Opened 10 months ago

Last modified 10 months ago

#27815 new defect

Killing firefox.real child at ~100% load caused parent to segfault

Reported by: traumschule Owned by: tbb-team
Priority: Medium Milestone:
Component: Applications/Tor Browser Version:
Severity: Normal Keywords:
Cc: Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

(TB 8.5a1 on debian buster 32-bit)

Another hard to reproduce issue. According to #firefox it is safe to kill any of the four content processes of the parent (Tor) Browser (easy to see with ps axjf).

There is the single parent process and then the content processes, by default 4, tabs distributed among them, then there are other misc helper processes.

In my case the rogue child was in a state that took Tor Browser as a whole with it. crash_on_exit shows:

JavaScript error: resource://gre/modules/ExtensionContent.jsm, line 489: TypeError: Argument 1 of PrecompiledScript.executeInGlobal is not an object.                                                 
JavaScript error: resource://gre/modules/ExtensionContent.jsm, line 489: TypeError: Argument 1 of PrecompiledScript.executeInGlobal is not an object.                                                 
JavaScript error: resource://gre/modules/ExtensionContent.jsm, line 489: TypeError: Argument 1 of PrecompiledScript.executeInGlobal is not an object.                                                 
JavaScript error: resource://gre/modules/ExtensionContent.jsm, line 489: TypeError: Argument 1 of PrecompiledScript.executeInGlobal is not an object.                                                 
JavaScript error: resource://gre/modules/ExtensionContent.jsm, line 489: TypeError: Argument 1 of PrecompiledScript.executeInGlobal is not an object.                                                 
console.error: (new SyntaxError("JSON.parse: unexpected character at line 1 column 2 of the JSON data", "chrome://devtools/content/framework/toolbox-process-window.js", 231))                        
Sep 17 06:11:42.000 [notice] Owning controller connection has closed -- exiting now.
Sep 17 06:11:42.000 [notice] Catching signal TERM, exiting cleanly.
JavaScript error: jar:file:///path/to/tor-browser_en-US/Browser/omni.ja!/components/nsAsyncShutdown.js, line 114: Error: We have already registered a distinct blocker with the same name: Crash Reporter: blocking on minidumpgeneration.
[Parent 27413, Gecko_IOThread] WARNING: pipe error: Broken pipe: file /var/tmp/build/firefox-124fa904c4b2/ipc/chromium/src/chrome/common/ipc_channel_posix.cc, line 709                               
JavaScript error: chrome://torbutton/content/tor-circuit-display.js, line 466: TypeError: myController is null                                                                                        
JavaScript error: resource:///modules/sessionstore/SessionSaver.jsm, line 180: NS_ERROR_FAILURE: Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsIAppShellService.hiddenDOMWindow]  
WARNING: At least one completion condition is taking too long to complete. Conditions: [{"name":"Crash Reporter: blocking on minidumpgeneration.","state":"(none)","filename":"/var/tmp/build/firefox-124fa904c4b2/ipc/glue/CrashReporterHost.cpp","lineNumber":189,"stack":"Minidump generation"}] Barrier: profile-before-change                                                                           
FATAL ERROR: AsyncShutdown timeout in profile-before-change Conditions: [{"name":"Crash Reporter: blocking on minidumpgeneration.","state":"(none)","filename":"/var/tmp/build/firefox-124fa904c4b2/ipc/glue/CrashReporterHost.cpp","lineNumber":189,"stack":"Minidump generation"}] At least one completion condition failed to complete within a reasonable amount of time. Causing a crash to ensure that we do not leave the user with an unresponsive process draining resources.
WARNING: No crash reporter available
[Parent 27413, Main Thread] ###!!! ABORT: file /var/tmp/build/firefox-124fa904c4b2/ipc/glue/CrashReporterHost.cpp, line 189                                                                           
[Parent 27413, Main Thread] ###!!! ABORT: file /var/tmp/build/firefox-124fa904c4b2/ipc/glue/CrashReporterHost.cpp, line 189                                                                           
./start-tor-browser: line 375: 27413 Segmentation fault      TOR_CONTROL_PASSWD=${TOR_CONTROL_PASSWD} ./firefox --class "Tor Browser" -profile TorBrowser/Data/Browser/profile.default "${@}" < /dev/null

I don't think that #27537 is the cause, not sure about the SyntaxError. I guess the crashreporter is blocked intentionally? myController is null reminds me that i disabled all plugins to see if the load would decrease, but it didn't so i killed the child after being told "If you kill a content process the browser should be fine, all the tabs will be in their unloaded state when you return to them".

Kept a corefile of the child for gdb enthusiasts, unfortunately not of the parent.

Child Tickets

Change History (2)

comment:1 Changed 10 months ago by traumschule

In comparison this was a requested exit of Tor Browser 8.5a1:

Sep 22 03:12:06.000 [info] {CONTROL} connection_control_reached_eof(): Control connection reached EOF. Closing.                                                                                        
Sep 22 03:12:06.000 [notice] {CONTROL} Owning controller connection has closed -- exiting now.                                                                                                        
Sep 22 03:12:06.000 [notice] {GENERAL} Catching signal TERM, exiting cleanly.
Sep 22 03:12:06.000 [notice] {CONTROL} Owning controller connection has closed -- exiting now.                                                          
Sep 22 03:12:06.000 [notice] {GENERAL} Catching signal TERM, exiting cleanly.                                                                                                                         
Sep 22 03:12:06.000 [info] {GENERAL} or_state_save(): Saved state to "/path/to/tor-browser_en-US/Browser/TorBrowser/Data/Tor/state"                                                             
JavaScript error: jar:file:///path/to/tor-browser_en-US/Browser/omni.ja!/components/nsAsyncShutdown.js, line 114: Error: We have already registered a distinct blocker with the same name: Crash
 Reporter: blocking on minidumpgeneration.                                                                                                                                                             
JavaScript error: chrome://torbutton/content/tor-circuit-display.js, line 466: TypeError: myController is null                                                                                        
Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 352) has been freed.                                                                                                                
Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 366) has been freed.                                                                                                                
Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 365) has been freed.                                                                                                                
Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 364) has been freed.                                                                                                                
Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 363) has been freed.                                                                                                                 
Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 362) has been freed.                                                                                                                 
Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 361) has been freed.                                                                                                                
Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 360) has been freed.                                                                                                                
Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 359) has been freed.                                                                                                                
Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 368) has been freed.
Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 357) has been freed.                                                                                                                
Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 356) has been freed.                                                                                                                 
Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 367) has been freed.                                                                                                                 
Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 354) has been freed.                                                                                                                
Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 353) has been freed.                                                                                                                
Sep 22 03:12:17.000 [info] {REND} hs_purge_last_hid_serv_requests(): Purging client last-HS-desc-request-time table                                                                                    
Sep 22 03:12:17.000 [info] {FS} tor_lockfile_unlock(): Unlocking "/path/to/tor-browser_en-US/Browser/TorBrowser/Data/Tor/lock"                                                                 
JavaScript error: resource:///modules/sessionstore/SessionSaver.jsm, line 180: NS_ERROR_FAILURE: Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsIAppShellService.hiddenDOMWindow]   
WARNING: At least one completion condition is taking too long to complete. Conditions: [{"name":"Crash Reporter: blocking on minidumpgeneration.","state":"(none)","filename":"/var/tmp/build/firefox-1
24fa904c4b2/ipc/glue/CrashReporterHost.cpp","lineNumber":189,"stack":"Minidump generation"}] Barrier: profile-before-change                                                                           
tbb@t43:~$ kill FATAL ERROR: AsyncShutdown timeout in profile-before-change Conditions: [{"name":"Crash Reporter: blocking on minidumpgeneration.","state":"(none)","filename":"/var/tmp/build/firefox-
124fa904c4b2/ipc/glue/CrashReporterHost.cpp","lineNumber":189,"stack":"Minidump generation"}] At least one completion condition failed to complete within a reasonable amount of time. Causing a crash
to ensure that we do not leave the user with an unresponsive process draining resources.                                                                                                               
WARNING: No crash reporter available                                                                                                                                                                   
[Parent 13849, Main Thread] ###!!! ABORT: file /var/tmp/build/firefox-124fa904c4b2/ipc/glue/CrashReporterHost.cpp, line 189                                                                           
[Parent 13849, Main Thread] ###!!! ABORT: file /var/tmp/build/firefox-124fa904c4b2/ipc/glue/CrashReporterHost.cpp, line 189
./Browser/start-tor-browser: line 375: 13849 Segmentation fault      TOR_CONTROL_PASSWD=${TOR_CONTROL_PASSWD} ./firefox --class "Tor Browser" -profile TorBrowser/Data/Browser/profile.default "${@}" < /dev/null

comment:2 Changed 10 months ago by traumschule

Another issue for segfault on exit: #12481
#18778 claims to trigger 100% load.

Last edited 10 months ago by traumschule (previous) (diff)
Note: See TracTickets for help on using tickets.