1861553 - Assertion failure: attrs.mPartitionKey.Equals(partitionKey), at /builds/worker/checkouts/gecko/toolkit/components/resistfingerprinting/nsRFPService.cpp:1630

Status: RESOLVED DUPLICATE of bug 1873682

(Core :: Privacy: Anti-Tracking, defect, P3)

Description

[Tyson Smith [:tsmith]]

Found while fuzzing m-c 20231020-9c4a85b9e8b5 (--enable-debug --enable-fuzzing)

This has been reported by fuzzers and by live site testing. Getting a reliable test case has been tricky but a Pernosco session is available here: https://pernos.co/debug/DqaCTF8YDg86XlcHGELOKw/index.html

Assertion failure: attrs.mPartitionKey.Equals(partitionKey), at /builds/worker/checkouts/gecko/toolkit/components/resistfingerprinting/nsRFPService.cpp:1630

#0 0x7fd261c7ba35 in mozilla::nsRFPService::GetOverriddenFingerprintingSettingsForChannel(nsIChannel*) /builds/worker/checkouts/gecko/toolkit/components/resistfingerprinting/nsRFPService.cpp:1629:3
#1 0x7fd261a052ae in mozilla::AntiTrackingUtils::UpdateAntiTrackingInfoForChannel(nsIChannel*) /builds/worker/checkouts/gecko/toolkit/components/antitracking/AntiTrackingUtils.cpp:980:7
#2 0x7fd25af46b18 in mozilla::net::nsHttpChannel::AsyncOpen(nsIStreamListener*) /builds/worker/checkouts/gecko/netwerk/protocol/http/nsHttpChannel.cpp:6114:3
#3 0x7fd25ae3bff7 in mozilla::net::HttpChannelParent::InvokeAsyncOpen(nsresult) /builds/worker/checkouts/gecko/netwerk/protocol/http/HttpChannelParent.cpp:386:18
#4 0x7fd25ae3bd71 in mozilla::net::HttpChannelParent::TryInvokeAsyncOpen(nsresult) /builds/worker/checkouts/gecko/netwerk/protocol/http/HttpChannelParent.cpp:210:3
#5 0x7fd25ae9c217 in mozilla::MozPromise<bool, nsresult, false>::ThenValue<mozilla::net::HttpChannelParent::DoAsyncOpen(nsIURI*, nsIURI*, nsIURI*, nsIReferrerInfo*, nsIURI*, nsIURI*, unsigned int const&, CopyableTArray<mozilla::net::RequestHeaderTuple> const&, nsTString<char> const&, mozilla::Maybe<mozilla::ipc::IPCStream> const&, bool const&, short const&, mozilla::net::ClassOfService const&, unsigned char const&, bool const&, unsigned int const&, bool const&, unsigned long const&, nsTString<char> const&, bool const&, bool const&, bool const&, bool const&, bool const&, unsigned int const&, mozilla::net::LoadInfoArgs const&, unsigned int const&, unsigned long const&, mozilla::Maybe<mozilla::net::CorsPreflightArgs> const&, unsigned int const&, bool const&, bool const&, bool const&, nsTString<char> const&, mozilla::dom::RequestMode const&, unsigned int const&, unsigned long const&, nsTString<char16_t> const&, unsigned long const&, nsTArray<mozilla::net::PreferredAlternativeDataTypeParams> const&, unsigned long const&, mozilla::TimeStamp const&, mozilla::TimeStamp const&, mozilla::TimeStamp const&, mozilla::TimeStamp const&, mozilla::TimeStamp const&, mozilla::TimeStamp const&, bool const&, mozilla::TimeStamp const&, unsigned long const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&)::$_2, mozilla::net::HttpChannelParent::DoAsyncOpen(nsIURI*, nsIURI*, nsIURI*, nsIReferrerInfo*, nsIURI*, nsIURI*, unsigned int const&, CopyableTArray<mozilla::net::RequestHeaderTuple> const&, nsTString<char> const&, mozilla::Maybe<mozilla::ipc::IPCStream> const&, bool const&, short const&, mozilla::net::ClassOfService const&, unsigned char const&, bool const&, unsigned int const&, bool const&, unsigned long const&, nsTString<char> const&, bool const&, bool const&, bool const&, bool const&, bool const&, unsigned int const&, mozilla::net::LoadInfoArgs const&, unsigned int const&, unsigned long const&, mozilla::Maybe<mozilla::net::CorsPreflightArgs> const&, unsigned int const&, bool const&, bool const&, bool const&, nsTString<char> const&, mozilla::dom::RequestMode const&, unsigned int const&, unsigned long const&, nsTString<char16_t> const&, unsigned long const&, nsTArray<mozilla::net::PreferredAlternativeDataTypeParams> const&, unsigned long const&, mozilla::TimeStamp const&, mozilla::TimeStamp const&, mozilla::TimeStamp const&, mozilla::TimeStamp const&, mozilla::TimeStamp const&, mozilla::TimeStamp const&, bool const&, mozilla::TimeStamp const&, unsigned long const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&)::$_3>::DoResolveOrRejectInternal(mozilla::MozPromise<bool, nsresult, false>::ResolveOrRejectValue&) /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h
#6 0x7fd25a2f3643 in mozilla::MozPromise<bool, nsresult, false>::ThenValueBase::ResolveOrRejectRunnable::Run() /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:490:21
#7 0x7fd25a6ae347 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:549:16
#8 0x7fd25a6a5f13 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:876:26
#9 0x7fd25a6a4757 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:699:15
#10 0x7fd25a6a4bb5 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:485:36
#11 0x7fd25a6b2056 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:211:37
#12 0x7fd25a6b2056 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
#13 0x7fd25a6c8a62 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1198:16
#14 0x7fd25a6cfb4d in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
#15 0x7fd25b387135 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
#16 0x7fd25b2a1121 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
#17 0x7fd25b2a1121 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
#18 0x7fd25fbd81d8 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27
#19 0x7fd261ca5484 in nsAppStartup::Run() /builds/worker/checkouts/gecko/toolkit/components/startup/nsAppStartup.cpp:296:30
#20 0x7fd261e0b5a5 in XREMain::XRE_mainRun() /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:5675:22
#21 0x7fd261e0cd16 in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:5884:8
#22 0x7fd261e0d932 in XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:5940:21
#23 0x55705866a187 in do_main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:227:22
#24 0x55705866a187 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:445:16
#25 0x7fd2706d1d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#26 0x7fd2706d1e3f in __libc_start_main csu/../csu/libc-start.c:392:3
#27 0x55705863ffa8 in _start (/home/worker/builds/m-c-20231025162820-fuzzing-debug/firefox-bin+0x58fa8) (BuildId: 289ae2ba03c36a9d5adf41384f02820fe62409e1)

Comment 1

[Tim Huang[:timhuang]]

Attachment: Bug 1861553 - Don't compute the fingerprinting overrides if the top is a loopback host. r?tjr

Comment 2

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Comment 3

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20231215214115-8fd04cb03fbd.
The bug appears to have been introduced in the following build range:

Start: 4091bed4a0aae7772537e08e6cb49bf0bc7434c9 (20231018043634)
End: 604dc9fa34d8f2dc2076436d207d3fc9dea1b98e (20231018000534)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=4091bed4a0aae7772537e08e6cb49bf0bc7434c9&tochange=604dc9fa34d8f2dc2076436d207d3fc9dea1b98e

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Based on comment #3, this bug contains a bisection range found by bugmon. However, the Regressed by field is still not filled.

:timhuang, if possible, could you fill the Regressed by field and investigate this regression?

For more information, please visit BugBot documentation.

Comment 5

[Dianna Smith [:diannaS] - on Leave, back on August 9th]

:timhuang any update on what we can do here? Are you planning on disabling/adjusting the assertion?

Comment 6

[Tim Huang[:timhuang]]

I am working on Bug 1873682, which can potentially fix this bug. We can verify once that bug is fixed.

Comment 8

[Bugmon [:jkratzer for issues]]

No valid actions for resolution (DUPLICATE).
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.