1982261 - Crash in [@ IPCError-browser | SetCookies Invalid cookie received.]

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[BugBot [:suhaib / :marco]]

Crash report: https://crash-stats.mozilla.org/report/index/ee441322-b777-4419-8e5d-bffec0250723

Reason: DUMP_REQUESTED

Top 10 frames of crashing thread:

0  libxul.so  mozilla::dom::binding_detail::GenericGetter<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>  dom/bindings/BindingUtils.cpp
0  libxul.so  CallJSNative  js/src/vm/Interpreter.cpp:501
0  libxul.so  js::InternalCallOrConstruct  js/src/vm/Interpreter.cpp:597
0  libxul.so  InternalCall  js/src/vm/Interpreter.cpp:664
0  libxul.so  js::Call  js/src/vm/Interpreter.cpp:696
0  libxul.so  js::CallGetter  js/src/vm/Interpreter.cpp:818
0  libxul.so  CallGetter  js/src/vm/NativeObject.cpp:2125
0  libxul.so  GetExistingProperty<  js/src/vm/NativeObject.cpp:2153
0  libxul.so  NativeGetPropertyInline<  js/src/vm/NativeObject.cpp:2296
0  libxul.so  js::NativeGetProperty  js/src/vm/NativeObject.cpp:2326

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2025-07-23
• Process type: Content
• Is startup crash: No
• Has user comments: No
• Is null crash: No

By analyzing the backtrace, the regression may have been introduced by a patch [1] to fix Bug 1976971.

[1] https://hg.mozilla.org/mozilla-central/rev?node=9638f25e3a87

:jrmuizel, since you are the author of the potential regressor, could you please take a look?

Comment 1

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1976971

Comment 2

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1976971

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

baku, does this ring any bells?
We get somehow to https://searchfox.org/firefox-main/rev/3c23ce1368431d49bae08e8e211f7f2bf4e4829d/netwerk/cookie/CookieServiceParent.cpp#344

Comment 4

[Andrea Marchesini [:baku]]

Somehow, there is an IPC call to set an invalid cookie. Unfortunately in the crash there is no details about what called that method. I'm going to change the approach and log a warning message and return IPC_OK.

Comment 5

[Andrea Marchesini [:baku]]

Attachment: Bug 1982261 - CookieServiceParent logs about invalid cookies instead of crashing, r?valentin

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/de8e54ecf601
https://hg.mozilla.org/integration/autoland/rev/05d9c3f01472
CookieServiceParent logs about invalid cookies instead of crashing, r=valentin,cookie-reviewers

Comment 7

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/05d9c3f01472

Comment 8

[Donal Meehan [:dmeehan]]

:baku, does this need uplift requests? The only crash reports are in nightly, are beta and release affected?

Comment 9

[Andrea Marchesini [:baku]]

beta yes. No release. The number of crashes is low.

Comment 10

[Phabricator Automation]

firefox-beta Uplift Approval Request

• User impact if declined: A rare crash can occur when storing invalid cookies.
• Code covered by automated testing: yes
• Fix verified in Nightly: yes
• Needs manual QE test: no
• Steps to reproduce for manual QE testing: n/a
• Risk associated with taking this patch: low
• Explanation of risk level: The crash is triggered by a MOZ_ASSERT, replaced with a MOZ_DIAGNOSTIC_ASSERT.
• String changes made/needed: none.
• Is Android affected?: yes

Comment 11

[Andrea Marchesini [:baku]]

Attachment: Bug 1982261 - CookieServiceParent logs about invalid cookies instead of crashing, r?valentin

Original Revision: https://phabricator.services.mozilla.com/D264812

Comment 12

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/0310ec096e4b
https://hg.mozilla.org/releases/mozilla-beta/rev/b2c86eba88a3