1994681 - Reduce Page Protection: Module allowing for temporary disabling tracking-protection for current tab

Status: RESOLVED FIXED

(Core :: Privacy: Anti-Tracking, task, P2)

Description

[Manuel Bucher [:manuel]]

One pref for the start. Likely bound to the lifetime of the tab, so no persistent data necessary.

Comment 1

[Manuel Bucher [:manuel]]

Attachment: WIP: Bug 1994681 - Reduce Page Protection: Module allowing for temporary disabling tracking-protection for current tab

Comment 2

[Manuel Bucher [:manuel]]

Attachment: Bug 1994681 - Reduce Page Protection: Module allowing for temporary disabling tracking-protection for current tab r=timhuang

Comment 3

[Manuel Bucher [:manuel]]

Attachment: Bug 1994681 - Test ScopedPrefs service r=timhuang

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/0d948a131830
https://hg.mozilla.org/integration/autoland/rev/a88c802fcdf4
Reduce Page Protection: Module allowing for temporary disabling tracking-protection for current tab r=timhuang
https://github.com/mozilla-firefox/firefox/commit/c8e41a31f760
https://hg.mozilla.org/integration/autoland/rev/a632f2b9b34b
Test ScopedPrefs service r=timhuang

Comment 5

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/a88c802fcdf4
https://hg.mozilla.org/mozilla-central/rev/a632f2b9b34b

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/002bb6fcfdcd
https://hg.mozilla.org/mozilla-central/rev/f6498b740080
Revert "Bug 1994681 - Test ScopedPrefs service r=timhuang"
https://github.com/mozilla-firefox/firefox/commit/83d1a08db47b
https://hg.mozilla.org/mozilla-central/rev/887fb4b92f0c
Revert "Bug 1994681 - Reduce Page Protection: Module allowing for temporary disabling tracking-protection for current tab r=timhuang"

Comment 7

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Backed out for causing crashes [@ mozilla::dom::BrowsingContextWebProgress::BrowsingContextWebProgress ], e.g. bp-46278314-5f6b-4112-92c1-7ae290260303

Comment 8

[BugBot [:suhaib / :marco/ :calixte]]

The bug is linked to a topcrash signature, which matches the following criteria:

• Top 10 desktop browser crashes on nightly
• Top 10 AArch64 and ARM crashes on nightly

For more information, please visit BugBot documentation.

Comment 9

[Yannis Juglaret [:yannis] (Away until May 11)]

Attachment: Reproducer-for-bug-1994681.patch

Attaching a reproducer for the Nightly crash. I generated it using Claude Code, socorro-cli and symdis. I'll share the Claude Code session internally for people who are curious. Below is the explanation for the crash, also generated by Claude Code.

Crash signature

[@ mozilla::dom::BrowsingContextWebProgress::BrowsingContextWebProgress]

172 crashes on Nightly 150.0a1 in under a day (March 3, 2026). Cross-platform
(Windows 82%, Linux 9%, Mac 9%). All parent process, main thread.

Root cause

The BrowsingContextWebProgress constructor unconditionally dereferences
Top()->GetWebProgress() for non-top BrowsingContexts:

// BrowsingContextWebProgress.cpp:50
mScopedPrefs = aBrowsingContext->Top()->GetWebProgress()->mScopedPrefs;
//             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
//             GetWebProgress() returns null here

GetWebProgress() returns the raw mWebProgress pointer from
CanonicalBrowsingContext. This is null when the top BC's mWebProgress has
been moved away by ReplacedBy() during a cross-site navigation.

How the crash happens

A cross-site navigation (e.g. example.com to example.org) with Fission
triggers a process switch. The parent process calls
CanonicalBrowsingContext::ReplacedBy(), which std::moves mWebProgress
from the old top BC to the new one (CanonicalBrowsingContext.cpp:255).

If the old content process has pending setTimeout callbacks (or other async
work) that create <iframe> elements, it sends CreateBrowsingContext IPC
messages to the parent. These messages arrive after ReplacedBy() has
already run. The parent handles them: Attach() creates a new
BrowsingContextWebProgress for the subframe. The constructor calls
Top(), which walks up the parent chain to the old top BC — the one
whose mWebProgress was moved to the new BC. GetWebProgress() returns null.
Null dereference at offset 0x98 (the offset of mScopedPrefs within
BrowsingContextWebProgress).

Content process (example.com)          Parent process
--------------------------------       --------------------------------
setTimeout callbacks fire,             Cross-site navigation starts
creating <iframe> elements             (example.com -> example.org)
     |                                      |
     v                                      v
Each iframe creation sends             ReplacedBy() runs:
CreateBrowsingContext IPC              old top BC's mWebProgress is
to the parent                          std::move'd to new top BC
     |                                      |
     +--- IPC messages arrive AFTER --------+
          ReplacedBy() has run
                  |
                  v
          Parent handles CreateBrowsingContext:
            Attach() -> new BrowsingContextWebProgress(subframeBC)
            Constructor: subframeBC->Top() returns OLD top BC
            OLD top BC has mWebProgress == nullptr (moved away)
            Top()->GetWebProgress()->mScopedPrefs  <-- NULL DEREF

Reproducer

docshell/test/browser/browser_browsingContext_webprogress_subframe_crash.js
loads a page, schedules 15 setTimeout callbacks that each create an
<iframe>, then immediately navigates cross-site. The staggered timers
(0ms, 10ms, ..., 140ms) ensure some fire after ReplacedBy() has moved
mWebProgress, triggering the null dereference in the parent process.

To observe the crash in WinDbg (install from the Microsoft Store):

./mach mochitest --debugger=windbgx --debugger-args="-g -G -o" --headless docshell/test/browser/browser_browsingContext_webprogress_subframe_crash.js

Crash stack:

xul!nsCOMPtr<nsIScopedPrefs>::operator=                         [nsCOMPtr.h @ 563]
xul!mozilla::dom::BrowsingContextWebProgress::BrowsingContextWebProgress
                                                  [BrowsingContextWebProgress.cpp @ 50]
xul!mozilla::dom::BrowsingContext::Attach              [BrowsingContext.cpp @ 1036]
xul!mozilla::dom::BrowsingContext::CreateFromIPC         [BrowsingContext.cpp @ 640]
xul!mozilla::dom::ContentParent::RecvCreateBrowsingContext  [ContentParent.cpp @ 6930]

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/475066ef88e3
https://hg.mozilla.org/integration/autoland/rev/ac903b307883
Reduce Page Protection: Module allowing for temporary disabling tracking-protection for current tab r=timhuang
https://github.com/mozilla-firefox/firefox/commit/60c0bfefb01d
https://hg.mozilla.org/integration/autoland/rev/7c80a3400303
Test ScopedPrefs service r=timhuang

Comment 11

[Manuel Bucher [:manuel]]

Thanks for helping me investigate. Was really useful :)

Comment 12

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/ac903b307883
https://hg.mozilla.org/mozilla-central/rev/7c80a3400303