The following tests:
test_dynUnsecureIframeRedirect.html
test_unsecureIframeRedirect.html

Don't go through the mixed content blocker even with the patches in Bug 1584159 the ShouldLoad call never fires.

It appears AsyncOnChannelRedirect doesn't happen for all the loads in the middle in fission.

I'm hitting these warnings: https://searchfox.org/mozilla-central/rev/35873cfc312a6285f54aa5e4ec2d4ab911157522/netwerk/ipc/DocumentChannelChild.cpp#40-42

This seems to happen when nsDocumentOpenInfo::OnStartRequest QI's the request: nsCOMPtr<nsIHttpChannel> httpChannel(do_QueryInterface(request, &rv)); - https://searchfox.org/mozilla-central/rev/35873cfc312a6285f54aa5e4ec2d4ab911157522/uriloader/base/nsURILoader.cpp#219

The callstack is:

 0:48.35 GECKO(8293) #01: mozilla::net::DocumentChannelChild::QueryInterface(nsID const&, void**) (/home/jonathan/projects/mozilla-unified/netwerk/ipc/DocumentChannelChild.cpp:35)
 0:48.37 GECKO(8293) #02: nsQueryInterfaceISupportsWithError::operator()(nsID const&, void**) const (/home/jonathan/projects/mozilla-unified/xpcom/base/nsCOMPtr.cpp:25)
 0:48.46 GECKO(8293) #03: nsQueryInterfaceWithError<nsIRequest>::operator()(nsID const&, void**) const (/home/jonathan/projects/mozilla-unified/obj-devedition/dist/include/nsCOMPtr.h:197)
 0:48.46 GECKO(8293) #04: void nsCOMPtr<nsIHttpChannel>::assign_from_qi_with_error<nsIRequest>(nsQueryInterfaceWithError<nsIRequest> const&, nsID const&) (/home/jonathan/projects/mozilla-unified/obj-devedition/dist/include/nsCOMPtr.h:1176)
 0:48.46 GECKO(8293) #05: nsCOMPtr<nsIRequest> (/home/jonathan/projects/mozilla-unified/obj-devedition/dist/include/nsCOMPtr.h:584)
 0:48.82 GECKO(8293) #06: nsDocumentOpenInfo::OnStartRequest(nsIRequest*) (/home/jonathan/projects/mozilla-unified/uriloader/base/nsURILoader.cpp:221)
 0:52.77 GECKO(8293) #07: mozilla::net::DocumentChannelChild::ShutdownListeners(nsresult) (Unified_cpp_netwerk_ipc0.cpp:?)
 0:52.78 GECKO(8293) #08: mozilla::net::DocumentChannelChild::Cancel(nsresult) (/home/jonathan/projects/mozilla-unified/netwerk/ipc/DocumentChannelChild.cpp:570)
 0:52.79 GECKO(8293) #09: mozilla::net::nsLoadGroup::Cancel(nsresult) (/home/jonathan/projects/mozilla-unified/netwerk/base/nsLoadGroup.cpp:220)
 0:52.80 GECKO(8293) #10: nsDocLoader::Stop() (/home/jonathan/projects/mozilla-unified/uriloader/base/nsDocLoader.cpp:237)
 0:53.13 GECKO(8293) #11: nsDocShell::Stop() (/home/jonathan/projects/mozilla-unified/docshell/base/nsDocShell.h:213)
 0:53.14 GECKO(8293) #12: nsDocShell::Stop(unsigned int) (/home/jonathan/projects/mozilla-unified/docshell/base/nsDocShell.cpp:4476)
 0:53.15 GECKO(8293) #13: nsDocShell::Destroy() (/home/jonathan/projects/mozilla-unified/docshell/base/nsDocShell.cpp:4731)
 0:53.40 GECKO(8293) #14: nsFrameLoader::DestroyDocShell() (Unified_cpp_dom_base8.cpp:?)
 0:53.40 GECKO(8293) #15: nsFrameLoaderDestroyRunnable::Run() (/home/jonathan/projects/mozilla-unified/dom/base/nsFrameLoader.cpp:1840)
 0:54.42 GECKO(8293) #16: mozilla::dom::Document::MaybeInitializeFinalizeFrameLoaders() (/home/jonathan/projects/mozilla-unified/dom/base/Document.cpp:8496)
 0:54.43 GECKO(8293) #17: decltype (((*{parm#1}).*{parm#2})()) mozilla::detail::RunnableMethodArguments<>::applyImpl<mozilla::dom::Document, void (mozilla::dom::Document::*)()>(mozilla::dom::Document*, void (mozilla::dom::Document::*)(), mozilla::Tuple<>&, std::integer_sequence<unsigned long>) (/home/jonathan/projects/mozilla-unified/obj-devedition/dist/include/nsThreadUtils.h:1124)
 0:54.44 GECKO(8293) #18: decltype (applyImpl({parm#1}, {parm#2}, (*this).mArguments, std::integer_sequence<unsigned long>{})) mozilla::detail::RunnableMethodArguments<>::apply<mozilla::dom::Document, void (mozilla::dom::Document::*)()>(mozilla::dom::Document*, void (mozilla::dom::Document::*)()) (/home/jonathan/projects/mozilla-unified/obj-devedition/dist/include/nsThreadUtils.h:1130)
 0:54.46 GECKO(8293) #19: mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run() (Unified_cpp_dom_base2.cpp:?)
 0:54.58 GECKO(8293) #20: nsContentUtils::RemoveScriptBlocker() (/home/jonathan/projects/mozilla-unified/dom/base/nsContentUtils.cpp:5197)
 0:54.59 GECKO(8293) #21: ~nsAutoScriptBlocker (/home/jonathan/projects/mozilla-unified/dom/base/nsContentUtils.h:3338)
 0:54.60 GECKO(8293) #22: nsFrameLoaderOwner::ChangeRemotenessCommon(bool, nsTSubstring<char16_t> const&, std::function<void ()>&, mozilla::ErrorResult&) (/home/jonathan/projects/mozilla-unified/dom/base/nsFrameLoaderOwner.cpp:129)
 0:54.61 GECKO(8293) #23: nsFrameLoaderOwner::ChangeRemotenessWithBridge(mozilla::dom::BrowserBridgeChild*, mozilla::ErrorResult&) (/home/jonathan/projects/mozilla-unified/dom/base/nsFrameLoaderOwner.cpp:218)
 0:54.64 GECKO(8293) #24: mozilla::dom::WindowGlobalChild::RecvMakeFrameRemote(mozilla::dom::BrowsingContext*, mozilla::ipc::ManagedEndpoint<mozilla::dom::PBrowserBridgeChild>&&, mozilla::dom::IdType<mozilla::dom::BrowserParent> const&, std::function<void (bool const&)>&&) (/home/jonathan/projects/mozilla-unified/dom/ipc/WindowGlobalChild.cpp:341)
 0:54.73 GECKO(8293) #25: mozilla::dom::PWindowGlobalChild::OnMessageReceived(IPC::Message const&) (/home/jonathan/projects/mozilla-unified/obj-devedition/ipc/ipdl/PWindowGlobalChild.cpp:451)
 0:54.99 GECKO(8293) #26: mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) (/home/jonathan/projects/mozilla-unified/obj-devedition/ipc/ipdl/PContentChild.cpp:7817)
 0:55.09 GECKO(8293) #27: mozilla::dom::ContentChild::OnMessageReceived(IPC::Message const&) (/home/jonathan/projects/mozilla-unified/dom/ipc/ContentChild.cpp:3819)
 0:55.15 GECKO(8293) #28: mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) (/home/jonathan/projects/mozilla-unified/ipc/glue/MessageChannel.cpp:2208)
 0:55.17 GECKO(8293) #29: mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) (Unified_cpp_ipc_glue1.cpp:?)
 0:55.19 GECKO(8293) #30: mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) (Unified_cpp_ipc_glue1.cpp:?)
 0:55.20 GECKO(8293) #31: mozilla::ipc::MessageChannel::MessageTask::Run() (/home/jonathan/projects/mozilla-unified/ipc/glue/MessageChannel.cpp:2004)
 0:55.23 GECKO(8293) #32: mozilla::SchedulerGroup::Runnable::Run() (/home/jonathan/projects/mozilla-unified/xpcom/threads/SchedulerGroup.cpp:295)
 0:55.29 GECKO(8293) #33: nsThread::ProcessNextEvent(bool, bool*) (/home/jonathan/projects/mozilla-unified/xpcom/threads/nsThread.cpp:1225)
 0:55.30 GECKO(8293) #34: NS_ProcessNextEvent(nsIThread*, bool) (/home/jonathan/projects/mozilla-unified/xpcom/threads/nsThreadUtils.cpp:486)
 0:55.31 GECKO(8293) #35: mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) (/home/jonathan/projects/mozilla-unified/ipc/glue/MessagePump.cpp:85)
 0:55.33 GECKO(8293) #36: mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) (/home/jonathan/projects/mozilla-unified/ipc/glue/MessagePump.cpp:272)
 0:55.35 GECKO(8293) #37: MessageLoop::RunInternal() (/home/jonathan/projects/mozilla-unified/ipc/chromium/src/base/message_loop.cc:315)
 0:55.36 GECKO(8293) #38: MessageLoop::RunHandler() (/home/jonathan/projects/mozilla-unified/ipc/chromium/src/base/message_loop.cc:309)
 0:55.37 GECKO(8293) #39: MessageLoop::Run() (/home/jonathan/projects/mozilla-unified/ipc/chromium/src/base/message_loop.cc:290)
 0:55.40 GECKO(8293) #40: nsBaseAppShell::Run() (/home/jonathan/projects/mozilla-unified/widget/nsBaseAppShell.cpp:139)
 0:55.41 GECKO(8293) #41: XRE_RunAppShell() (/home/jonathan/projects/mozilla-unified/toolkit/xre/nsEmbedFunctions.cpp:934)
 0:55.43 GECKO(8293) #42: mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) (/home/jonathan/projects/mozilla-unified/ipc/glue/MessagePump.cpp:238)
 0:55.43 GECKO(8293) #43: MessageLoop::RunInternal() (/home/jonathan/projects/mozilla-unified/ipc/chromium/src/base/message_loop.cc:315)
 0:55.43 GECKO(8293) #44: MessageLoop::RunHandler() (/home/jonathan/projects/mozilla-unified/ipc/chromium/src/base/message_loop.cc:309)
 0:55.43 GECKO(8293) #45: MessageLoop::Run() (/home/jonathan/projects/mozilla-unified/ipc/chromium/src/base/message_loop.cc:290)
 0:55.44 GECKO(8293) #46: XRE_InitChildProcess(int, char**, XREChildData const*) (/home/jonathan/projects/mozilla-unified/toolkit/xre/nsEmbedFunctions.cpp:773)
 0:55.45 GECKO(8293) #47: mozilla::BootstrapImpl::XRE_InitChildProcess(int, char**, XREChildData const*) (/home/jonathan/projects/mozilla-unified/toolkit/xre/Bootstrap.cpp:67)
 0:55.47 GECKO(8293) #48: content_process_main(mozilla::Bootstrap*, int, char**) (/home/jonathan/projects/mozilla-unified/browser/app/../../ipc/contentproc/plugin-container.cpp:56)
 0:55.48 GECKO(8293) #49: main (/home/jonathan/projects/mozilla-unified/browser/app/nsBrowserApp.cpp:272)
 0:57.12 GECKO(8293) #50: __libc_start_main (/build/glibc-KRRWSm/glibc-2.29/csu/../csu/libc-start.c:342)
 0:57.13 GECKO(8293) #51: _start (/home/jonathan/projects/mozilla-unified/obj-devedition/dist/bin/firefox)
 0:57.13 GECKO(8293) #52: ??? (???:???)

The related log lines are (without fission):

 0:53.90 GECKO(2959) [Parent 2959, Main Thread] WARNING: NS_ENSURE_TRUE(aCSP) failed: file /home/jonathan/projects/mozilla-unified/dom/security/FramingChecker.cpp, line 175
 0:53.90 GECKO(2959) [Child 3040: Main Thread]: D/nsRedirect nsAsyncRedirectVerifyHelper::Init() oldChan=0x7f61ad940080 newChan=0x7f61b089b080
 0:53.90 GECKO(2959) [Child 3040: Main Thread]: D/nsRedirect nsAsyncRedirectVerifyHelper::Run() calling gIOService...
 0:53.90 GECKO(2959) [Child 3040: Main Thread]: D/nsRedirect nsAsyncRedirectVerifyHelper::DelegateOnChannelRedirect() sink=0x7f61b39f4128 expectedCBs=0 mResult=0
 0:53.90 GECKO(2959) [Child 3040: Main Thread]: D/nsRedirect nsAsyncRedirectVerifyHelper::OnRedirectVerifyCallback() result=0 expectedCBs=1 mResult=0
 0:53.90 GECKO(2959) [Child 3040: Main Thread]: D/nsRedirect   result=0 expectedCBs=0
 0:53.90 GECKO(2959) [Child 3040: Main Thread]: D/nsRedirect nsAsyncRedirectVerifyHelper::DelegateOnChannelRedirect() sink=0x7f61b38b4308 expectedCBs=0 mResult=0
 0:53.90 GECKO(2959) [Child 3040: Main Thread]: D/nsRedirect nsAsyncRedirectVerifyHelper::OnRedirectVerifyCallback() result=0 expectedCBs=1 mResult=0
 0:53.90 GECKO(2959) [Child 3040: Main Thread]: D/nsRedirect   result=0 expectedCBs=0
 0:53.90 GECKO(2959) [Child 3040: Main Thread]: D/nsRedirect nsAsyncRedirectVerifyHelper::DelegateOnChannelRedirect() sink=0x7f61b38b4268 expectedCBs=0 mResult=0
 0:53.90 GECKO(2959) AsyncOnChannelRedirect !!!
 0:53.90 GECKO(2959) From: https://example.com/tests/security/manager/ssl/tests/mochitest/mixedcontent/iframeunsecredirect.sjs To: http://example.com/tests/security/manager/ssl/tests/mochitest/mixedcontent/iframe.html
 0:53.91 GECKO(2959) ShouldLoad
 0:53.91 GECKO(2959) got spec http://example.com/tests/security/manager/ssl/tests/mochitest/mixedcontent/iframe.html
 0:53.91 GECKO(2959) [Child 3040: Main Thread]: D/nsRedirect nsAsyncRedirectVerifyHelper::OnRedirectVerifyCallback() result=0 expectedCBs=1 mResult=0
 0:53.91 GECKO(2959) [Child 3040: Main Thread]: D/nsRedirect   result=0 expectedCBs=0
 0:53.91 GECKO(2959) [Child 3040: Main Thread]: D/nsRedirect nsAsyncRedirectVerifyHelper::Run() calling sink...
 0:53.91 GECKO(2959) [Child 3040: Main Thread]: D/nsRedirect nsAsyncRedirectVerifyHelper::DelegateOnChannelRedirect() sink=0x7f61b08fd488 expectedCBs=0 mResult=0
 0:53.91 GECKO(2959) [Child 3040: Main Thread]: D/nsRedirect nsAsyncRedirectVerifyHelper::OnRedirectVerifyCallback() result=0 expectedCBs=1 mResult=0
 0:53.91 GECKO(2959) [Child 3040: Main Thread]: D/nsRedirect   result=0 expectedCBs=0
 0:53.91 GECKO(2959) [Child 3040: Main Thread]: D/nsRedirect nsAsyncRedirectVerifyHelper::InitCallback() expectedCBs=0 mResult=0
 0:53.91 GECKO(2959) [Child 3040: Main Thread]: D/nsRedirect nsAsyncRedirectVerifyHelper::ExplicitCallback() result=0 expectedCBs=0 mCallbackInitiated=1 mResult=0
 0:53.91 GECKO(2959) [Child 3040: Main Thread]: D/nsRedirect nsAsyncRedirectVerifyHelper::ExplicitCallback() dispatched callback event=0x7f61b08fda80
 0:53.91 GECKO(2959) [Child 3040: Main Thread]: D/nsRedirect nsAsyncVerifyRedirectCallbackEvent::Run() callback to 0x7f61ad9400a0 with result 0
 0:54.02 GECKO(2959) ++DOMWINDOW == 16 (0x7f61b0911400) [pid = 3040] [serial = 20] [outer = 0x7f61b086f3e0]
 0:54.13 GECKO(2959) [Child 3040: Main Thread]: D/nsSecureBrowserUI GetState 0x7f61b087f520
 0:54.13 GECKO(2959) [Child 3040: Main Thread]: D/nsSecureBrowserUI   mState: 21
 0:54.13 GECKO(2959) [Child 3040: Main Thread]: D/nsSecureBrowserUI GetState 0x7f61b087f520
 0:54.13 GECKO(2959) [Child 3040: Main Thread]: D/nsSecureBrowserUI   mState: 21
 0:54.13 GECKO(2959) [Child 3040: Main Thread]: D/nsSecureBrowserUI GetState 0x7f61b087f520
 0:54.13 GECKO(2959) [Child 3040: Main Thread]: D/nsSecureBrowserUI   mState: 21
 0:54.14 PASS src='redirect to unsecure' changed to broken, expected broken got broken

With fission:

 0:55.59 GECKO(5654) [Parent 5654, Main Thread] WARNING: NS_ENSURE_TRUE(aCSP) failed: file /home/jonathan/projects/mozilla-unified/dom/security/FramingChecker.cpp, line 175
 0:55.64 GECKO(5654) ### XPCOM_MEM_BLOAT_LOG defined -- logging bloat/leaks to /tmp/tmpAGSj1m.mozrunner/runtests_leaks_tab_pid5972.log
 0:55.66 GECKO(5654) [Child 5929, Main Thread] WARNING: Trying to request nsIHttpChannel from DocumentChannelChild, this is likely broken: file /home/jonathan/projects/mozilla-unified/netwerk/ipc/DocumentChannelChild.cpp, line 42
 0:55.66 GECKO(5654) [Child 5929, Main Thread] WARNING: Trying to request nsIHttpChannel from DocumentChannelChild, this is likely broken: file /home/jonathan/projects/mozilla-unified/netwerk/ipc/DocumentChannelChild.cpp, line 42
 0:55.66 GECKO(5654) [Child 5929, Main Thread] WARNING: NS_ENSURE_TRUE(request) failed: file /home/jonathan/projects/mozilla-unified/netwerk/base/nsLoadGroup.cpp, line 575
 0:55.79 GECKO(5654) [Child 5972, Main Thread] WARNING: No CID found when attempting to map contract ID: file /home/jonathan/projects/mozilla-unified/xpcom/components/nsComponentManager.cpp, line 729
 0:56.28 GECKO(5654) Couldn't convert chrome URL: chrome://branding/locale/brand.properties
 0:56.51 GECKO(5654) ++DOCSHELL 0x7f377d561800 == 1 [pid = 5972] [id = {5be17b49-e90f-4590-a3eb-1278532a7a18}]
 0:56.52 GECKO(5654) ++DOMWINDOW == 1 (0x7f377f374100) [pid = 5972] [serial = 1] [outer = (nil)]
 0:56.52 GECKO(5654) ++DOMWINDOW == 2 (0x7f377d529000) [pid = 5972] [serial = 2] [outer = 0x7f377f374100]
 0:56.69 GECKO(5654) [Child 5972: Main Thread]: D/nsSecureBrowserUI 0x7f377f278160 OnLocationChange: 0x7f377d561828 (nil) about:blank 0
 0:56.69 GECKO(5654) [Child 5972: Main Thread]: D/nsSecureBrowserUI   calling OnSecurityChange (nil) 0
 0:56.75 GECKO(5654) ++DOMWINDOW == 3 (0x7f377f3d1000) [pid = 5972] [serial = 3] [outer = 0x7f377f374100]
 0:56.81 GECKO(5654) [Child 5972: Main Thread]: D/nsSecureBrowserUI 0x7f377f278160 OnLocationChange: 0x7f377d561828 0x7f377f393080 http://example.com/tests/security/manager/ssl/tests/mochitest/mixedcontent/iframe.html 0
 0:56.81 GECKO(5654) [Child 5972: Main Thread]: D/nsSecureBrowserUI   we have a channel 0x7f377f393080
 0:56.81 GECKO(5654) [Child 5972: Main Thread]: D/nsSecureBrowserUI   innermost URI is 'http://example.com/tests/security/manager/ssl/tests/mochitest/mixedcontent/iframe.html'
 0:56.81 GECKO(5654) [Child 5972: Main Thread]: D/nsSecureBrowserUI   URI can't be considered secure
 0:56.81 GECKO(5654) [Child 5972: Main Thread]: D/nsSecureBrowserUI   calling OnSecurityChange 0x7f377f393080 4
 0:56.89 GECKO(5654) [Child 5929: Main Thread]: D/nsSecureBrowserUI GetState 0x7f5e3a9bf880
 0:56.89 GECKO(5654) [Child 5929: Main Thread]: D/nsSecureBrowserUI   mState: 2
 0:56.89 GECKO(5654) [Child 5929: Main Thread]: D/nsSecureBrowserUI GetState 0x7f5e3a9bf880
 0:56.89 GECKO(5654) [Child 5929: Main Thread]: D/nsSecureBrowserUI   mState: 2
 0:56.89 GECKO(5654) [Child 5929: Main Thread]: D/nsSecureBrowserUI GetState 0x7f5e3a9bf880
 0:56.89 GECKO(5654) [Child 5929: Main Thread]: D/nsSecureBrowserUI   mState: 2
 0:56.90 GECKO(5654) ShouldLoad
 0:56.90 FAIL FAILURE: src='redirect to unsecure' changed to broken, expected broken got secure
    SimpleTest.ok@SimpleTest/SimpleTest.js:277:18
    onMessageReceived@security/manager/ssl/tests/mochitest/mixedcontent/mixedContentTest.js:100:18
    EventListener.handleEvent*onLoad@security/manager/ssl/tests/mochitest/mixedcontent/mixedContentTest.js:51:12
    EventHandlerNonNull*@security/manager/ssl/tests/mochitest/mixedcontent/mixedContentTest.js:34:1
 0:56.91 FAIL FAILURE: for 'broken' expected  flags [0,1,0], src='redirect to unsecure' changed to broken
    SimpleTest.ok@SimpleTest/SimpleTest.js:277:18
    onMessageReceived@security/manager/ssl/tests/mochitest/mixedcontent/mixedContentTest.js:100:18
    EventListener.handleEvent*onLoad@security/manager/ssl/tests/mochitest/mixedcontent/mixedContentTest.js:51:12
    EventHandlerNonNull*@security/manager/ssl/tests/mochitest/mixedcontent/mixedContentTest.js:34:1

It sounds like I'm debugging the side effects of Bug 1522640

I think everything involved here is http, so we are triggering a process, switch, and that's the underlying problem here.

When there's no process switch (non-fission), the content process/docshell that initiated the request sees the AsyncOnChannelRedirect call as we switch from the initial channel (DocumentChannelChild) to the final channel (HttpChannelChild), and that's where the nsMixedContentBlocker is running and blocking the load.

When there is a process switch (fission), there's no content process that has access to both the new and old nsIChannel* instances, so AsyncOnChannelRedirect(nsIChannel*,nsIChannel*) cannot be called.

AsyncOnChannelRedirect also runs on the parent-process instance of these channel objects though (and thus can run regardless of whether we did a process switch). nsMixedContentBlocker is choosing to ignore this one though, in favour of only checking in the child - https://searchfox.org/mozilla-central/rev/3300072e993ae05d50d5c63d815260367eaf9179/dom/security/nsMixedContentBlocker.cpp#292

I think the solution here is to run the mixed content blocker checks in the parent process. It looks like we depend on the docshell tree in this code, which isn't going to work under fission anyway, so we should fix this to use BrowsingContext instead.

Removing flags so this bug shows up in next triage meeting.

Temporarily reassigning these DOM Security Fission bugs to ckerschb for re-triage.

The actual problem was that iframe loads were classified as TYPE_DOCUMENT before we fixed Bug 1594529. FWIW, the tests will be enabled within Bug 1631405.