1971020 - Crash in [@ mozilla::detail::InvalidArrayIndex_CRASH | mozilla::net::CookieStorage::RemoveCookiesFromBackUntilUnderLimit ]

Status: RESOLVED FIXED

(Core :: Networking: Cookies, defect, P2)

Description

[BugBot [:suhaib / :marco]]

Crash report: https://crash-stats.mozilla.org/report/index/f08d3468-3583-4ebf-8956-fc5a30250607

MOZ_CRASH Reason: ElementAt(aIndex = 71, aLength = 71)

Top 10 frames of crashing thread:

0  mozglue.dll  MOZ_Crash  mfbt/Assertions.h:381
0  mozglue.dll  mozilla::detail::InvalidArrayIndex_CRASH  mfbt/Assertions.cpp:50
1  xul.dll  nsTArray_Impl<mozilla::net::CookieListIter, nsTArrayInfallibleAllocator>::ElementAt const  xpcom/ds/nsTArray.h:1225
1  xul.dll  mozilla::ArrayIterator<mozilla::net::CookieListIter&, nsTArray_Impl<mozilla::net::CookieListIter, nsTArrayInfallibleAllocator> >::operator* const  xpcom/ds/ArrayIterator.h:107
1  xul.dll  std::reverse_iterator<mozilla::ArrayIterator<mozilla::net::CookieListIter&, nsTArray_Impl<mozilla::net::CookieListIter, nsTArrayInfallibleAllocator> > >::operator* const  /builds/worker/fetches/vs/VC/Tools/MSVC/14.39.33519/include/xutility:1554
1  xul.dll  mozilla::net::CookieStorage::RemoveCookiesFromBackUntilUnderLimit  netwerk/cookie/CookieStorage.cpp
2  xul.dll  mozilla::net::CookieStorage::RemoveOlderCookiesUntilUnderLimit  netwerk/cookie/CookieStorage.cpp:568
3  xul.dll  mozilla::net::CookieStorage::AddCookie  netwerk/cookie/CookieStorage.cpp:756
4  xul.dll  mozilla::net::CookieService::SetCookieStringFromHttp  netwerk/cookie/CookieService.cpp:636
5  xul.dll  mozilla::net::HttpBaseChannel::SetCookieHeaders  netwerk/protocol/http/HttpBaseChannel.cpp:3626

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2025-05-18
• Process type: Parent
• Is startup crash: No
• Has user comments: No
• Is null crash: No

Comment 1

[BugBot [:suhaib / :marco]]

The Bugbug bot thinks this bug should belong to the 'Core::Networking: Cookies' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 3

[Andrew McCreight [:mccr8]]

Almost all of these have aIndex == aLength like the one in comment 0.

Comment 4

[Andrew McCreight [:mccr8]]

This signature looks like the same issue, is also fairly common, and is less generic, so I'll update the summary to use it.

bp-5a6d6e12-f051-4627-8cc3-9267a0250606

Comment 5

[Andrew McCreight [:mccr8]]

This looks like it could be a regression in 139.

Comment 6

[Valentin Gosu [:valentin]]

I haven't yet figured out what the problem is, bit it might be a regression from bug 1845870.
The bug description seems to point to RemoveCookiesFromBackUntilUnderLimit, so they're possibly connected.

Comment 7

[Randell Jesup [:jesup] (needinfo me)]

Crashes are heavily mac, with a few linux thrown in. Quite a few crashes.

Comment 8

[Donal Meehan [:dmeehan]]

We are in the final week of beta for Fx140, so there is little time to fix this if we can include a fix in the Fx140

Comment 9

[Kershaw Chang [:kershaw]]

Ed, could you take a look?
Could we try to fix this in this cycle? Thanks.

Comment 10

[edgul]

Looking now.

Comment 11

[edgul]

For a quick fix I think we can enable network_cookie_chips_partitionLimitDryRun.

Comment 12

[edgul]

Attachment: Bug 1971020 - Disable CHIPS partition limit purging. r?valentin

Comment 13

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/2e449ef2a4a0
https://hg.mozilla.org/integration/autoland/rev/b7374072b047
Disable CHIPS partition limit purging. r=bvandersloot

Comment 14

[edgul]

Comment on attachment 9493903 [details]
Bug 1971020 - Disable CHIPS partition limit purging. r?valentin

Beta/Release Uplift Approval Request

• User impact if declined/Reason for urgency: Crash will continue into v140 release
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): This only disables recently added CHIPS purging. Meaning no cookies will be removed when exceeding CHIPS limit. Other standard cookie limits still apply to keep cookie counts under control.
• String changes made/needed:
• Is Android affected?: Yes

Comment 15

[edgul]

Donal, fx-trains shows 140 beta as going into build (8) today at 13:00 UTC. Did we miss chance to get this into beta 140?

Comment 16

[Donal Meehan [:dmeehan]]

140.0b8 is being built right now, but this hasn't landed in central yet.
140.0b9 builds on Friday. 140.0b9 the last beta build, but I should be able to take this before then so it will make 140.

Comment 17

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/b7374072b047

Comment 18

[Donal Meehan [:dmeehan]]

Comment on attachment 9493903 [details]
Bug 1971020 - Disable CHIPS partition limit purging. r?valentin

Approved for 140.0b9

Comment 19

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/9309d04cb294
https://hg.mozilla.org/releases/mozilla-beta/rev/e93f76cc0ba0