Re: [tor-bugs] #27815 [Applications/Tor Browser]: Killing firefox.real child at ~100% load caused parent to segfault

2018-10-03 Thread Tor Bug Tracker & Wiki 
#27815: Killing firefox.real child at ~100% load caused parent to segfault
--+--
 Reporter:  traumschule   |  Owner:  tbb-team
 Type:  defect| Status:  new
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:|  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+--

Comment (by traumschule):

 Another issue for segfault on exit: #12481

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #27815 [Applications/Tor Browser]: Killing firefox.real child at ~100% load caused parent to segfault

2018-09-22 Thread Tor Bug Tracker & Wiki 
#27815: Killing firefox.real child at ~100% load caused parent to segfault
--+--
 Reporter:  traumschule   |  Owner:  tbb-team
 Type:  defect| Status:  new
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:|  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+--

Comment (by traumschule):

 In comparison this was a requested exit of Tor Browser 8.5a1:

 {{{
 Sep 22 03:12:06.000 [info] {CONTROL} connection_control_reached_eof():
 Control connection reached EOF. Closing.
 Sep 22 03:12:06.000 [notice] {CONTROL} Owning controller connection has
 closed -- exiting now.
 Sep 22 03:12:06.000 [notice] {GENERAL} Catching signal TERM, exiting
 cleanly.
 Sep 22 03:12:06.000 [notice] {CONTROL} Owning controller connection has
 closed -- exiting now.
 Sep 22 03:12:06.000 [notice] {GENERAL} Catching signal TERM, exiting
 cleanly.
 Sep 22 03:12:06.000 [info] {GENERAL} or_state_save(): Saved state to
 "/path/to/tor-browser_en-US/Browser/TorBrowser/Data/Tor/state"
 JavaScript error: jar:file:///path/to/tor-browser_en-
 US/Browser/omni.ja!/components/nsAsyncShutdown.js, line 114: Error: We
 have already registered a distinct blocker with the same name: Crash
  Reporter: blocking on minidumpgeneration.
 JavaScript error: chrome://torbutton/content/tor-circuit-display.js, line
 466: TypeError: myController is null
 Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 352) has
 been freed.
 Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 366) has
 been freed.
 Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 365) has
 been freed.
 Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 364) has
 been freed.
 Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 363) has
 been freed.
 Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 362) has
 been freed.
 Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 361) has
 been freed.
 Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 360) has
 been freed.
 Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 359) has
 been freed.
 Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 368) has
 been freed.
 Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 357) has
 been freed.
 Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 356) has
 been freed.
 Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 367) has
 been freed.
 Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 354) has
 been freed.
 Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 353) has
 been freed.
 Sep 22 03:12:17.000 [info] {REND} hs_purge_last_hid_serv_requests():
 Purging client last-HS-desc-request-time table
 Sep 22 03:12:17.000 [info] {FS} tor_lockfile_unlock(): Unlocking "/path/to
 /tor-browser_en-US/Browser/TorBrowser/Data/Tor/lock"
 JavaScript error: resource:///modules/sessionstore/SessionSaver.jsm, line
 180: NS_ERROR_FAILURE: Component returned failure code: 0x80004005
 (NS_ERROR_FAILURE) [nsIAppShellService.hiddenDOMWindow]
 WARNING: At least one completion condition is taking too long to complete.
 Conditions: [{"name":"Crash Reporter: blocking on
 minidumpgeneration.","state":"(none)","filename":"/var/tmp/build/firefox-1
 24fa904c4b2/ipc/glue/CrashReporterHost.cpp","lineNumber":189,"stack":"Minidump
 generation"}] Barrier: profile-before-change
 tbb@t43:~$ kill FATAL ERROR: AsyncShutdown timeout in profile-before-
 change Conditions: [{"name":"Crash Reporter: blocking on
 minidumpgeneration.","state":"(none)","filename":"/var/tmp/build/firefox-
 124fa904c4b2/ipc/glue/CrashReporterHost.cpp","lineNumber":189,"stack":"Minidump
 generation"}] At least one completion condition failed to complete within
 a reasonable amount of time. Causing a crash
 to ensure that we do not leave the user with an unresponsive process
 draining resources.
 WARNING: No crash reporter available
 [Parent 13849, Main Thread] ###!!! ABORT: file /var/tmp/build/firefox-
 124fa904c4b2/ipc/glue/CrashReporterHost.cpp, line 189
 [Parent 13849, Main Thread] ###!!! ABORT: file /var/tmp/build/firefox-
 124fa904c4b2/ipc/glue/CrashReporterHost.cpp, line 189
 ./Browser/start-tor-browser: line 375: 13849 Segmentation fault
 TOR_CONTROL_PASSWD=${TOR_CONTROL_PASSWD} ./firefox --class "Tor Browser"
 -profile TorBrowser/Data/Browser/profile.default "${@}" < /dev/null
 }}}

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project:

[tor-bugs] #27815 [Applications/Tor Browser]: Killing firefox.real child at ~100% load caused parent to segfault

2018-09-21 Thread Tor Bug Tracker & Wiki 
#27815: Killing firefox.real child at ~100% load caused parent to segfault
--+--
 Reporter:  traumschule   |  Owner:  tbb-team
 Type:  defect| Status:  new
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal|   Keywords:
Actual Points:|  Parent ID:
   Points:|   Reviewer:
  Sponsor:|
--+--
 (TB 8.5a1 on debian buster 32-bit)

 Another hard to reproduce issue. According to #firefox it is safe to kill
 any of the four content processes of the parent (Tor) Browser (easy to see
 with {{{ps axjf}}}).
 > There is the single parent process and then the content processes, by
 default 4, tabs distributed among them, then there are other misc helper
 processes.

 In my case the rogue child was in a state that took Tor Browser as a whole
 with it. crash_on_exit shows:

 {{{
 JavaScript error: resource://gre/modules/ExtensionContent.jsm, line 489:
 TypeError: Argument 1 of PrecompiledScript.executeInGlobal is not an
 object.
 JavaScript error: resource://gre/modules/ExtensionContent.jsm, line 489:
 TypeError: Argument 1 of PrecompiledScript.executeInGlobal is not an
 object.
 JavaScript error: resource://gre/modules/ExtensionContent.jsm, line 489:
 TypeError: Argument 1 of PrecompiledScript.executeInGlobal is not an
 object.
 JavaScript error: resource://gre/modules/ExtensionContent.jsm, line 489:
 TypeError: Argument 1 of PrecompiledScript.executeInGlobal is not an
 object.
 JavaScript error: resource://gre/modules/ExtensionContent.jsm, line 489:
 TypeError: Argument 1 of PrecompiledScript.executeInGlobal is not an
 object.
 console.error: (new SyntaxError("JSON.parse: unexpected character at line
 1 column 2 of the JSON data", "chrome://devtools/content/framework
 /toolbox-process-window.js", 231))
 Sep 17 06:11:42.000 [notice] Owning controller connection has closed --
 exiting now.
 Sep 17 06:11:42.000 [notice] Catching signal TERM, exiting cleanly.
 JavaScript error: jar:file:///path/to/tor-browser_en-
 US/Browser/omni.ja!/components/nsAsyncShutdown.js, line 114: Error: We
 have already registered a distinct blocker with the same name: Crash
 Reporter: blocking on minidumpgeneration.
 [Parent 27413, Gecko_IOThread] WARNING: pipe error: Broken pipe: file
 /var/tmp/build/firefox-
 124fa904c4b2/ipc/chromium/src/chrome/common/ipc_channel_posix.cc, line 709
 JavaScript error: chrome://torbutton/content/tor-circuit-display.js, line
 466: TypeError: myController is null
 JavaScript error: resource:///modules/sessionstore/SessionSaver.jsm, line
 180: NS_ERROR_FAILURE: Component returned failure code: 0x80004005
 (NS_ERROR_FAILURE) [nsIAppShellService.hiddenDOMWindow]
 WARNING: At least one completion condition is taking too long to complete.
 Conditions: [{"name":"Crash Reporter: blocking on
 minidumpgeneration.","state":"(none)","filename":"/var/tmp/build/firefox-
 124fa904c4b2/ipc/glue/CrashReporterHost.cpp","lineNumber":189,"stack":"Minidump
 generation"}] Barrier: profile-before-change
 FATAL ERROR: AsyncShutdown timeout in profile-before-change Conditions:
 [{"name":"Crash Reporter: blocking on
 minidumpgeneration.","state":"(none)","filename":"/var/tmp/build/firefox-
 124fa904c4b2/ipc/glue/CrashReporterHost.cpp","lineNumber":189,"stack":"Minidump
 generation"}] At least one completion condition failed to complete within
 a reasonable amount of time. Causing a crash to ensure that we do not
 leave the user with an unresponsive process draining resources.
 WARNING: No crash reporter available
 [Parent 27413, Main Thread] ###!!! ABORT: file /var/tmp/build/firefox-
 124fa904c4b2/ipc/glue/CrashReporterHost.cpp, line 189
 [Parent 27413, Main Thread] ###!!! ABORT: file /var/tmp/build/firefox-
 124fa904c4b2/ipc/glue/CrashReporterHost.cpp, line 189
 ./start-tor-browser: line 375: 27413 Segmentation fault
 TOR_CONTROL_PASSWD=${TOR_CONTROL_PASSWD} ./firefox --class "Tor Browser"
 -profile TorBrowser/Data/Browser/profile.default "${@}" < /dev/null
 }}}

 I don't think that #27537 is the cause, not sure about the SyntaxError. I
 guess the crashreporter is blocked intentionally? {{{myController is
 null}}} reminds me that i disabled all plugins to see if the load would
 decrease, but it didn't so i killed the child after being told "If you
 kill a content process the browser should be fine, all the tabs will be in
 their unloaded state when you return to them".

 Kept a corefile of the child for gdb enthusiasts, unfortunately not of the
 parent.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing