[tbb-bugs] #17102 [Tor Browser]: Second open Tor Browser crash on shutdown

[Tor Bug Tracker & Wiki]

#17102: Second open Tor Browser crash on shutdown
---------------------------------------------+--------------------------
 Reporter:  arthuredelstein                  |          Owner:  tbb-team
     Type:  defect                           |         Status:  new
 Priority:  normal                           |      Milestone:
Component:  Tor Browser                      |        Version:
 Keywords:  tbb-crash, TorBrowserTeam201509  |  Actual Points:
Parent ID:                                   |         Points:
---------------------------------------------+--------------------------
 If I open one Tor Browser, and then I open a second, it correctly shows
 the error message "A copy of Nightly is already open. Only one copy of
 Nightly can be open at a time." But then the second TBB crashes. Here's
 the stack trace:
 {{{
 * thread #1: tid = 0x1fe37a, 0x0000000102bf0156
 XUL`ThirdPartyUtil::GetFirstPartyHost(aChannel=0x0000000000000000,
 aDocument=0x00000001133d6000, aResult=0x00007fff5fbfdbf8) + 86 at
 ThirdPartyUtil.cpp:47, queue = 'com.apple.main-thread, stop reason =
 EXC_BAD_ACCESS (code=1, address=0x0)
     frame #0: 0x0000000102bf0156
 XUL`ThirdPartyUtil::GetFirstPartyHost(aChannel=0x0000000000000000,
 aDocument=0x00000001133d6000, aResult=0x00007fff5fbfdbf8) + 86 at
 ThirdPartyUtil.cpp:47
    44       CallGetService(THIRDPARTYUTIL_CONTRACTID,
 &gThirdPartyUtilService);
    45     }
    46     nsCOMPtr<nsIURI> isolationURI;
 -> 47     nsresult rv =
 gThirdPartyUtilService->GetFirstPartyIsolationURI(aChannel, aDocument,
 getter_AddRefs(isolationURI));
    48     NS_ENSURE_SUCCESS(rv, rv);
    49     if (!isolationURI) {
    50       // Isolation is not active.
 (lldb) bt
 * thread #1: tid = 0x1fe37a, 0x0000000102bf0156
 XUL`ThirdPartyUtil::GetFirstPartyHost(aChannel=0x0000000000000000,
 aDocument=0x00000001133d6000, aResult=0x00007fff5fbfdbf8) + 86 at
 ThirdPartyUtil.cpp:47, queue = 'com.apple.main-thread, stop reason =
 EXC_BAD_ACCESS (code=1, address=0x0)
     frame #0: 0x0000000102bf0156
 XUL`ThirdPartyUtil::GetFirstPartyHost(aChannel=0x0000000000000000,
 aDocument=0x00000001133d6000, aResult=0x00007fff5fbfdbf8) + 86 at
 ThirdPartyUtil.cpp:47
     frame #1: 0x0000000102c4a48a
 XUL`ThirdPartyUtil::GetFirstPartyHost(aDocument=0x00000001133d6000,
 aResult=0x00007fff5fbfdbf8) + 42 at ThirdPartyUtil.h:36
     frame #2: 0x0000000102c8f7c5
 XUL`nsDocument::cycleCollection::Unlink(this=0x0000000109af2a80,
 p=0x00000001133d6000) + 1237 at nsDocument.cpp:2166
     frame #3: 0x0000000103f4c2cd
 XUL`nsHTMLDocument::cycleCollection::Unlink(this=0x0000000109af2a80,
 p=0x00000001133d6000) + 61 at nsHTMLDocument.cpp:203
     frame #4: 0x000000010161aa92
 XUL`nsCycleCollector::CollectWhite(this=0x0000000111597000) + 882 at
 nsCycleCollector.cpp:3297
     frame #5: 0x000000010161c196
 XUL`nsCycleCollector::Collect(this=0x0000000111597000, aCCType=ShutdownCC,
 aBudget=0x00007fff5fbfde08, aManualListener=0x0000000000000000,
 aPreferShorterSlices=false) + 534 at nsCycleCollector.cpp:3648
     frame #6: 0x000000010161bf18
 XUL`nsCycleCollector::ShutdownCollect(this=0x0000000111597000) + 88 at
 nsCycleCollector.cpp:3575
     frame #7: 0x000000010161cf63
 XUL`nsCycleCollector::Shutdown(this=0x0000000111597000) + 51 at
 nsCycleCollector.cpp:3857
     frame #8: 0x000000010161e535 XUL`nsCycleCollector_shutdown() + 181 at
 nsCycleCollector.cpp:4290
     frame #9: 0x0000000101767d43
 XUL`mozilla::ShutdownXPCOM(aServMgr=0x0000000000000000) + 1587 at
 XPCOMInit.cpp:1016
     frame #10: 0x0000000101767705
 XUL`NS_ShutdownXPCOM(aServMgr=0x00000001003253d8) + 21 at
 XPCOMInit.cpp:863
     frame #11: 0x00000001056407aa
 XUL`ScopedXPCOMStartup::~ScopedXPCOMStartup(this=0x00007fff5fbfe320) + 234
 at nsAppRunner.cpp:1348
     frame #12: 0x00000001056406b5
 XUL`ScopedXPCOMStartup::~ScopedXPCOMStartup(this=0x00007fff5fbfe320) + 21
 at nsAppRunner.cpp:1329
     frame #13: 0x000000010564b121
 XUL`ProfileErrorDialog(aProfileDir=0x00000001003f4800,
 aProfileLocalDir=0x00000001003f4800, aStatus=PROFILE_STATUS_IS_LOCKED,
 aUnlocker=0x0000000000000000, aNative=0x000000011151a8a0,
 aResult=0x00007fff5fbfef80) + 2689 at nsAppRunner.cpp:2087
     frame #14: 0x000000010564573f
 XUL`SelectProfile(aResult=0x00007fff5fbfef80,
 aProfileSvc=0x00000001003b4740, aNative=0x000000011151a8a0,
 aStartOffline=0x00007fff5fbff0c0, aProfileName=0x00007fff5fbff000) + 3375
 at nsAppRunner.cpp:2507
     frame #15: 0x0000000105643798
 XUL`XREMain::XRE_mainStartup(this=0x00007fff5fbfef60,
 aExitFlag=0x00007fff5fbfeedf) + 2104 at nsAppRunner.cpp:4056
     frame #16: 0x00000001056498ff
 XUL`XREMain::XRE_main(this=0x00007fff5fbfef60, argc=5,
 argv=0x00007fff5fbff8b0, aAppData=0x00007fff5fbff240) + 639 at
 nsAppRunner.cpp:4509
     frame #17: 0x0000000105649ebd XUL`XRE_main(argc=5,
 argv=0x00007fff5fbff8b0, aAppData=0x00007fff5fbff240, aFlags=0) + 77 at
 nsAppRunner.cpp:4743
     frame #18: 0x0000000100001d66 firefox`do_main(argc=5,
 argv=0x00007fff5fbff8b0, xreDirectory=0x0000000100320100) + 1750 at
 nsBrowserApp.cpp:294
     frame #19: 0x00000001000011f1 firefox`main(argc=5,
 argv=0x00007fff5fbff8b0) + 321 at nsBrowserApp.cpp:667
     frame #20: 0x0000000100000c54 firefox`start + 52
 }}}

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/17102>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online