Closed Bug 1873682 Opened 5 months ago Closed 2 months ago

Assertion failure: attrs.mPartitionKey.Equals(partitionKey)

Categories

(Core :: Privacy: Anti-Tracking, defect, P3)

Product:
Core
Component:
Privacy: Anti-Tracking
Platform:
Desktop
Windows 11
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
126 Branch
Tracking Flags:
Tracking Status
firefox126 --- fixed

People

(Reporter: aiunusov, Assigned: timhuang)

References

Details

Attachments

(1 file)

Bug 1873682 - Fallback to use partitionKey as the top URI when getting the fingerprinting override if the top-level window has been navigated away. r?tjr!,#anti-tracking
48 bytes, text/x-phabricator-request
Details | Review

Prerequisites

Nightly, Debug build.

  1. go to the https://chip.de . Scroll for a bit.
  2. in the current tab, type goo.gl and press Enter

https://searchfox.org/mozilla-central/source/toolkit/components/resistfingerprinting/nsRFPService.cpp#1863

Assertion failure: attrs.mPartitionKey.Equals(partitionKey), at C:/Users/aiunu/mozilla-source/mozilla-unified/toolkit/components/resistfingerprinting/nsRFPService.cpp:1863
#01: mozilla::nsRFPService::GetOverriddenFingerprintingSettingsForChannel (C:\Users\aiunu\mozilla-source\mozilla-unified\toolkit\components\resistfingerprinting\nsRFPService.cpp:1862)
#02: mozilla::AntiTrackingUtils::UpdateAntiTrackingInfoForChannel (C:\Users\aiunu\mozilla-source\mozilla-unified\toolkit\components\antitracking\AntiTrackingUtils.cpp:999)
#03: mozilla::net::nsHttpChannel::AsyncOpen (C:\Users\aiunu\mozilla-source\mozilla-unified\netwerk\protocol\http\nsHttpChannel.cpp:6124)
#04: mozilla::net::HttpChannelParent::InvokeAsyncOpen (C:\Users\aiunu\mozilla-source\mozilla-unified\netwerk\protocol\http\HttpChannelParent.cpp:388)
#05: mozilla::net::HttpChannelParent::TryInvokeAsyncOpen (C:\Users\aiunu\mozilla-source\mozilla-unified\netwerk\protocol\http\HttpChannelParent.cpp:212)
#06: mozilla::MozPromise<bool,nsresult,0>::ThenValue<lambda at C:\Users\aiunu\mozilla-source\mozilla-unified\netwerk\protocol\http\HttpChannelParent.cpp:662:11',lambda at C:\Users\aiunu\mozilla-source\mozilla-unified\netwerk\protocol\http\HttpChannelParent.c (C:\Users\aiunu\mozilla-source\mozilla-unified\obj-x86_64-pc-windows-msvc\dist\include\mozilla\MozPromise.h:883)
#07: mozilla::MozPromise<bool,nsresult,0>::ThenValueBase::ResolveOrRejectRunnable::Run (C:\Users\aiunu\mozilla-source\mozilla-unified\obj-x86_64-pc-windows-msvc\dist\include\mozilla\MozPromise.h:491)
#08: mozilla::RunnableTask::Run (C:\Users\aiunu\mozilla-source\mozilla-unified\xpcom\threads\TaskController.cpp:569)
#09: mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal (C:\Users\aiunu\mozilla-source\mozilla-unified\xpcom\threads\TaskController.cpp:895)
#10: mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal (C:\Users\aiunu\mozilla-source\mozilla-unified\xpcom\threads\TaskController.cpp:718)
#11: mozilla::TaskController::ProcessPendingMTTask (C:\Users\aiunu\mozilla-source\mozilla-unified\xpcom\threads\TaskController.cpp:504)
#12: mozilla::detail::RunnableFunction<`lambda at C:\Users\aiunu\mozilla-source\mozilla-unified\xpcom\threads\TaskController.cpp:222:7'>::Run (C:\Users\aiunu\mozilla-source\mozilla-unified\xpcom\threads\nsThreadUtils.h:549)
#13: nsThread::ProcessNextEvent (C:\Users\aiunu\mozilla-source\mozilla-unified\xpcom\threads\nsThread.cpp:1203)
#14: NS_ProcessNextEvent (C:\Users\aiunu\mozilla-source\mozilla-unified\xpcom\threads\nsThreadUtils.cpp:480)
#15: mozilla::ipc::MessagePump::Run (C:\Users\aiunu\mozilla-source\mozilla-unified\ipc\glue\MessagePump.cpp:85)
#16: MessageLoop::RunHandler (C:\Users\aiunu\mozilla-source\mozilla-unified\ipc\chromium\src\base\message_loop.cc:364)
#17: MessageLoop::Run (C:\Users\aiunu\mozilla-source\mozilla-unified\ipc\chromium\src\base\message_loop.cc:346)
#18: nsBaseAppShell::Run (C:\Users\aiunu\mozilla-source\mozilla-unified\widget\nsBaseAppShell.cpp:150)
#19: nsAppShell::Run (C:\Users\aiunu\mozilla-source\mozilla-unified\widget\windows\nsAppShell.cpp:822)
#20: nsAppStartup::Run (C:\Users\aiunu\mozilla-source\mozilla-unified\toolkit\components\startup\nsAppStartup.cpp:297)
#21: XREMain::XRE_mainRun (C:\Users\aiunu\mozilla-source\mozilla-unified\toolkit\xre\nsAppRunner.cpp:5747)
#22: XREMain::XRE_main (C:\Users\aiunu\mozilla-source\mozilla-unified\toolkit\xre\nsAppRunner.cpp:5956)
#23: XRE_main (C:\Users\aiunu\mozilla-source\mozilla-unified\toolkit\xre\nsAppRunner.cpp:6013)
#24: NS_internal_main (C:\Users\aiunu\mozilla-source\mozilla-unified\browser\app\nsBrowserApp.cpp:445)
#25: wmain (C:\Users\aiunu\mozilla-source\mozilla-unified\toolkit\xre\nsWindowsWMain.cpp:151)
#26: __scrt_common_main_seh (D:\a_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288)
#27: BaseThreadInitThunk[C:\WINDOWS\System32\KERNEL32.DLL +0x1257d]
#28: RtlUserThreadStart[C:\WINDOWS\SYSTEM32\ntdll.dll +0x5aa58]

OS: Unspecified → Windows 11
Hardware: Unspecified → Desktop
Version: unspecified → Trunk
See Also: → 1861369
Assignee: nobody → tihuang
Severity: -- → S3
Priority: -- → P3

I see the same assertion failure on facebook.com on a debug build. I'm on macOS also, so it's unlikely that this is a Windows only bug.

STR:

  1. Navigate to facebook.com
  2. Click on "allow all cookies" on the cookie banner.
  3. Close the tab and navigate to facebook.com again.
  4. Click on the back button.

This crashes the whole browser with the same assertion failure.

Here's the whole stack:

Assertion failure: attrs.mPartitionKey.Equals(partitionKey), at /Users/canova/projects/mozilla-central/toolkit/components/resistfingerprinting/nsRFPService.cpp:2021
#01: mozilla::nsRFPService::GetOverriddenFingerprintingSettingsForChannel(nsIChannel*)[/Users/canova/projects/mozilla-central/obj-aarch64-apple-darwin23.2.0/toolkit/library/build/XUL +0xcd7caf4]
#02: mozilla::AntiTrackingUtils::UpdateAntiTrackingInfoForChannel(nsIChannel*)[/Users/canova/projects/mozilla-central/obj-aarch64-apple-darwin23.2.0/toolkit/library/build/XUL +0xc8eb97c]
#03: mozilla::net::nsHttpChannel::AsyncOpen(nsIStreamListener*)[/Users/canova/projects/mozilla-central/obj-aarch64-apple-darwin23.2.0/toolkit/library/build/XUL +0x21c4cf8]
#04: mozilla::net::HttpChannelParent::InvokeAsyncOpen(nsresult)[/Users/canova/projects/mozilla-central/obj-aarch64-apple-darwin23.2.0/toolkit/library/build/XUL +0x2036f0c]
#05: mozilla::net::HttpChannelParent::TryInvokeAsyncOpen(nsresult)[/Users/canova/projects/mozilla-central/obj-aarch64-apple-darwin23.2.0/toolkit/library/build/XUL +0x2036d68]
#06: mozilla::net::HttpChannelParent::DoAsyncOpen(nsIURI*, nsIURI*, nsIURI*, nsIReferrerInfo*, nsIURI*, nsIURI*, unsigned int const&, CopyableTArray<mozilla::net::RequestHeaderTuple> const&, nsTString<char> const&, mozilla::Maybe<mozilla::ipc::IPCStream> const[/Users/canova/projects/mozilla-central/obj-aarch64-apple-darwin23.2.0/toolkit/library/build/XUL +0x20f3078]
#07: std::__1::enable_if<!TakesArgument<void (mozilla::net::HttpChannelParent::DoAsyncOpen(nsIURI*, nsIURI*, nsIURI*, nsIReferrerInfo*, nsIURI*, nsIURI*, unsigned int const&, CopyableTArray<mozilla::net::RequestHeaderTuple> const&, nsTString<char> const&, mozi[/Users/canova/projects/mozilla-central/obj-aarch64-apple-darwin23.2.0/toolkit/library/build/XUL +0x20f3298]
#08: std::__1::enable_if<!false, void>::type mozilla::MozPromise<bool, nsresult, false>::InvokeCallbackMethod<false, mozilla::net::HttpChannelParent::DoAsyncOpen(nsIURI*, nsIURI*, nsIURI*, nsIReferrerInfo*, nsIURI*, nsIURI*, unsigned int const&, CopyableTArray[/Users/canova/projects/mozilla-central/obj-aarch64-apple-darwin23.2.0/toolkit/library/build/XUL +0x20f2fb4]
#09: mozilla::MozPromise<bool, nsresult, false>::ThenValue<mozilla::net::HttpChannelParent::DoAsyncOpen(nsIURI*, nsIURI*, nsIURI*, nsIReferrerInfo*, nsIURI*, nsIURI*, unsigned int const&, CopyableTArray<mozilla::net::RequestHeaderTuple> const&, nsTString<char>[/Users/canova/projects/mozilla-central/obj-aarch64-apple-darwin23.2.0/toolkit/library/build/XUL +0x20f2678]
#10: mozilla::MozPromise<bool, nsresult, false>::ThenValueBase::DoResolveOrReject(mozilla::MozPromise<bool, nsresult, false>::ResolveOrRejectValue&)[/Users/canova/projects/mozilla-central/obj-aarch64-apple-darwin23.2.0/toolkit/library/build/XUL +0x5aaa8]
#11: mozilla::MozPromise<bool, nsresult, false>::ThenValueBase::ResolveOrRejectRunnable::Run()[/Users/canova/projects/mozilla-central/obj-aarch64-apple-darwin23.2.0/toolkit/library/build/XUL +0x5a724]
#12: mozilla::RunnableTask::Run()[/Users/canova/projects/mozilla-central/obj-aarch64-apple-darwin23.2.0/toolkit/library/build/XUL +0x13459bc]
#13: mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)[/Users/canova/projects/mozilla-central/obj-aarch64-apple-darwin23.2.0/toolkit/library/build/XUL +0x13363a4]
#14: mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)[/Users/canova/projects/mozilla-central/obj-aarch64-apple-darwin23.2.0/toolkit/library/build/XUL +0x13346c4]
#15: mozilla::TaskController::ProcessPendingMTTask(bool)[/Users/canova/projects/mozilla-central/obj-aarch64-apple-darwin23.2.0/toolkit/library/build/XUL +0x1334abc]
#16: mozilla::TaskController::TaskController()::$_0::operator()() const[/Users/canova/projects/mozilla-central/obj-aarch64-apple-darwin23.2.0/toolkit/library/build/XUL +0x1360514]
#17: mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run()[/Users/canova/projects/mozilla-central/obj-aarch64-apple-darwin23.2.0/toolkit/library/build/XUL +0x1360480]
#18: nsThread::ProcessNextEvent(bool, bool*)[/Users/canova/projects/mozilla-central/obj-aarch64-apple-darwin23.2.0/toolkit/library/build/XUL +0x1384760]
#19: NS_ProcessPendingEvents(nsIThread*, unsigned int)[/Users/canova/projects/mozilla-central/obj-aarch64-apple-darwin23.2.0/toolkit/library/build/XUL +0x137fcac]
#20: nsBaseAppShell::NativeEventCallback()[/Users/canova/projects/mozilla-central/obj-aarch64-apple-darwin23.2.0/toolkit/library/build/XUL +0x975c858]
#21: nsAppShell::ProcessGeckoEvents(void*)[/Users/canova/projects/mozilla-central/obj-aarch64-apple-darwin23.2.0/toolkit/library/build/XUL +0x98528dc]
#22: __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__[/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation +0x7da4c]
#23: __CFRunLoopDoSource0[/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation +0x7d9e0]
#24: __CFRunLoopDoSources0[/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation +0x7d750]
#25: __CFRunLoopRun[/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation +0x7c340]
#26: CFRunLoopRunSpecific[/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation +0x7b9ac]
#27: RunCurrentEventLoopInMode[/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox +0x30448]
#28: ReceiveNextEventCommon[/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox +0x30284]
#29: _BlockUntilNextEventMatchingListInModeWithFilter[/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox +0x2ffdc]
#30: _DPSNextEvent[/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit +0x398a4]
#31: -[NSApplication(NSEventRouting) _nextEventMatchingEventMask:untilDate:inMode:dequeue:][/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit +0x813980]
#32: -[GeckoNSApplication nextEventMatchingMask:untilDate:inMode:dequeue:][/Users/canova/projects/mozilla-central/obj-aarch64-apple-darwin23.2.0/toolkit/library/build/XUL +0x98513a0]
#33: -[NSApplication run][/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit +0x2cd50]
#34: -[GeckoNSApplication run][/Users/canova/projects/mozilla-central/obj-aarch64-apple-darwin23.2.0/toolkit/library/build/XUL +0x9851130]
#35: nsAppShell::Run()[/Users/canova/projects/mozilla-central/obj-aarch64-apple-darwin23.2.0/toolkit/library/build/XUL +0x9853578]
#36: nsAppStartup::Run()[/Users/canova/projects/mozilla-central/obj-aarch64-apple-darwin23.2.0/toolkit/library/build/XUL +0xcdc801c]
#37: XREMain::XRE_mainRun()[/Users/canova/projects/mozilla-central/obj-aarch64-apple-darwin23.2.0/toolkit/library/build/XUL +0xd05c5e8]
#38: XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&)[/Users/canova/projects/mozilla-central/obj-aarch64-apple-darwin23.2.0/toolkit/library/build/XUL +0xd05d68c]
#39: XRE_main(int, char**, mozilla::BootstrapConfig const&)[/Users/canova/projects/mozilla-central/obj-aarch64-apple-darwin23.2.0/toolkit/library/build/XUL +0xd05dc44]
#40: mozilla::BootstrapImpl::XRE_main(int, char**, mozilla::BootstrapConfig const&)[/Users/canova/projects/mozilla-central/obj-aarch64-apple-darwin23.2.0/toolkit/library/build/XUL +0xd0796b0]
#41: do_main(int, char**, char**)[/Users/canova/projects/mozilla-central/obj-aarch64-apple-darwin23.2.0/dist/NightlyDebug.app/Contents/MacOS/firefox +0x1218]
#42: main[/Users/canova/projects/mozilla-central/obj-aarch64-apple-darwin23.2.0/dist/NightlyDebug.app/Contents/MacOS/firefox +0xa08]

This patch introduces a mTopLevelWindowContextId field to
cookieJarSettings. The field caches the top-level window context id. We
use this field to check whether the top-level window is navigated away.
If so, we fallback to use partitionKey as the top URI when getting the
fingerprinting override because the top-level URI could be different in
this case.

Duplicate of this bug: 1861369
See Also: → 1885979
Duplicate of this bug: 1885979
Pushed by tihuang@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/0cda2285fb46
Fallback to use partitionKey as the top URI when getting the fingerprinting override if the top-level window has been navigated away. r=tjr,anti-tracking-reviewers,cookie-reviewers,pbz

Backed out for causing process-crash failures
Crash signature: [@ mozilla::nsRFPService::GetOverriddenFingerprintingSettingsForChannel]

Backout link

Push with failures

Failure log

Flags: needinfo?(tihuang)
Pushed by tihuang@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/5dcfef99cd96
Fallback to use partitionKey as the top URI when getting the fingerprinting override if the top-level window has been navigated away. r=tjr,anti-tracking-reviewers,cookie-reviewers,pbz

https://hg.mozilla.org/mozilla-central/rev/5dcfef99cd96

Status: NEW → RESOLVED
Closed: 2 months ago
status-firefox126: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → 126 Branch
Flags: needinfo?(tihuang)

We can probably close Bug 1861553 and Bug 1859952 right?

Flags: needinfo?(tihuang)

Yes, I believe we can. I will close them as dup of this one.

Flags: needinfo?(tihuang)
Duplicate of this bug: 1859952
Duplicate of this bug: 1861553
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: