages should not have a reason to trigger this bug, though a buggy page might do so and cause parent process crashes.

#2 crash for Thunderbird release 153.0 (non-ESR). All about opening PDFs

The few Thunderbird failures I looked through are a different error. The sudden increase in frequency is surprising to me, I don't immediately see what change could've caused that.

nsDocShellLoadState URI changed while in content process

Do we have a bug that tracks the Thunderbird crashes? This bug is likely about something else and my change probably won't fix it.

(In reply to Vincent Hilla [:vhilla] from comment #29)

The few Thunderbird failures I looked through are a different error. The sudden increase in frequency is surprising to me, I don't immediately see what change could've caused that.

nsDocShellLoadState URI changed while in content process

Do we have a bug that tracks the Thunderbird crashes? This bug is likely about something else and my change probably won't fix it.

Filed bug 2057980