Re: [tor-bugs] #20390 [Applications/Tor Browser]: Tor Crashes

2016-11-07 Thread Tor Bug Tracker & Wiki 
#20390: Tor Crashes
--+---
 Reporter:  mwolfe|  Owner:  tbb-team
 Type:  defect| Status:  needs_information
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-crash |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+---

Comment (by cypherpunks):

 Different user here, on OS X 10.11.6 with 8GB RAM.

 I encountered a similar crash after the following:
 * Browsed a page on https://twitter.com/ with security level set to High
 (this was the only tab).
 * Clicked "Temporarily allow all this page" in NoScript.
 A few seconds later, the browser crashed:

 {{{
 Process:   firefox [1525]
 Path:  /Applications/TorBrowser.app/Contents/MacOS/firefox
 Identifier:org.mozilla.tor browser
 Version:   6.0.5 (4500.1.1)
 Code Type: X86-64 (Native)
 Parent Process:??? [1]
 Responsible:   firefox [1525]
 User ID:   502

 Date/Time: 2016-11-07 14:01:21.589 -0500
 OS Version:Mac OS X 10.11.6 (15G1108)
 Report Version:11
 Anonymous UUID:

 Sleep/Wake UUID:

 Time Awake Since Boot: 12000 seconds
 Time Since Wake:   1900 seconds

 System Integrity Protection: enabled

 Crashed Thread:4  Socket Thread

 Exception Type:EXC_BAD_ACCESS (SIGSEGV)
 Exception Codes:   EXC_I386_GPFLT
 Exception Note:EXC_CORPSE_NOTIFY

 Thread 0:: Dispatch queue: com.apple.main-thread
 0   XUL 0x0001045000e3 0x101afd000 +
 44052707

 Thread 1:: Dispatch queue: com.apple.libdispatch-manager
 0   libsystem_kernel.dylib  0x7fff99060efa kevent_qos + 10
 1   libdispatch.dylib   0x7fff88208165
 _dispatch_mgr_invoke + 216
 2   libdispatch.dylib   0x7fff88207dcd
 _dispatch_mgr_thread + 52

 Thread 2:: Gecko_IOThread
 0   libsystem_kernel.dylib  0x7fff99060eca kevent + 10
 1   XUL 0x000101ddf5bc 0x101afd000 +
 3024316

 Thread 3:: Closing Service
 0   libsystem_kernel.dylib  0x7fff9905fdb6 __psynch_cvwait
 + 10
 1   libsystem_pthread.dylib 0x7fff87ca4728
 _pthread_cond_wait + 767
 2   libnss3.dylib   0x000101a1debd PR_WaitCondVar
 + 253

 Thread 4 Crashed:: Socket Thread
 0   libnss3.dylib   0x0001018224ad
 PK11_ExitContextMonitor + 14
 1   libnss3.dylib   0x000101823398
 PK11_DigestFinal + 264
 2   XUL 0x000103a330e5 0x101afd000 +
 32727269

 Thread 5:: JS Helper
 0   libsystem_kernel.dylib  0x7fff9905fdb6 __psynch_cvwait
 + 10
 1   libsystem_pthread.dylib 0x7fff87ca4728
 _pthread_cond_wait + 767
 2   libnss3.dylib   0x000101a1debd PR_WaitCondVar
 + 253

 Thread 6:: JS Helper
 0   libsystem_kernel.dylib  0x7fff9905fdb6 __psynch_cvwait
 + 10
 1   libsystem_pthread.dylib 0x7fff87ca4728
 _pthread_cond_wait + 767
 2   libnss3.dylib   0x000101a1debd PR_WaitCondVar
 + 253

 Thread 7:: JS Helper
 0   libsystem_kernel.dylib  0x7fff9905fdb6 __psynch_cvwait
 + 10
 1   libsystem_pthread.dylib 0x7fff87ca4728
 _pthread_cond_wait + 767
 2   libnss3.dylib   0x000101a1debd PR_WaitCondVar
 + 253

 Thread 8:: JS Helper
 0   libsystem_kernel.dylib  0x7fff9905fdb6 __psynch_cvwait
 + 10
 1   libsystem_pthread.dylib 0x7fff87ca4728
 _pthread_cond_wait + 767
 2   libnss3.dylib   0x000101a1debd PR_WaitCondVar
 + 253

 Thread 9:: JS Helper
 0   libsystem_kernel.dylib  0x7fff9905fdb6 __psynch_cvwait
 + 10
 1   libsystem_pthread.dylib 0x7fff87ca4728
 _pthread_cond_wait + 767
 2   libnss3.dylib   0x000101a1debd PR_WaitCondVar
 + 253

 Thread 10:: JS Helper
 0   libsystem_kernel.dylib  0x7fff9905fdb6 __psynch_cvwait
 + 10
 1   libsystem_pthread.dylib 0x7fff87ca4728
 _pthread_cond_wait + 767
 2   libnss3.dylib   0x000101a1debd PR_WaitCondVar
 + 253

 Thread 11:: JS Helper
 0   libsystem_kernel.dylib  0x7fff9905fdb6 __psynch_cvwait
 + 10
 1   libsystem_pthread.dylib 0x7fff87ca4728
 _pthread_cond_wait + 767
 2   libnss3.dylib   0x000101a1debd PR_WaitCondVar
 + 253

 Thread 12:: JS Helper
 0   libsystem_kernel.dylib  0x7fff9905fdb6

Re: [tor-bugs] #20390 [Applications/Tor Browser]: Tor Crashes

2016-11-03 Thread Tor Bug Tracker & Wiki 
#20390: Tor Crashes
--+---
 Reporter:  mwolfe|  Owner:  tbb-team
 Type:  defect| Status:  needs_information
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-crash |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+---

Comment (by cypherpunks):

 Actually `context` was freed by C_SetOperationState, it seems. If *slot
 overwritten by free() then crash triggered.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #20390 [Applications/Tor Browser]: Tor Crashes

2016-11-03 Thread Tor Bug Tracker & Wiki 
#20390: Tor Crashes
--+---
 Reporter:  mwolfe|  Owner:  tbb-team
 Type:  defect| Status:  needs_information
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-crash |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+---

Comment (by cypherpunks):

 This use-after-free can be [https://dxr.mozilla.org/mozilla-
 esr45/source/security/nss/lib/pk11wrap/pk11cxt.c#133 RCE]

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #20390 [Applications/Tor Browser]: Tor Crashes

2016-11-03 Thread Tor Bug Tracker & Wiki 
#20390: Tor Crashes
--+---
 Reporter:  mwolfe|  Owner:  tbb-team
 Type:  defect| Status:  needs_information
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-crash |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+---

Comment (by cypherpunks):

 [https://dxr.mozilla.org/mozilla-
 esr45/source/security/nss/lib/pk11wrap/pk11cxt.c#48 This] is about wrong
 slot:
 {{{
 if ((cx->ownSession) && (cx->slot->isThreadSafe)) {
 }}}
 Probably points to freed memory, else NULL would trigger for all another
 platforms too. If correct then should be reproducible for hardened Tor
 Browser too.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #20390 [Applications/Tor Browser]: Tor Crashes

2016-11-02 Thread Tor Bug Tracker & Wiki 
#20390: Tor Crashes
--+---
 Reporter:  mwolfe|  Owner:  tbb-team
 Type:  defect| Status:  needs_information
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-crash |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+---

Comment (by cypherpunks):

 This ticket differs, if it's OOM then it was triggered somehow indirectly.
 {{{
 0   libnss3.dylib   0x0001004224ad
 PK11_ExitContextMonitor + 14\
 1   libnss3.dylib   0x000100423398
 PK11_DigestFinal + 264\
 }}}
 Similar backtrace reported for #20181

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #20390 [Applications/Tor Browser]: Tor Crashes

2016-11-02 Thread Tor Bug Tracker & Wiki 
#20390: Tor Crashes
--+---
 Reporter:  mwolfe|  Owner:  tbb-team
 Type:  defect| Status:  needs_information
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-crash |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+---

Comment (by mwolfe):

 I thought it was insufficient memory, so I added 4GB, going from 4GB to
 8GB, but Tor still crashes (it uses about 5GB, which might have explained
 the problem with having only 4GB).

 I had four tabs open: independent.co.uk home page, an article about the
 election, fivethirtyeight.com and realclearpolitics.com when Tor crashed.

 I have attached the crash file from OS X 10.6.8

 I am now running Tor Browser 6.0.5 (based on Mozilla Firefox 45.4.0)

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #20390 [Applications/Tor Browser]: Tor Crashes

2016-10-19 Thread Tor Bug Tracker & Wiki 
#20390: Tor Crashes
--+---
 Reporter:  mwolfe|  Owner:  tbb-team
 Type:  defect| Status:  needs_information
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-crash |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+---

Comment (by gk):

 Replying to [comment:5 mwolfe]:
 > Checking in Activity Monitor, I only have 6 MB memory available. Maybe
 that's causing the crashes?

 Yes, that is what I think looking at your stack trace + looking at the
 older bugs you filed. Can you try to increase the amount of usable memory
 for Tor Browser and report back? A test of a vanilla Firefox 45 ESR might
 shed some light on your problem as well.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #20390 [Applications/Tor Browser]: Tor Crashes

2016-10-19 Thread Tor Bug Tracker & Wiki 
#20390: Tor Crashes
--+---
 Reporter:  mwolfe|  Owner:  tbb-team
 Type:  defect| Status:  needs_information
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-crash |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+---

Comment (by mwolfe):

 Checking in Activity Monitor, I only have 6 MB memory available. Maybe
 that's causing the crashes?

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #20390 [Applications/Tor Browser]: Tor Crashes

2016-10-19 Thread Tor Bug Tracker & Wiki 
#20390: Tor Crashes
--+---
 Reporter:  mwolfe|  Owner:  tbb-team
 Type:  defect| Status:  needs_information
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-crash |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+---

Comment (by mwolfe):

 4GB. Old Macintosh 2.66 Ghz Intel Core i7, 4GB 1067 Mhz DDR3.
 Windows 10 running in Boot Camp.

 Still using OS X 10.6 on Mac side.

 Do not have normal Firefox installed. For insecure, I use old Safari on
 Mac side and Internet Explorer on Windows side.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #20390 [Applications/Tor Browser]: Tor Crashes

2016-10-18 Thread Tor Bug Tracker & Wiki 
#20390: Tor Crashes
--+---
 Reporter:  mwolfe|  Owner:  tbb-team
 Type:  defect| Status:  needs_information
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-crash |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+---

Comment (by gk):

 How much RAM do you have available for Tor Browser? Do these crashes
 happen with a clean Firefox 45.4.0esr as well?

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #20390 [Applications/Tor Browser]: Tor Crashes

2016-10-18 Thread Tor Bug Tracker & Wiki 
#20390: Tor Crashes
--+---
 Reporter:  mwolfe|  Owner:  tbb-team
 Type:  defect| Status:  needs_information
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-crash |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+---

Comment (by mwolfe):

 I had several tabs open. http://www.nytimes.com/ and
 http://www.independent.co.uk/ and some articles (I forget which ones),
 with Privacy and Security Medium Low. The crashes never happen with
 Privacy and Security set to Medium High.

 Opening several tabs of articles from http://www.independent.co.uk/ tends
 to cause crashes, both on Windows 10 64 bit and on Mac OS 10.6

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #20390 [Applications/Tor Browser]: Tor Crashes

2016-10-18 Thread Tor Bug Tracker & Wiki 
#20390: Tor Crashes
--+---
 Reporter:  mwolfe|  Owner:  tbb-team
 Type:  defect| Status:  needs_information
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-crash |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+---
Changes (by gk):

 * keywords:  Crash => tbb-crash
 * status:  new => needs_information


Comment:

 Is this reproducible? If so, how? When does the crash happen?

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

[tor-bugs] #20390 [Applications/Tor Browser]: Tor Crashes

2016-10-18 Thread Tor Bug Tracker & Wiki 
#20390: Tor Crashes
--+--
 Reporter:  mwolfe|  Owner:  tbb-team
 Type:  defect| Status:  new
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal|   Keywords:  Crash
Actual Points:|  Parent ID:
   Points:|   Reviewer:
  Sponsor:|
--+--
 Mac OS 10.6, Tor 6.0.5

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs