Tor Browser 8 crashes trying to print on Linux

Looks like a crash in the print dialog itself:

#0  0x000000000006a0e6 in ?? ()
#1  0x00007e03fcbebc0e in OPENSSL_cpuid_setup () from /lib64/libcrypto.so.1.1
#2  0x00007e03fcb820b7 in _init () from /lib64/libcrypto.so.1.1
#3  0x00007e041317a5d0 in ?? () from /usr/lib64/gtk-3.0/3.0.0/printbackends/libprintbackend-cloudprint.so
#4  0x00007e044b4914da in call_init.part () from /lib64/ld-linux-x86-64.so.2
#5  0x00007e044b491616 in _dl_init () from /lib64/ld-linux-x86-64.so.2
#6  0x00007e044b4957bf in dl_open_worker () from /lib64/ld-linux-x86-64.so.2
#7  0x00007e044a28fc4f in _dl_catch_exception () from /lib64/libc.so.6
#8  0x00007e044b495037 in _dl_open () from /lib64/ld-linux-x86-64.so.2
#9  0x00007e044b060006 in dlopen_doit () from /lib64/libdl.so.2
#10 0x00007e044a28fc4f in _dl_catch_exception () from /lib64/libc.so.6
#11 0x00007e044a28fcdf in _dl_catch_error () from /lib64/libc.so.6
#12 0x00007e044b060725 in _dlerror_run () from /lib64/libdl.so.2
#13 0x00007e044b060096 in dlopen@@GLIBC_2.2.5 () from /lib64/libdl.so.2
#14 0x00007e0448f6e902 in g_module_open () from /lib64/libgmodule-2.0.so.0
#15 0x00007e0449831f7a in gtk_print_backend_module_load () from /lib64/libgtk-3.so.0
#16 0x00007e04468bd1c1 in g_type_module_use () from /lib64/libgobject-2.0.so.0
#17 0x00007e04498328b0 in _gtk_print_backend_module_create () from /lib64/libgtk-3.so.0
#18 0x00007e0449832cd7 in gtk_print_backend_load_modules () from /lib64/libgtk-3.so.0
#19 0x00007e044982c4dd in gtk_print_unix_dialog_init () from /lib64/libgtk-3.so.0
#20 0x00007e04468b9f3a in g_type_create_instance () from /lib64/libgobject-2.0.so.0
#21 0x00007e044689c6c8 in g_object_new_internal () from /lib64/libgobject-2.0.so.0
#22 0x00007e044689e64e in g_object_new_valist () from /lib64/libgobject-2.0.so.0
#23 0x00007e044689e9ad in g_object_new () from /lib64/libgobject-2.0.so.0
#24 0x00007e043cd65e24 in nsPrintDialogWidgetGTK::nsPrintDialogWidgetGTK (this=0x7ffc301b5280, aParent=<optimized out>, aSettings=0x7e040823c7e0)
    at /var/tmp/build/firefox-124fa904c4b2/widget/gtk/nsPrintDialogGTK.cpp:160
#25 0x00007e043cd67523 in nsPrintDialogServiceGTK::Show (this=<optimized out>, aParent=<optimized out>, aSettings=0x7e040823c7e0, 
    aWebBrowserPrint=<optimized out>) at /var/tmp/build/firefox-124fa904c4b2/widget/gtk/nsPrintDialogGTK.cpp:524
#26 0x00007e043db2dccd in nsPrintingPromptService::ShowPrintDialog (this=<optimized out>, parent=0x7e041fbe87f0, webBrowserPrint=0x7e0416349000,
    printSettings=0x7e040823c7e0) at /var/tmp/build/firefox-124fa904c4b2/toolkit/components/printingui/nsPrintingPromptService.cpp:83
#27 0x00007e043db315fe in mozilla::embedding::PrintingParent::ShowPrintDialog (this=0x7e04081fc060, aParent=0x7e0410365800, aData=...,
    aResult=aResult@entry=0x7ffc301b5400) at /var/tmp/build/firefox-124fa904c4b2/toolkit/components/printingui/ipc/PrintingParent.cpp:162
#28 0x00007e043db31c18 in mozilla::embedding::PrintingParent::RecvShowPrintDialog (this=<optimized out>, aDialog=0x7e0415a64f40, aParent=<optimized out>,
    aData=...) at /var/tmp/build/firefox-124fa904c4b2/toolkit/components/printingui/ipc/PrintingParent.cpp:183
#29 0x00007e043b5b79c0 in mozilla::embedding::PPrintingParent::OnMessageReceived (this=0x7e04081fc060, msg__=...)
    at /var/tmp/build/firefox-124fa904c4b2/obj-x86_64-pc-linux-gnu/ipc/ipdl/PPrintingParent.cpp:314
#30 0x00007e043b69eae6 in mozilla::dom::PContentParent::OnMessageReceived (this=0x7e0407f4f000, msg__=...)
    at /var/tmp/build/firefox-124fa904c4b2/obj-x86_64-pc-linux-gnu/ipc/ipdl/PContentParent.cpp:3319
#31 0x00007e043b4983ef in mozilla::ipc::MessageChannel::DispatchAsyncMessage (this=this@entry=0x7e0407f4f108, aMsg=...)
    at /var/tmp/build/firefox-124fa904c4b2/ipc/glue/MessageChannel.cpp:2138
#32 0x00007e043b49e67b in mozilla::ipc::MessageChannel::DispatchMessage (this=0x7e0407f4f108, aMsg=...)
    at /var/tmp/build/firefox-124fa904c4b2/ipc/glue/MessageChannel.cpp:2068
#33 0x00007e043b49ffb9 in mozilla::ipc::MessageChannel::RunMessage (this=<optimized out>, aTask=...)
#34 0x00007e043b4a00ed in mozilla::ipc::MessageChannel::MessageTask::Run (this=0x7e041bb53f30)
    at /var/tmp/build/firefox-124fa904c4b2/ipc/glue/MessageChannel.cpp:1947
#35 0x00007e043b0e3018 in nsThread::ProcessNextEvent (this=0x7e0449f5cd40, aMayWait=<optimized out>, aResult=0x7ffc301b612f)
    at /var/tmp/build/firefox-124fa904c4b2/xpcom/threads/nsThread.cpp:1040
#36 0x00007e043b0eb878 in NS_ProcessNextEvent (aThread=<optimized out>, aThread@entry=0x7e0449f5cd40, aMayWait=aMayWait@entry=false)
    at /var/tmp/build/firefox-124fa904c4b2/xpcom/threads/nsThreadUtils.cpp:517
#37 0x00007e043b48fa5a in mozilla::ipc::MessagePump::Run (this=0x7e0449ff2ec0, aDelegate=0x7e0449f67200)
    at /var/tmp/build/firefox-124fa904c4b2/ipc/glue/MessagePump.cpp:97
#38 0x00007e043b46697d in MessageLoop::RunInternal (this=<optimized out>) at /var/tmp/build/firefox-124fa904c4b2/ipc/chromium/src/base/message_loop.cc:326
#39 MessageLoop::RunHandler (this=<optimized out>) at /var/tmp/build/firefox-124fa904c4b2/ipc/chromium/src/base/message_loop.cc:319
#40 MessageLoop::Run (this=<optimized out>) at /var/tmp/build/firefox-124fa904c4b2/ipc/chromium/src/base/message_loop.cc:299
#41 0x00007e043cd11d68 in nsBaseAppShell::Run (this=0x7e042b873e20) at /var/tmp/build/firefox-124fa904c4b2/widget/nsBaseAppShell.cpp:157
#42 0x00007e043dabc05e in nsAppStartup::Run (this=0x7e04276951f0) at /var/tmp/build/firefox-124fa904c4b2/toolkit/components/startup/nsAppStartup.cpp:290
#43 0x00007e043db506af in XREMain::XRE_mainRun (this=this@entry=0x7ffc301b6410) at /var/tmp/build/firefox-124fa904c4b2/toolkit/xre/nsAppRunner.cpp:5372
#44 0x00007e043db514af in XREMain::XRE_main (this=this@entry=0x7ffc301b6410, argc=argc@entry=5, argv=argv@entry=0x7ffc301b7748, aConfig=...)
    at /var/tmp/build/firefox-124fa904c4b2/toolkit/xre/nsAppRunner.cpp:5517
#45 0x00007e043db51896 in XRE_main (argc=5, argv=0x7ffc301b7748, aConfig=...) at /var/tmp/build/firefox-124fa904c4b2/toolkit/xre/nsAppRunner.cpp:5609
#46 0x000058af70f3e266 in do_main (argc=5, argv=0x7ffc301b7748, envp=<optimized out>) at /var/tmp/build/firefox-124fa904c4b2/browser/app/nsBrowserApp.cpp:231
#47 0x000058af70f3da29 in main (argc=5, argv=0x7ffc301b7748, envp=0x7ffc301b7778) at /var/tmp/build/firefox-124fa904c4b2/browser/app/nsBrowserApp.cpp:304

added TorBrowserTeam201901R component::applications/tor browser owner::tbb-team priority::medium resolution::fixed severity::normal status::closed tbb-8.0-issues tbb-backported tbb-crash tbb-rbm tbb-regression type::defect labels

Do you have some steps to reproduce the problem? I tried a bit but I don't get a crash on my system. Oh, and does a vanilla Firefox 60 ESR show the same problem on your system? (see: https://www.mozilla.org/en-US/firefox/organizations/all/ for some bundles)

Trac:
Keywords: N/A deleted, tbb.8.0-issues, tbb-regression added
Status: new to needs_information

Firefox 60 ESR does not crash. This is a Fedora 28 system. It looks like the crash is being triggered in that libprintbackend-cloudprint.so lib, which is troubling.

Bug is easy to trigger for me. Going to the print dialog after trying to print any page will cause the crash, before the print dialog appears. I can get a print preview. It's just the dialog itself seems to be the problem.

I will try to get debuginfo symbols for that and all of the glibc+gtk poritions, and make a new backtrace.

Okay, the ASan build was trickier than expected:

https://people.torproject.org/~gk/testbuilds/tor-browser-linux64-8.0_en-US-asan.tar.xz https://people.torproject.org/~gk/testbuilds/tor-browser-linux64-8.0_en-US-asan.tar.xz.asc

If you think debug symbols would be useful let me know. I have them around as well and could upload them.

Yeah I need debug symbols. The crashes seem to be coming from libxul now.

Also I tried this build on a fedora 26 system and it did not crash. It seems to be something that changed in FC28 that is causing it.

Alright, here we go:

https://people.torproject.org/~gk/testbuilds/tor-browser-linux64-debug.tar.xz https://people.torproject.org/~gk/testbuilds/tor-browser-linux64-debug.tar.xz.asc

''' jaym@stealth:~/Downloads/tor-browser_en-US$ ./Browser/firefox Oct 11 08:43:29.111 [notice] Tor 0.3.3.9 (git-45028085ea188baf) running on Linux with Libevent 2.1.8-stable, OpenSSL 1.0.2p, Zlib 1.2.11, Liblzma N/A, and Libzstd N/A. Oct 11 08:43:29.111 [notice] Tor can't help you if you use it wrong! Learn how to be safe at https://www.torproject.org/download/download#warning Oct 11 08:43:29.111 [notice] Read configuration file "/home/jaym/Downloads/tor-browser_en-US/Browser/TorBrowser/Data/Tor/torrc-defaults". Oct 11 08:43:29.111 [notice] Read configuration file "/home/jaym/Downloads/tor-browser_en-US/Browser/TorBrowser/Data/Tor/torrc". Oct 11 08:43:29.117 [notice] Scheduler type KIST has been enabled. Oct 11 08:43:29.117 [notice] Opening Socks listener on 127.0.0.1:9150 Oct 11 08:43:29.117 [notice] Opening Control listener on 127.0.0.1:9151 Oct 11 08:43:29.000 [notice] Parsing GEOIP IPv4 file /home/jaym/Downloads/tor-browser_en-US/Browser/TorBrowser/Data/Tor/geoip.

(firefox:5303): Gtk-WARNING **: 08:43:29.138: Theme parsing error: :1:34: Expected ')' in color definition

(firefox:5303): Gtk-WARNING **: 08:43:29.139: Theme parsing error: :1:77: Expected ')' in color definition Oct 11 08:43:29.000 [notice] Parsing GEOIP IPv6 file /home/jaym/Downloads/tor-browser_en-US/Browser/TorBrowser/Data/Tor/geoip6. Oct 11 08:43:29.000 [notice] Bootstrapped 0%: Starting Oct 11 08:43:30.000 [notice] Starting with guard context "default" Oct 11 08:43:30.000 [notice] Bootstrapped 80%: Connecting to the Tor network Oct 11 08:43:30.000 [notice] New control connection opened from 127.0.0.1. Oct 11 08:43:30.000 [notice] New control connection opened from 127.0.0.1. 1539247411058 addons.webextension.{73a6fe31-595d-460b-a920-fcc0f8843232} WARN Loading extension '{73a6fe31-595d-460b-a920-fcc0f8843232}': Reading manifest: Error processing background.persistent: Event pages are not currently supported. This will run as a persistent background page. 1539247411320 addons.webextension.https-everywhere-eff@eff.org WARN Please specify whether you want browser_style or not in your browser_action options. 1539247411320 addons.webextension.{73a6fe31-595d-460b-a920-fcc0f8843232} WARN Please specify whether you want browser_style or not in your browser_action options. Oct 11 08:43:31.000 [notice] Bootstrapped 85%: Finishing handshake with first hop Oct 11 08:43:31.000 [notice] Bootstrapped 90%: Establishing a Tor circuit Oct 11 08:43:32.000 [notice] Tor has successfully opened a circuit. Looks like client functionality is working. Oct 11 08:43:32.000 [notice] Bootstrapped 100%: Done Oct 11 08:43:33.000 [notice] New control connection opened from 127.0.0.1. Oct 11 08:43:33.000 [notice] New control connection opened from 127.0.0.1. ./Browser/firefox.real: symbol lookup error: /usr/lib/x86_64-linux-gnu/libhogweed.so.4: undefined symbol: __gmpz_limbs_read ASAN:DEADLYSIGNAL

==5427==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f8037bbae08 bp 0x7f8034a7f690 sp 0x7f8034a7f680 T2) Crash Annotation GraphicsCriticalError: |[C0][GFX1-]: Receive IPC close with reason=AbnormalShutdown (t=3.48482) Oct 11 08:43:37.000 [notice] Owning controller connection has closed -- exiting now. Oct 11 08:43:37.000 [notice] Catching signal TERM, exiting cleanly. ASAN:DEADLYSIGNAL

==5377==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f68608c2e08 bp 0x7f685d787690 sp 0x7f685d787680 T2) Crash Annotation GraphicsCriticalError: |[C0][GFX1-]: Receive IPC close with reason=AbnormalShutdown (t=4.51812) jaym@stealth:~/Downloads/tor-browser_en-US$ #0 0x7f8037bbae07 (/home/jaym/Downloads/tor-browser_en-US/Browser/libxul.so+0x222be07) #1 0x7f8037bbb33e (/home/jaym/Downloads/tor-browser_en-US/Browser/libxul.so+0x222c33e) #2 (closed) 0x7f8037b7b0ea (/home/jaym/Downloads/tor-browser_en-US/Browser/libxul.so+0x21ec0ea) #3 (closed) 0x7f8037b7bf96 (/home/jaym/Downloads/tor-browser_en-US/Browser/libxul.so+0x21ecf96) #4 (closed) 0x7f8037b2bb65 (/home/jaym/Downloads/tor-browser_en-US/Browser/libxul.so+0x219cb65) #5 (closed) 0x7f8037b32585 (/home/jaym/Downloads/tor-browser_en-US/Browser/libxul.so+0x21a3585) #6 (closed) 0x7f8037b54114 (/home/jaym/Downloads/tor-browser_en-US/Browser/libxul.so+0x21c5114) #7 (closed) 0x7f8037b2b02d (/home/jaym/Downloads/tor-browser_en-US/Browser/libxul.so+0x219c02d) #8 (closed) 0x7f804fcd16da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da) #9 (closed) 0x7f804eeb788e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x12188e)

AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV (/home/jaym/Downloads/tor-browser_en-US/Browser/libxul.so+0x222be07) Thread T2 (Chrome_~dThread) created by T0 (Web Content) here: #0 0x7f804ff1cd79 in __interceptor_pthread_create (Browser/TorBrowser/Tor/libasan.so.3+0x33d79) #1 0x7f8037b2bdf3 (/home/jaym/Downloads/tor-browser_en-US/Browser/libxul.so+0x219cdf3) #2 (closed) 0x7f8037b52453 (/home/jaym/Downloads/tor-browser_en-US/Browser/libxul.so+0x21c3453) #3 (closed) 0x7f8037bbd893 (/home/jaym/Downloads/tor-browser_en-US/Browser/libxul.so+0x222e893) #4 (closed) 0x7f803e7777c6 (/home/jaym/Downloads/tor-browser_en-US/Browser/libxul.so+0x8de87c6) #5 (closed) 0x55c4970c18fc (/home/jaym/Downloads/tor-browser_en-US/Browser/firefox.real+0xa8fc) #6 (closed) 0x55c4970c0bdb (/home/jaym/Downloads/tor-browser_en-US/Browser/firefox.real+0x9bdb) #7 (closed) 0x7f804edb7b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)

==5427==ABORTING #0 0x7f68608c2e07 (/home/jaym/Downloads/tor-browser_en-US/Browser/libxul.so+0x222be07) #1 0x7f68608c333e (/home/jaym/Downloads/tor-browser_en-US/Browser/libxul.so+0x222c33e) #2 (closed) 0x7f68608830ea (/home/jaym/Downloads/tor-browser_en-US/Browser/libxul.so+0x21ec0ea) #3 (closed) 0x7f6860883f96 (/home/jaym/Downloads/tor-browser_en-US/Browser/libxul.so+0x21ecf96) #4 (closed) 0x7f6860833b65 (/home/jaym/Downloads/tor-browser_en-US/Browser/libxul.so+0x219cb65) #5 (closed) 0x7f686083a585 (/home/jaym/Downloads/tor-browser_en-US/Browser/libxul.so+0x21a3585) #6 (closed) 0x7f686085c114 (/home/jaym/Downloads/tor-browser_en-US/Browser/libxul.so+0x21c5114) #7 (closed) 0x7f686083302d (/home/jaym/Downloads/tor-browser_en-US/Browser/libxul.so+0x219c02d) #8 (closed) 0x7f68789d96da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da) #9 (closed) 0x7f6877bbf88e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x12188e)

AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV (/home/jaym/Downloads/tor-browser_en-US/Browser/libxul.so+0x222be07) Thread T2 (Chrome_~dThread) created by T0 (Web Content) here: #0 0x7f6878c24d79 in __interceptor_pthread_create (Browser/TorBrowser/Tor/libasan.so.3+0x33d79) #1 0x7f6860833df3 (/home/jaym/Downloads/tor-browser_en-US/Browser/libxul.so+0x219cdf3) #2 (closed) 0x7f686085a453 (/home/jaym/Downloads/tor-browser_en-US/Browser/libxul.so+0x21c3453) #3 (closed) 0x7f68608c5893 (/home/jaym/Downloads/tor-browser_en-US/Browser/libxul.so+0x222e893) #4 (closed) 0x7f686747f7c6 (/home/jaym/Downloads/tor-browser_en-US/Browser/libxul.so+0x8de87c6) #5 (closed) 0x55f3c88738fc (/home/jaym/Downloads/tor-browser_en-US/Browser/firefox.real+0xa8fc) #6 (closed) 0x55f3c8872bdb (/home/jaym/Downloads/tor-browser_en-US/Browser/firefox.real+0x9bdb) #7 (closed) 0x7f6877abfb96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)

==5377==ABORTING

================================================================= ==5341==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 4 byte(s) in 1 object(s) allocated from: #0 0x7fd03a535b58 in interceptor_malloc (Browser/TorBrowser/Tor/libasan.so.3+0xc4b58) #1 0x5611dd1c2e9a in tor_malloc (/home/jaym/Downloads/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0xaf0e9a) #2 (closed) 0x5611dd1c2f41 in tor_malloc_zero (/home/jaym/Downloads/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0xaf0f41) #3 (closed) 0x5611dd032c01 (/home/jaym/Downloads/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0x960c01) #4 (closed) 0x5611dd032f03 (/home/jaym/Downloads/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0x960f03) #5 (closed) 0x5611dd041991 in control_event_logmsg (/home/jaym/Downloads/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0x96f991) #6 (closed) 0x5611dd1ba27d (/home/jaym/Downloads/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0xae827d) #7 (closed) 0x5611dd1bbcc1 in tor_log (/home/jaym/Downloads/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0xae9cc1) #8 (closed) 0x5611dd04cd46 in control_event_bootstrap (/home/jaym/Downloads/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0x97ad46) #9 (closed) 0x5611dd016215 in connection_or_finished_connecting (/home/jaym/Downloads/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0x944215) #10 (closed) 0x5611dcfe95c2 (/home/jaym/Downloads/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0x9175c2) #11 (closed) 0x5611dcfeaefb in connection_handle_write (/home/jaym/Downloads/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0x918efb) #12 (closed) 0x5611dcd69b97 (/home/jaym/Downloads/tor-browser_en-US/Browser/TorBrowser/Tor/tor+0x697b97) #13 (closed) 0x7fd039c7d149 (Browser/TorBrowser/Tor/libevent-2.1.so.6+0x22149)

SUMMARY: AddressSanitizer: 4 byte(s) leaked in 1 allocation(s).

'''

./Browser/firefox.real: symbol lookup error: /usr/lib/x86_64-linux-gnu/libhogweed.so.4: undefined symbol: gmpz_limbs_read

seems to trigger that. I wonder whether that's another part of our struggle to ship the proper libs with Tor Browser and only use those libs if there aren't newer versions on the system where Tor Browser is running.

Mike, do you see a similar undefined symbol error in your termina?

Trac:
Cc: N/A to boklm

Attaching gdb to the asan build, there is first the following issue:

Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
0x00007f64a379ebf9 in __GI___poll (fds=0x6040004ae110, nfds=6, timeout=-1) at ../sysdeps/unix/sysv/linux/poll.c:29
29	../sysdeps/unix/sysv/linux/poll.c: No such file or directory.
(gdb) bt
#0  0x00007f64a379ebf9 in __GI___poll (fds=0x6040004ae110, nfds=6, timeout=-1) at ../sysdeps/unix/sysv/linux/poll.c:29
#1  0x00007f64a48140b4 in poll () from ./Browser/TorBrowser/Tor/libasan.so.3
#2  0x00007f649083acef in PollWrapper (ufds=0x6040004ae110, nfsd=6, timeout_=-1) at /var/tmp/build/firefox-124fa904c4b2/widget/gtk/nsAppShell.cpp:53
#3  0x00007f649d675439 in ?? () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#4  0x00007f649d67554c in g_main_context_iteration () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#5  0x00007f649083ae4f in nsAppShell::ProcessNextNativeEvent (this=<optimized out>, mayWait=<optimized out>)
    at /var/tmp/build/firefox-124fa904c4b2/widget/gtk/nsAppShell.cpp:295
#6  0x00007f64907b0f5d in nsBaseAppShell::DoProcessNextNativeEvent (this=this@entry=0x608000022e20, mayWait=<optimized out>)
    at /var/tmp/build/firefox-124fa904c4b2/widget/nsBaseAppShell.cpp:139
#7  0x00007f64907b140a in nsBaseAppShell::OnProcessNextEvent (this=0x608000022e20, thr=0x60e0000264c0, mayWait=<optimized out>)
    at /var/tmp/build/firefox-124fa904c4b2/widget/nsBaseAppShell.cpp:290
#8  0x00007f648ba40f86 in nsThread::ProcessNextEvent (this=0x60e0000264c0, aMayWait=<optimized out>, aResult=<optimized out>)
    at /var/tmp/build/firefox-124fa904c4b2/xpcom/threads/nsThread.cpp:952
#9  0x00007f648ba59842 in NS_ProcessNextEvent (aThread=aThread@entry=0x60e0000264c0, aMayWait=aMayWait@entry=true)
    at /var/tmp/build/firefox-124fa904c4b2/xpcom/threads/nsThreadUtils.cpp:517
#10 0x00007f648c4a3cc2 in mozilla::ipc::MessagePump::Run (this=0x606000122d80, aDelegate=0x61400001e040) at /var/tmp/build/firefox-124fa904c4b2/ipc/glue/MessagePump.cpp:125
#11 0x00007f648c426586 in MessageLoop::RunInternal (this=<optimized out>) at /var/tmp/build/firefox-124fa904c4b2/ipc/chromium/src/base/message_loop.cc:326
#12 MessageLoop::RunHandler (this=<optimized out>) at /var/tmp/build/firefox-124fa904c4b2/ipc/chromium/src/base/message_loop.cc:319
#13 MessageLoop::Run (this=<optimized out>) at /var/tmp/build/firefox-124fa904c4b2/ipc/chromium/src/base/message_loop.cc:299
#14 0x00007f64907a8149 in nsBaseAppShell::Run (this=0x608000022e20) at /var/tmp/build/firefox-124fa904c4b2/widget/nsBaseAppShell.cpp:157
#15 0x00007f6492ece006 in nsAppStartup::Run (this=0x607000058690) at /var/tmp/build/firefox-124fa904c4b2/toolkit/components/startup/nsAppStartup.cpp:290
#16 0x00007f64930666b0 in XREMain::XRE_mainRun (this=this@entry=0x7ffe06f1bfc0) at /var/tmp/build/firefox-124fa904c4b2/toolkit/xre/nsAppRunner.cpp:5372
#17 0x00007f64930691f9 in XREMain::XRE_main (this=this@entry=0x7ffe06f1bfc0, argc=argc@entry=1, argv=argv@entry=0x7ffe06f1d428, aConfig=...)
    at /var/tmp/build/firefox-124fa904c4b2/toolkit/xre/nsAppRunner.cpp:5517
#18 0x00007f6493069d9e in XRE_main (argc=1, argv=<optimized out>, aConfig=...) at /var/tmp/build/firefox-124fa904c4b2/toolkit/xre/nsAppRunner.cpp:5609
#19 0x000055613d01e1d9 in do_main (argc=1, argv=0x7ffe06f1d428, envp=<optimized out>) at /var/tmp/build/firefox-124fa904c4b2/browser/app/nsBrowserApp.cpp:231
#20 0x000055613d01cae0 in main (argc=1, argv=0x7ffe06f1d428, envp=0x7ffe06f1d438) at /var/tmp/build/firefox-124fa904c4b2/browser/app/nsBrowserApp.cpp:304

Trac:
Username: reportUrl
Status: needs_information to new
Keywords: tbb.8.0-issues deleted, tbb-8.0-issues added

I also have this problem using Fedora 28 & 29 on two different machines. I think it started a few releases ago, it must be for 3-4 months now, currently using 8.0.4. I can reliably make TBB crash by hitting Ctrl+P / File...Print. I can safely go to File...Print Preview, and the preview is generated fine, but if I click Page Setup or Print, it crashes. It doesn't matter if the printer is turned on or not. I'm not a developer, sorry I can't provide more technical details.

Trac:
Username: wert

What do you see for objdump -T /usr/lib/i386-linux-gnu/libgmp.so.10.3.2|grep limbs? (this is the location on debian, it may differ on fedora)

0001c9c0 g    DF .text  0000003a  Base        __gmpz_limbs_write
0001c920 g    DF .text  00000046  Base        __gmpz_limbs_finish
000189f0 g    DF .text  00000284  Base        __gmpz_prodlimbs
0001c9b0 g    DF .text  00000008  Base        __gmpz_limbs_read
0001c970 g    DF .text  0000003a  Base        __gmpz_limbs_modify

If it is OS related it should be reported upstream. gmp only had one commit since Fedora 26.

Similar issues were reported for debian and slackware years ago

• #746216: libhogweed.so.2: undefined reference to `__gmpz_limbs_modify'
• #753423: libhogweed.so.2: undefined symbol: __gmpn_cnd_add_n
• Slackware 14.2: libhogweed.so.4: undefined symbol: __gmpn_cnd_sub_n

Jaym was missing a definition for gmpz_limbs_read as evidenced by the following error:

symbol lookup error: /usr/lib/x86_64-linux-gnu/libhogweed.so.4: undefined symbol: gmpz_limbs_read

Today looking more closely above I realized I could get feedback in the terminal if I start TBB with Browser/firefox instead of Browser/start-tor-browser. So, here's what I get (using Fedora 29 with Gnome 3.30.2):

$ /home/xxxx/.local/share/torbrowser/tbb/x86_64/tor-browser_en-US/Browser/firefox
Jan 13 08:59:58.883 [notice] Tor 0.3.4.9 (git-4ac3ccf2863b86e7) running on Linux with Libevent 2.1.8-stable, OpenSSL 1.0.2q, Zlib 1.2.11, Liblzma N/A, and Libzstd N/A.
Jan 13 08:59:58.883 [notice] Tor can't help you if you use it wrong! Learn how to be safe at https://www.torproject.org/download/download#warning
Jan 13 08:59:58.883 [notice] Read configuration file "/home/xxxx/.local/share/torbrowser/tbb/x86_64/tor-browser_en-US/Browser/TorBrowser/Data/Tor/torrc-defaults".
Jan 13 08:59:58.883 [notice] Read configuration file "/home/xxxx/.local/share/torbrowser/tbb/x86_64/tor-browser_en-US/Browser/TorBrowser/Data/Tor/torrc".
Jan 13 08:59:58.887 [notice] Scheduler type KIST has been enabled.
Jan 13 08:59:58.887 [notice] Opening Socks listener on 127.0.0.1:9150
Jan 13 08:59:58.887 [notice] Opening Control listener on 127.0.0.1:9151
Jan 13 08:59:58.000 [notice] Parsing GEOIP IPv4 file /home/xxxx/.local/share/torbrowser/tbb/x86_64/tor-browser_en-US/Browser/TorBrowser/Data/Tor/geoip.
Jan 13 08:59:58.000 [notice] Parsing GEOIP IPv6 file /home/xxxx/.local/share/torbrowser/tbb/x86_64/tor-browser_en-US/Browser/TorBrowser/Data/Tor/geoip6.
Jan 13 08:59:59.000 [notice] Bootstrapped 0%: Starting
Jan 13 08:59:59.000 [notice] Starting with guard context "default"
Jan 13 08:59:59.000 [notice] Bootstrapped 80%: Connecting to the Tor network
Jan 13 08:59:59.000 [notice] New control connection opened from 127.0.0.1.
Jan 13 08:59:59.000 [notice] New control connection opened from 127.0.0.1.
1547369999870	addons.webextension.{73a6fe31-595d-460b-a920-fcc0f8843232}	WARN	Loading extension '{73a6fe31-595d-460b-a920-fcc0f8843232}': Reading manifest: Error processing background.persistent: Event pages are not currently supported. This will run as a persistent background page.
1547370000039	addons.webextension.https-everywhere-eff@eff.org	WARN	Please specify whether you want browser_style or not in your browser_action options.
1547370000039	addons.webextension.{73a6fe31-595d-460b-a920-fcc0f8843232}	WARN	Please specify whether you want browser_style or not in your browser_action options.
Jan 13 09:00:00.000 [notice] Bootstrapped 85%: Finishing handshake with first hop
Jan 13 09:00:01.000 [notice] Bootstrapped 90%: Establishing a Tor circuit
Jan 13 09:00:03.000 [notice] Tor has successfully opened a circuit. Looks like client functionality is working.
Jan 13 09:00:03.000 [notice] Bootstrapped 100%: Done
Jan 13 09:00:06.000 [notice] New control connection opened from 127.0.0.1.
Jan 13 09:00:06.000 [notice] New control connection opened from 127.0.0.1.
JavaScript error: chrome://global/content/browser-child.js, line 359: NS_ERROR_NOT_AVAILABLE: Component returned failure code: 0x80040111 (NS_ERROR_NOT_AVAILABLE) [nsIWebNavigation.loadURIWithOptions]
JavaScript error: chrome://global/content/browser-child.js, line 359: NS_ERROR_NOT_AVAILABLE: Component returned failure code: 0x80040111 (NS_ERROR_NOT_AVAILABLE) [nsIWebNavigation.loadURIWithOptions]

(firefox:10865): Gtk-WARNING **: 09:02:27.150: /lib64/libhogweed.so.4: undefined symbol: __gmpn_cnd_sub_n

(firefox:10865): Gtk-WARNING **: 09:02:27.157: /lib64/libhogweed.so.4: undefined symbol: __gmpn_cnd_sub_n
Jan 13 09:02:27.000 [notice] Owning controller connection has closed -- exiting now.
Jan 13 09:02:27.000 [notice] Catching signal TERM, exiting cleanly.
Crash Annotation GraphicsCriticalError: |[C0][GFX1-]: Receive IPC close with reason=AbnormalShutdown (t=131.831) Segmentation fault (core dumped)

Following traumschule's suggestion with objdump I get:

# objdump -T /home/xxxx/.local/share/torbrowser/tbb/x86_64/tor-browser_en-US/Browser/TorBrowser/Tor/libgmp.so.10 | grep gmpn_cnd_sub_n
# objdump -T /usr/lib64/libgmp.so.10.3.2 | grep gmpn_cnd_sub_n
0000000000029700 g    DF .text	0000000000000136  Base        __gmpn_cnd_sub_n
# objdump -T /usr/lib64/libgmp.so.10 | grep gmpn_cnd_sub_n
0000000000029700 g    DF .text	0000000000000136  Base        __gmpn_cnd_sub_n

If I understand this right, gmpn_cnd_sub_n is defined locally but not in TBB. Hope this helps. (If this is an upstream or elsewhere thing, please let me know.)

Trac:
Username: wert2

Replying to wert2:

If I understand this right, gmpn_cnd_sub_n is defined locally but not in TBB. Hope this helps. (If this is an upstream or elsewhere thing, please let me know.)

Okay, I'm hitting this now, too. Fedora 29.

(firefox:2105): Gtk-WARNING **: 02:17:31.932: /lib64/libhogweed.so.4: undefined symbol: __gmpn_cnd_sub_n

(firefox:2105): Gtk-WARNING **: 02:17:31.939: /lib64/libhogweed.so.4: undefined symbol: __gmpn_cnd_sub_n
Jan 14 02:17:36.000 [notice] Owning controller connection has closed -- exiting now.
Jan 14 02:17:36.000 [notice] Catching signal TERM, exiting cleanly.
./tor-browser_en-US/Browser/start-tor-browser: line 373:  2105 Segmentation fault      (core dumped) TOR_CONTROL_PASSWD=${TOR_CONTROL_PASSWD} ./firefox --class "Tor Browser" -profile TorBrowser/Data/Browser/profile.default "${@}" < /dev/null
[Child 2230, Chrome_ChildThread] WARNING: pipe error (3): Connection reset by peer: file /var/tmp/build/firefox-efdff96e8955/ipc/chromium/src/chrome/common/ipc_channel_posix.cc, line 353

Interestingly, I'm seeing the same missing symbol as wert2 (__gmpn_cnd_sub_n), but a different missing symbol than Jaym (gmpz_limbs_read), probably different Tor Browser releases. But, either way, it seems like this is another instance where the system provides a newer version of the library. I'm guessing Debian Wheezy is providing a particularly old version of gmp now.

Replying to sysrqb:

Replying to wert2:

If I understand this right, gmpn_cnd_sub_n is defined locally but not in TBB. Hope this helps. (If this is an upstream or elsewhere thing, please let me know.)

Okay, I'm hitting this now, too. Fedora 29.

{{{ (firefox:2105): Gtk-WARNING **: 02:17:31.932: /lib64/libhogweed.so.4: undefined symbol: __gmpn_cnd_sub_n

(firefox:2105): Gtk-WARNING **: 02:17:31.939: /lib64/libhogweed.so.4: undefined symbol: __gmpn_cnd_sub_n Jan 14 02:17:36.000 [notice] Owning controller connection has closed -- exiting now. Jan 14 02:17:36.000 [notice] Catching signal TERM, exiting cleanly. ./tor-browser_en-US/Browser/start-tor-browser: line 373: 2105 Segmentation fault (core dumped) TOR_CONTROL_PASSWD=

{TOR_CONTROL_PASSWD} ./firefox --class "Tor Browser" -profile TorBrowser/Data/Browser/profile.default "

{@}" < /dev/null [Child 2230, Chrome_ChildThread] WARNING: pipe error (3): Connection reset by peer: file /var/tmp/build/firefox-efdff96e8955/ipc/chromium/src/chrome/common/ipc_channel_posix.cc, line 353 }}}

Interestingly, I'm seeing the same missing symbol as wert2 (__gmpn_cnd_sub_n), but a different missing symbol than Jaym (gmpz_limbs_read), probably different Tor Browser releases. But, either way, it seems like this is another instance where the system provides a newer version of the library. I'm guessing Debian Wheezy is providing a particularly old version of gmp now.

No, we compile that ourselves and only for FTE's sake if I see that correctly. I guess we can bump the lib version until we fully remove FTE support. Or maybe that's the final nail in the FTE coffin and we remove it and all of its dependencies before we do #26920 (moved).

Trac:
Keywords: N/A deleted, TorBrowserTeam201901, tbb-rbm added

As we only need our build of libgmp.so for FTE, maybe we could have an FTE specific LD_LIBRARY_PATH directory containing libgmp.so (for instance by replacing Browser/TorBrowser/Tor/PluggableTransports/fteproxy.bin by a wrapper script adding this diretory to LD_LIBRARY_PATH), and removing it from the general LD_LIBRARY_PATH.

Replying to boklm:

As we only need our build of libgmp.so for FTE, maybe we could have an FTE specific LD_LIBRARY_PATH directory containing libgmp.so (for instance by replacing Browser/TorBrowser/Tor/PluggableTransports/fteproxy.bin by a wrapper script adding this diretory to LD_LIBRARY_PATH), and removing it from the general LD_LIBRARY_PATH.

Works for me.

Replying to gk:

Replying to boklm:

As we only need our build of libgmp.so for FTE, maybe we could have an FTE specific LD_LIBRARY_PATH directory containing libgmp.so (for instance by replacing Browser/TorBrowser/Tor/PluggableTransports/fteproxy.bin by a wrapper script adding this diretory to LD_LIBRARY_PATH), and removing it from the general LD_LIBRARY_PATH.

Works for me.

However, that would not solve the underlying issue and FTE users could potentially be hitting it.

Replying to gk:

However, that would not solve the underlying issue and FTE users could potentially be hitting it.

If I understand the underlying issue correctly, it is that on some systems a library used by gtk is requiring a version of libgmp more recent than the one we ship, but our version is used because it is in LD_LIBRARY_PATH. If we remove libgmp from the LD_LIBRARY_PATH used by the firefox process, then the system version of libgmp will be used by the print dialog, which should solve the issue. The fteproxy process will still have our build of libgmp in its LD_LIBRARY_PATH, however as fteproxy is probably not linked to gtk, it should not be an issue.

Replying to boklm:

Replying to gk:

However, that would not solve the underlying issue and FTE users could potentially be hitting it.

If I understand the underlying issue correctly, it is that on some systems a library used by gtk is requiring a version of libgmp more recent than the one we ship, but our version is used because it is in LD_LIBRARY_PATH. If we remove libgmp from the LD_LIBRARY_PATH used by the firefox process, then the system version of libgmp will be used by the print dialog, which should solve the issue. The fteproxy process will still have our build of libgmp in its LD_LIBRARY_PATH, however as fteproxy is probably not linked to gtk, it should not be an issue.

Yes, I think that's a good summary and you are right.