Opened 5 years ago

Closed 5 years ago

Last modified 4 years ago

#13443 closed defect (fixed)

TB v4.0 (xul.dll) crashes on Windows

Reported by: cypherpunks Owned by: tbb-team
Priority: Very High Milestone:
Component: Applications/Tor Browser Version:
Severity: Normal Keywords: tbb-crash, tbb-helpdesk-frequent, TorBrowserTeam201410, fuck-mingw
Cc: Sherief, user523, arthuredelstein, sepand, samskarebyaha, olddoggi Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

Hi,

I tried out the 4.0 TB bundle today on Windows 7 SP1 64-bit and it consistently crashed after logging into gmail. Gmail would authenticate and the page would begin to load (I could see emails), but when the page load completed, the entire browser crashed. I went back to 3.6.6, which works fine on this machine.

Child Tickets

Attachments (2)

start.cmd (53 bytes) - added by cypherpunks 5 years ago.
Disable trap to debugger
Debug.TXT (36.3 KB) - added by gk 5 years ago.
debug information -- crash with default build

Download all attachments as: .zip

Change History (56)

comment:1 Changed 5 years ago by gk

Keywords: tbb-crash added
Version: Tor: unspecified

Does this happens somewhere else, too? I don't have a Gmail account, which makes reproducing it hard for me.

comment:2 in reply to:  1 ; Changed 5 years ago by Jason

Replying to gk:

Does this happens somewhere else, too? I don't have a Gmail account, which makes reproducing it hard for me.

There are more "TB crash" tickets on RT. I believe this issue is limited to Windows verson of TB4.0.

Some websites reported by users:
tweetdeck
chatovod.com

And the error messages:
Firefox.exe - EXCEPTION
A breakpoint has been reached.

comment:3 in reply to:  2 ; Changed 5 years ago by gk

Priority: normalcritical
Summary: TB v4.0 crashes onload for gmailTB v4.0 crashes on Windows

Replying to Jason:

Replying to gk:

Does this happens somewhere else, too? I don't have a Gmail account, which makes reproducing it hard for me.

There are more "TB crash" tickets on RT. I believe this issue is limited to Windows verson of TB4.0.

Some websites reported by users:
tweetdeck
chatovod.com

And the error messages:
Firefox.exe - EXCEPTION
A breakpoint has been reached.

I can reproduce that with tweetdeck on a Windows machine. Let me know if OS X and Linux are affected as well with some crashes (tweetdeck works on my Linux box at least). Marking as 'critical' as it is probably affecting a ton of users and the crash reason is unknown yet.

comment:4 in reply to:  3 Changed 5 years ago by Jason

Replying to gk:

I can reproduce that with tweetdeck on a Windows machine. Let me know if OS X and Linux are affected as well with some crashes (tweetdeck works on my Linux box at least). Marking as 'critical' as it is probably affecting a ton of users and the crash reason is unknown yet.

Didn't see any crash complaints about OS X and Linux. Now I'm directing users to this ticket and ask them to add more details.

Last edited 5 years ago by Jason (previous) (diff)

comment:5 Changed 5 years ago by u0

Problem Event Name: APPCRASH
Application Name: firefox.exe
Application Version: 31.2.0.0
Application Timestamp: 00000000
Fault Module Name: xul.dll
Fault Module Version: 31.2.0.0

Windows 7 64bit, clean TBB4 install. Suspect jquery on page is involved.

comment:6 Changed 5 years ago by Jason

Don't know why, but looks like it works (at least for tweetdeck crahs).

Here it is:

  1. Click NoScript and choose "Forbid scripts globally";
  2. Click NoScript, then choose Option > Embeddings;
  3. In the "addtional restrictions for untrusted sites" section, check all the options;
  4. Open "https://tweetdeck.twitter.com/";
  5. When it begins to load the page, click Noscript and choose "temporarily allow all this page";
  6. If the page keeps loading like forever, click "refresh" or press F5.

Changed 5 years ago by cypherpunks

Attachment: start.cmd added

Disable trap to debugger

comment:7 Changed 5 years ago by cypherpunks

Useless, xul.dll contains unknown code, no such code in repos exist.

Last edited 5 years ago by cypherpunks (previous) (diff)

comment:8 Changed 5 years ago by gk

My full-fledged debug build crashes on Windows way earlier for different reasons (will be a new issue to investigate) and the default build gives the attached debug log. Seems we need some symbols here. I am building a new debug build just with debug symbols and deoptimized code. Might already be enough to find the problem.

Changed 5 years ago by gk

Attachment: Debug.TXT added

debug information -- crash with default build

comment:9 Changed 5 years ago by belinda

My original comment was this one: "My TBB keeps crashing every time I try to read my Gmail emails. No idea why. On Win 7, 32-bit. Everything worked perfectly before on the alphas 4.0 1,2, and 3. :("

TBB 4.0 is still crashing on my Win7 machine (initially in GMail but now also in the same way when I tried to register to make this comment, haha). However it's working fine on my Mac 64bit with Yosemite installed, GMail included.

Hope this helps and a big thank you to everyone like yourselves who puts effort in to make everything work.

comment:10 Changed 5 years ago by gk

Marked #13457 duplicate.

comment:11 Changed 5 years ago by gk

Marked #13468 as duplicate. oboom.com is affected as well.

comment:12 Changed 5 years ago by gk

Cc: Sherief added

Marked #13492 as duplicate.

comment:13 Changed 5 years ago by Sherief

Cc: Sherief removed

Confirmed on Windows using a gmail account.

Crash log:

Problem signature:
  Problem Event Name:	APPCRASH
  Application Name:	firefox.exe
  Application Version:	31.2.0.0
  Application Timestamp:	00000000
  Fault Module Name:	xul.dll
  Fault Module Version:	31.2.0.0
  Fault Module Timestamp:	00000000
  Exception Code:	80000003
  Exception Offset:	0105d1e4
  OS Version:	6.1.7601.2.1.0.256.48
  Locale ID:	1033
  Additional Information 1:	0a9e
  Additional Information 2:	0a9e372d3b4ad19135b953a78882e789
  Additional Information 3:	0a9e
  Additional Information 4:	0a9e372d3b4ad19135b953a78882e789

comment:14 Changed 5 years ago by gk

This seems not to be caused by our patches. A vanilla ESR 31.2.0 compiled with mingw-w64 is crashing as well. And it does not seem to be a compiler bug either as Tor Browser compiled with mingw-w64 based on GCC 4.8.3 is crashing, too. Trying to bisect ESR 31 itself now to find the culprit.

Last edited 5 years ago by gk (previous) (diff)

comment:15 Changed 5 years ago by Sherief

Cc: Sherief added

comment:16 Changed 5 years ago by cypherpunks

My Tor Browser 4.0 crashes if I try to open local or online mp3 files. Logs show xul.dll

Another one has reported the same issue on the blog comments.

Last edited 5 years ago by cypherpunks (previous) (diff)

comment:17 Changed 5 years ago by Sherief

I didn't find any problems with OS X.

comment:18 Changed 5 years ago by cypherpunks

Could it be about the new hardening? #10065

comment:19 Changed 5 years ago by mikeperry

Keywords: tbb-helpdesk-frequent TorBrowserTeam201410 added

comment:20 in reply to:  18 Changed 5 years ago by gk

Replying to cypherpunks:

Could it be about the new hardening? #10065

Good idea but alas it is not that easy. Compiling without hardening is still crashing Tor Browser.

comment:21 in reply to:  14 ; Changed 5 years ago by cypherpunks

Replying to gk:

And it does not seem to be a compiler bug either as Tor Browser compiled with mingw-w64 based on GCC 4.8.3 is crashing, too.

Tor Browser compiled with d6435c83fe7268ef479f2db7cfd145684a9ffcc2 commit reverted or just with older GCC?

comment:22 in reply to:  21 Changed 5 years ago by gk

Replying to cypherpunks:

Replying to gk:

And it does not seem to be a compiler bug either as Tor Browser compiled with mingw-w64 based on GCC 4.8.3 is crashing, too.

Tor Browser compiled with d6435c83fe7268ef479f2db7cfd145684a9ffcc2 commit reverted or just with older GCC?

Just an older GCC as the mingw tag is too old for compiling Firefox ESR 31.

comment:23 in reply to:  14 Changed 5 years ago by cypherpunks

Replying to gk:

A vanilla ESR 31.2.0 compiled with mingw-w64 is crashing as well.

With disabled webrtc?

comment:24 Changed 5 years ago by gk

Cc: user523 added

Resolved #13532 as duplicate.

comment:25 Changed 5 years ago by cypherpunks

Nothing

Last edited 5 years ago by cypherpunks (previous) (diff)

comment:26 Changed 5 years ago by cypherpunks

Nothing

Last edited 5 years ago by cypherpunks (previous) (diff)

comment:27 Changed 5 years ago by gk

As an additional data point: Firefox 30 is crashing, too, but not 28.0a1 (built from rev 155018). This is basically with the Tor Browser .mozconfig (only webgl and accessibility disabled to speed things up).

comment:28 Changed 5 years ago by arthuredelstein

Cc: arthuredelstein added

comment:29 in reply to:  25 ; Changed 5 years ago by bullgeschichte

Replying to cypherpunks:

Try Hotfix:
set media.directshow.enabled pref to false.

I tried this and fixes tweetdeck crash. What does it do? Does it compromize anonimity?

comment:30 in reply to:  29 Changed 5 years ago by cypherpunks

What does it do?

It disable DirectShow to playback mp3 and another patented coding formats.

Does it compromize anonimity?

Probably. See #13543

comment:31 Changed 5 years ago by cypherpunks

Summary: TB v4.0 crashes on WindowsTB v4.0 (xul.dll) crashes on Windows

comment:32 Changed 5 years ago by cypherpunks

Can anybody to share (high level compressed) xull.dll for Tor Browser compiled with usual .mozconfig but webrtc enabled?

comment:33 Changed 5 years ago by mcs

Cc: sepand added

Resolved #13549 as a duplicate.

comment:34 Changed 5 years ago by mikeperry

gk - I am reluctant to call the pref change a workaround that we want to make a release for, unless it seems unlikely for us to find a better solution in a reasonable time frame. How is the bisecting going? Think you're likely to find an offending commit between now and the meeting on Monday?

comment:35 in reply to:  32 Changed 5 years ago by gk

Replying to cypherpunks:

Can anybody to share (high level compressed) xull.dll for Tor Browser compiled with usual .mozconfig but webrtc enabled?

Alas, no, as compiling WebRTC with mingw-w64 is broken at the moment.

comment:36 in reply to:  34 Changed 5 years ago by gk

Replying to mikeperry:

gk - I am reluctant to call the pref change a workaround that we want to make a release for, unless it seems unlikely for us to find a better solution in a reasonable time frame. How is the bisecting going? Think you're likely to find an offending commit between now and the meeting on Monday?

Tricky, I am close (last good rev 158433, first bad rev 159183) but it does not go faster as the breakage and amount of custom patches which need to get applied to get it built at all is rising. I might be lucky with some educated guesses today, we'll see. But given that I am afk from Sunday - Wednesday inclusive am not so optimistic.

comment:37 Changed 5 years ago by cypherpunks

(last good rev 158433, first bad rev 159183)

It's probably about enabling DirectShow for mp3 in Vista+ since 28 version then, because you testing using Win7 (?). Firefox disabled DirectShow for mp3 in Vista+ since 27 version.

comment:38 Changed 5 years ago by gk

Cc: samskarebyaha added

Resolved #13559 as a duplicate.

comment:39 in reply to:  37 Changed 5 years ago by gk

Replying to cypherpunks:

(last good rev 158433, first bad rev 159183)

It's probably about enabling DirectShow for mp3 in Vista+ since 28 version then, because you testing using Win7 (?). Firefox disabled DirectShow for mp3 in Vista+ since 27 version.

Yes. It turns out the crash is reproducible since the DirectShow code landed: https://hg.mozilla.org/mozilla-central/rev/e7fef018f421 is the first revision that breaks the build.

comment:41 Changed 5 years ago by u0

So what's next? Is it just a case of waiting for Mozilla to patch this?

comment:42 Changed 5 years ago by cypherpunks

DirectShow's classes using Component Object Model (COM), which hardly depends on exception handling:

inline void _com_issue_error(HRESULT hr) throw(_com_error) {
#if __EXCEPTIONS
    throw _com_error(hr);
#else
    /* This is designed to use exceptions. If exceptions are disabled, there is not much we can do here. */
    __debugbreak();
#endif
}

Firefox can't handle exceptions if built using GCC (Linux or MinGW, -fno-exceptions used). MSVC using cheap SEH so can handle exceptions. Not every exception code is fatal, but if no exception handling enabled then every error leads to program termination. MinGW version of _com_issue_error makes it clear by generating INT3.

Version 1, edited 5 years ago by cypherpunks (previous) (next) (diff)

comment:43 Changed 5 years ago by user523

Did all forget about cookie management?

comment:44 Changed 5 years ago by NewEraCracker

I can also reproduce this issue.

The current workaround is going to about:config and changing media.directshow.enabled to false as said here: https://bugzilla.mozilla.org/show_bug.cgi?id=1088848

Thanks to gk for sharing the link in comment 40.

This is a very annoying bug and it should be either fixed or have the above workaround applied.

comment:45 Changed 5 years ago by cypherpunks

Nothing

Last edited 5 years ago by cypherpunks (previous) (diff)

comment:46 Changed 5 years ago by cypherpunks

Nothing

Last edited 5 years ago by cypherpunks (previous) (diff)

comment:47 Changed 5 years ago by cypherpunks

Don't forget about #13543. It's better to disable DirectShow and WFM for Tor Browser by default.

comment:48 Changed 5 years ago by gk

Jacek landed the fix for us in the mingw-w64 repo: e712bb8b106d059914388e6ccd93c584a6416082.

comment:49 Changed 5 years ago by gk

Cc: olddoggi added

Resolved #13609 as duplicate.

comment:50 Changed 5 years ago by mikeperry

Resolution: fixed
Status: newclosed

This is mingw update is merged for 4.5-alpha-1 and fixed via pref for 4.0.1.

comment:51 Changed 5 years ago by u0

oops, my bad, pbcak...

Last edited 5 years ago by u0 (previous) (diff)

comment:52 Changed 5 years ago by gk

Resolved #13691 as duplicate.

comment:53 Changed 4 years ago by cypherpunks

Keywords: mingw added
Severity: Normal

comment:54 Changed 4 years ago by cypherpunks

Keywords: fuck-mingw added; mingw removed
Note: See TracTickets for help on using tickets.