Opened 4 years ago

Last modified 12 days ago

#11258 new defect

Toggling permissions.memory_only causes crash of Tor Browser

Reported by: gk Owned by: tbb-team
Priority: High Milestone:
Component: Applications/Tor Browser Version:
Severity: Normal Keywords: tbb-crash, tbb-firefox-patch
Cc: mcs, brade Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

While investigating #9531 I run into an other reason for crashing when hitting New Identity:

WARNING: NS_ENSURE_TRUE(asyncCloseWasCalled) failed: file /home/firefox/tor-browser/storage/src/mozStorageConnection.cpp, line 943
Assertion failure: !mAsyncExecutionThread, at /home/firefox/tor-browser/storage/src/mozStorageConnection.cpp:415

Program ./Browser/firefox (pid = 30485) received signal 11.

Commenting out the code toggling "permissions.memory_only" seems to help.

Child Tickets

Change History (6)

comment:1 Changed 4 years ago by gk

And here comes the relevant part of the stack trace:

(gdb) bt
#0  0xb7778424 in __kernel_vsyscall ()
#1  0xb74f6276 in nanosleep () at ../sysdeps/unix/syscall-template.S:81
#2  0xb74f604d in __sleep (seconds=0) at ../sysdeps/unix/sysv/linux/sleep.c:137
#3  0xb2aee016 in ah_crap_handler (signum=11)
    at /home/firefox/tor-browser/toolkit/xre/nsSigHandlers.cpp:88
#4  0xb2af536e in nsProfileLock::FatalSignalHandler (signo=11, 
    info=0xbf8c7f0c, context=0xbf8c7f8c)
    at /home/firefox/tor-browser/obj-i686-pc-linux-gnu/toolkit/profile/nsProfileLock.cpp:190
#5  <signal handler called>
#6  0xb40b60e0 in mozilla::storage::Connection::~Connection (this=0xa2821f90, 
    __in_chrg=<optimized out>)
    at /home/firefox/tor-browser/storage/src/mozStorageConnection.cpp:415
#7  0xb40b637a in mozilla::storage::Connection::Release (this=0xa2821f90)
    at /home/firefox/tor-browser/storage/src/mozStorageConnection.cpp:441
#8  0xb2afbec3 in nsRefPtr<nsToolkitProfile>::~nsRefPtr (this=0xa2921e20, 
    __in_chrg=<optimized out>) at ../../dist/include/nsAutoPtr.h:880
#9  0xb2b76091 in nsTArrayElementTraits<nsRefPtr<mozilla::a11y::DocAccessible> >::Destruct (e=0xa2921e20) at ../../../dist/include/nsTArray.h:534
#10 0xb2b75121 in nsTArray_Impl<nsRefPtr<mozilla::a11y::DocAccessible>, nsTArrayInfallibleAllocator>::DestructRange (this=0xa9ea69ac, start=6, count=1)
    at ../../../dist/include/nsTArray.h:1535
#11 0xb40c188a in nsTArray_Impl<nsRefPtr<mozilla::storage::Connection>, nsTArray
InfallibleAllocator>::RemoveElementsAt (this=0xa9ea69ac, start=6, count=1)
    at ../../dist/include/nsTArray.h:1252
#12 0xb40c1f20 in nsTArray_Impl<nsRefPtr<mozilla::storage::Connection>, nsTArrayInfallibleAllocator>::RemoveElementAt (this=0xa9ea69ac, index=6)
    at ../../dist/include/nsTArray.h:1258
#13 0xb40c175f in nsTArray_Impl<nsRefPtr<mozilla::storage::Connection>, nsTArrayInfallibleAllocator>::RemoveElement<mozilla::storage::Connection*, nsDefaultComparator<nsRefPtr<mozilla::storage::Connection>, mozilla::storage::Connection*> >
    (this=0xa9ea69ac, item=@0xbf8c8464: 0xa2821f90, comp=...)
    at ../../dist/include/nsTArray.h:1277
#14 0xb40c1429 in nsTArray_Impl<nsRefPtr<mozilla::storage::Connection>, nsTArrayInfallibleAllocator>::RemoveElement<mozilla::storage::Connection*> (
    this=0xa9ea69ac, item=@0xbf8c8464: 0xa2821f90)
    at ../../dist/include/nsTArray.h:1285
#15 0xb40bf935 in mozilla::storage::Service::unregisterConnection (
    this=0xa9ea6980, aConnection=0xa2821f90)
    at /home/firefox/tor-browser/storage/src/mozStorageService.cpp:353
#16 0xb40b634b in mozilla::storage::Connection::Release (this=0xa2821f90)
    at /home/firefox/tor-browser/storage/src/mozStorageConnection.cpp:436
#17 0xb2afbec3 in nsRefPtr<nsToolkitProfile>::~nsRefPtr (this=0xa4e6f0d8, 
    __in_chrg=<optimized out>) at ../../dist/include/nsAutoPtr.h:880
#18 0xb40a98df in mozilla::storage::StorageBaseStatementInternal::~StorageBaseStatementInternal (this=0xa4e6f0d4, __in_chrg=<optimized out>)
    at /home/firefox/tor-browser/storage/src/StorageBaseStatementInternal.h:42
#19 0xb40aa1bd in mozilla::storage::AsyncStatement::~AsyncStatement (
    this=0xa4e6f0d0, __in_chrg=<optimized out>)
    at /home/firefox/tor-browser/storage/src/mozStorageAsyncStatement.cpp:226
#20 0xb40aa3f5 in mozilla::storage::AsyncStatement::Release (this=0xa4e6f0d0)
    at /home/firefox/tor-browser/storage/src/mozStorageAsyncStatement.cpp:266
#21 0xb2ad8d28 in nsCOMPtr<nsIRDFDelegateFactory>::assign_assuming_AddRef (
    this=0xa9eba1fc, newPtr=0x0) at ../../dist/include/nsCOMPtr.h:519
#22 0xb2adb55b in nsCOMPtr<nsIFile>::begin_assignment (this=0xa9eba1fc)
    at ../../dist/include/nsCOMPtr.h:1288
#23 0xb2de41f1 in nsCOMPtr<mozIStorageAsyncStatement>::StartAssignment (
    this=0xa9eba1fc) at ../../dist/include/nsCOMPtr.h:871
#24 0xb2de265f in nsGetterAddRefs<mozIStorageAsyncStatement>::operator mozIStorageAsyncStatement** (this=0xbf8c871c) at ../../dist/include/nsCOMPtr.h:1364
#25 0xb4167492 in nsPermissionManager::InitDB (this=0xa9eba1d0, 
    aRemoveFile=false)
    at /home/firefox/tor-browser/extensions/cookie/nsPermissionManager.cpp:581
#26 0xb416a8c6 in nsPermissionManager::Observe (this=0xa9eba1d0, 
    aSubject=0xafe092e0, aTopic=0xb59cdf52 "nsPref:changed", 
    someData=0xbf8c8868)
    at /home/firefox/tor-browser/extensions/cookie/nsPermissionManager.cpp:1269
#27 0xb2e4f30d in nsPrefBranch::NotifyObserver (
    newpref=0xa5b258e0 "permissions.memory_only", data=0xa9eacc20)
    at /home/firefox/tor-browser/modules/libpref/src/nsPrefBranch.cpp:724
#28 0xb2e534ec in pref_DoCallback (
    changed_pref=0xa5b258e0 "permissions.memory_only")
    at /home/firefox/tor-browser/modules/libpref/src/prefapi.cpp:956
#29 0xb2e5300c in pref_HashPref (key=0xa5b258e0 "permissions.memory_only", 
    value=..., type=PREF_BOOL, flags=0)
    at /home/firefox/tor-browser/modules/libpref/src/prefapi.cpp:802
#30 0xb2e51b16 in PREF_SetBoolPref (
    pref_name=0xa5b258e0 "permissions.memory_only", value=false, 
    set_default=false)
    at /home/firefox/tor-browser/modules/libpref/src/prefapi.cpp:275
#31 0xb2e4c888 in nsPrefBranch::SetBoolPref (this=0xafe092e0, 
    aPrefName=0xa5b258e0 "permissions.memory_only", aValue=false)
    at /home/firefox/tor-browser/modules/libpref/src/nsPrefBranch.cpp:151
#32 0xb2e40fcf in mozilla::Preferences::SetBoolPref (this=0xafe0c680, 
    aPrefName=0xa5b258e0 "permissions.memory_only", aValue=false)
    at ../../../dist/include/mozilla/Preferences.h:48

comment:2 Changed 3 years ago by erinn

Keywords: tbb-firefox-patch added

comment:3 Changed 3 years ago by erinn

Component: Firefox Patch IssuesTor Browser
Owner: changed from mikeperry to tbb-team

comment:4 Changed 3 years ago by mcs

Cc: mcs brade added

I encountered this or a very, very similar crash today on Mac OS with an ESR 38-based browser while working on #13035. For me, it is actually a failed assertion (in a debug build) and it occurs the second time I do "New Identity", every time.

Assertion failure: !mAsyncExecutionThread (AsyncClose has not been invoked on this connection!), at /.../storage/src/mozStorageConnection.cpp:504

comment:5 in reply to:  4 Changed 3 years ago by gk

Replying to mcs:

I encountered this or a very, very similar crash today on Mac OS with an ESR 38-based browser while working on #13035. For me, it is actually a failed assertion (in a debug build) and it occurs the second time I do "New Identity", every time.

Yeah, I guess this is the same one. I encountered the problem as well by using a debug build and hitting New Identity. It led me to disable the permissions related code as this crash was much more reliable than the hang in #9531 which I actually wanted to debug.

Last edited 3 years ago by gk (previous) (diff)

comment:6 Changed 12 days ago by teor

Severity: Normal

Set all open tickets without a severity to "Normal"

Note: See TracTickets for help on using tickets.