1898700 - Crash in [@ nsTArray_Impl<T>::AppendElementsInternal<T> | nsTArray<T>::AppendElement | mozilla::net::CookieServiceParent::SerializeCookieListTable]

Status: RESOLVED DUPLICATE of bug 1896241

(Core :: Networking: Cookies, defect)

Description

[Jarda Snajdr [:jsnajdr]]

Crash report: https://crash-stats.mozilla.org/report/index/f7c0f5a9-46fd-4305-8e66-0e8830240522

Reason: EXC_BAD_ACCESS / KERN_INVALID_ADDRESS

Top 10 frames:

0  XUL  nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_RelocateUsingMemutils>::L...  xpcom/ds/nsTArray.h:397
0  XUL  nsTArray_Impl<mozilla::net::CookieStruct, nsTArrayInfallibleAllocator>::Appen...  xpcom/ds/nsTArray.h:1782
1  XUL  nsTArray<mozilla::net::CookieStruct>::AppendElement()  xpcom/ds/nsTArray.h:2843
1  XUL  mozilla::net::CookieServiceParent::SerializeCookieListTable(nsTArray<mozilla:...  netwerk/cookie/CookieServiceParent.cpp:218
2  XUL  mozilla::net::CookieServiceParent::TrackCookieLoad(nsIChannel*)  netwerk/cookie/CookieServiceParent.cpp:179
3  XUL  mozilla::dom::ContentParent::UpdateCookieStatus(nsIChannel*)  dom/ipc/ContentParent.cpp:6377
3  XUL  mozilla::dom::ContentParent::AboutToLoadHttpDocumentForChild(nsIChannel*, bool*)  dom/ipc/ContentParent.cpp:6437
4  XUL  mozilla::net::HttpChannelParent::OnStartRequest(nsIRequest*)  netwerk/protocol/http/HttpChannelParent.cpp:1183
5  XUL  mozilla::net::ForwardStreamListenerFunctions(nsTArray<mozilla::Variant<mozill...  netwerk/ipc/NeckoCommon.cpp:23
5  XUL  mozilla::detail::VariantImplementation<unsigned char, (unsigned long)0, mozil...  mfbt/Variant.h:309

Comment 1

[Jarda Snajdr [:jsnajdr]]

A very frequent crash that has been occuring for me in Nightly. Mostly when visiting wordpress.com sites as a logged-in user -- they are using nested iframes with 3rd party cookies. Stops happening when I disable the optInPartitioning pref.

Comment 2

[Kershaw Chang [:kershaw]]

Tim, could you take a look?
This looks like a recent regression and also a sec-high bug.

Comment 3

[edgul]

Maybe dupe of Bug 1896241

Comment 4

[Valentin Gosu [:valentin] (he/him)]

I have a WIP patch here that "might" fix the crash.
Could you try this build to see if it fixes the crash for you? https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/WrUVuJwETsi01bVs6otRGQ/runs/0/artifacts/public/build/target.dmg

Comment 6

[Jarda Snajdr [:jsnajdr]]

As I commented in https://bugzilla.mozilla.org/show_bug.cgi?id=1884648#c5, at some point last week, about May 21-24, the latest Nightly stopped crashing for me. I can no longer reproduce the crash neither on Nightly nor on the custom build you shared.

Something else must have changed on the AboutToLoadHttpDocumentForChild code path that also fixed the crash.