[tor-bugs] #5710 [Firefox Patch Issues]: Fix/Report SessionStore leakage

[Tor Bug Tracker & Wiki]

#5710: Fix/Report SessionStore leakage
----------------------------------+-----------------------------------------
 Reporter:  mikeperry             |          Owner:  mikeperry
     Type:  defect                |         Status:  new      
 Priority:  critical              |      Milestone:           
Component:  Firefox Patch Issues  |        Version:           
 Keywords:  MikePerry201205       |         Parent:           
   Points:                        |   Actualpoints:           
----------------------------------+-----------------------------------------

Comment(by cypherpunks):

 Replying to [comment:5 mikeperry]:
 > cypherpunks: Pretty sure the nsSessionStore.js file has all the
 observers that cause it to write stuff at various browser events (such as
 final-ui-shutdown, etc).

 This isn't very helpful, nsSessionStore.js is >4000 lines long and it
 doesn't contain the string "final-ui-shutdown". I was able to find the
 function "sss_saveStateObject" in
 /FirefoxPortable/App/Firefox/components/nsSessionStore.js and to see if I
 can get things going I put some code inside the function body to spawn a
 random exe. All worked as expected and I saw the exe launched during
 shutdown, but to my total amazement I can't get rid of this hack now. I
 have restored the original nsSessionStore.js without my app-launching code
 and it still launches the exe on shutdown. WHAT THE FUCK? Some caching
 mechanism that I'm unaware of?

 Anyway, if you could provide some code to dump the stack and other
 information necessary to diagnose what and why calls this function, that
 would be helpful. Perhaps you could just chuck out sss_saveStateObject and
 be done with this bug, removing scary stuff is always safer than playing
 whack-a-mole with preferences and fancy filters.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/5710#comment:7>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online