I was able to track it down further. The following block is responsible: https://searchfox.org/mozilla-central/source/security/manager/ssl/ContentSignatureVerifier.cpp#369-402 If I remove that block of code, both tests pass. It cannot be as simple as not destroying the result of VFY_CreateContext, I think we can assume that mozilla::UniqueVFYContext automatically calls VFY_DestroyContext.
Bug 1884444 Comment 29 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
I was able to track it down further. The following block is responsible: https://searchfox.org/mozilla-central/source/security/manager/ssl/ContentSignatureVerifier.cpp#369-402 If I remove that block of code, both tests don't crash. It cannot be as simple as not destroying the result of VFY_CreateContext, I think we can assume that mozilla::UniqueVFYContext automatically calls VFY_DestroyContext.