Open Bug 2061168 Opened 1 day ago Updated 1 day ago

BTP: Reset does not clear mLastStartedLoadId, so a clear between the two OnStartNavigation calls of one navigation drops that chain

Categories

(Core :: Privacy: Anti-Tracking, defect, P2)

Product:
Core
Component:
Privacy: Anti-Tracking
Type:
defect

Tracking

()

People

(Reporter: emz, Unassigned)

References

(Blocks 1 open bug)

Details

Found while auditing the BTP navigation state machine for bug 2060310. Pre-existing. Not reproduced; mechanism read from the code.

The problem. OnStartNavigation dedupes on mLastStartedLoadId, added by bug 2056952 because a single logical navigation can reach it more than once, across process switches and speculative loads. BounceTrackingState::Reset resets the record and cancels the timers but does not clear mLastStartedLoadId, and nothing else clears it either.

So if a clear lands between the first and second OnStartNavigation call for the same load id, the second call is treated as a duplicate and skipped. No record is created for that navigation, so OnResponseReceived then fails its record null check and neither fills the bounce set nor arms the finalization timer. That navigation contributes nothing to bounce detection.

The clear can come from clearAll, a container clear or a time-range clear.

For contrast, in the single-call case a clear landing between OnStartNavigation and the response also drops that navigation, independently of mLastStartedLoadId; that much is by design in Reset. The gap here is only that a stale load id stops the record from being recreated when a second call would otherwise have created it.

The loss is confined to the navigation whose load id was already consumed, and the next navigation recovers since it carries a different load id.

Suggested fix. Clear mLastStartedLoadId in the static BounceTrackingState::Reset, next to the existing ResetBounceTrackingRecord() call. Not in ResetBounceTrackingRecord itself: that helper also runs mid-navigation from RecordStatefulBounces, where clearing the id would re-open the double counting bug 2056952 closed.

Code:

You need to log in before you can comment on or make changes to this bug.