1803171 - FedCM Promise rejections on timeout cause tab crashes

Status: RESOLVED FIXED

(Core :: DOM: Credential Management, defect)

Description

[Benjamin VanderSloot [:bvandersloot]]

If you have the following config:

dom.security.credentialmanagement.identity.enabled: true
dom.security.credentialmanagement.identity.select_first_in_ui_lists: false	
dom.security.credentialmanagement.identity.wait_for_timeout: true

Then any use of the API that leads to a the returned promise being rejected causes a tab crash. Running the following in the console is an easy reproduction condition:

return await navigator.credentials.get({
      identity: {
        providers: [{
          configURL: "https://idp.example/manifest.json",
          clientId: "123",
          nonce: 123
        }]
      }
    });

A likely candidate for the bug is the fun manual pointer management in IdentityCredential::DiscoverFromExternalSource required to make the timeout work.

Comment 1

[Benjamin VanderSloot [:bvandersloot]]

Attachment: Bug 1803171 - FedCM Promise rejections on timeout cause tab crashes, r=pbz!

I found the source of the crash. We need to grab a reference of the promise and release it after the callback fires and make sure we don't lose our promise ref when we return from this function.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/021d5430a274
FedCM Promise rejections on timeout cause tab crashes, r=pbz

Comment 3

[Marian-Vasile Laza]

https://hg.mozilla.org/mozilla-central/rev/021d5430a274