class OwningGPUOutOfMemoryErrorOrGPUValidationError : public AllOwningUnionBase
[...]
  union Value
  {
    UnionMember<OwningNonNull<mozilla::webgpu::OutOfMemoryError> > mGPUOutOfMemoryError;
    UnionMember<OwningNonNull<mozilla::webgpu::ValidationError> > mGPUValidationError;

  };

  TypeOrUninit mType;
  Value mValue;

OwningNonNull<mozilla::webgpu::OutOfMemoryError>&
OwningGPUOutOfMemoryErrorOrGPUValidationError::SetAsGPUOutOfMemoryError()
{
  if (mType == eGPUOutOfMemoryError) {
    return mValue.mGPUOutOfMemoryError.Value();
  }
  Uninit();
  mType = eGPUOutOfMemoryError;
  return mValue.mGPUOutOfMemoryError.SetValue();
}

class UnionMember {
  AlignedStorage2<T> mStorage;
[...]
  template <typename... Args>
  T& SetValue(Args&&... args) {
    new (mStorage.addr()) T(std::forward<Args>(args)...);
    return *mStorage.addr();
  }

template <class T>
class MOZ_IS_SMARTPTR_TO_REFCOUNTED OwningNonNull {
 public:
  using element_type = T;

  OwningNonNull() = default;

The problem is that SetValue() in-place constructs the union variant, and in this case the union variant isn't OutOfMemory (which has a deleted ctor), it's OwningNonNull<OutOfMemory>, which does have a super dangerous default constructor!

The bug in question that the fix for bug 1837557 started hitting on CI is:

        dom::OwningGPUOutOfMemoryErrorOrGPUValidationError error;
[...]
          case PopErrorScopeResultType::OutOfMemory:
            error.SetAsGPUOutOfMemoryError();
            break;

Marking as blocking webgpu-v1-cts-windows, since the scope of comment 2 on bug 1838694 has moved to this bug at :jgilbert's initiative.

https://hg.mozilla.org/mozilla-central/rev/5cd8f2638cc5