[tor-bugs] #17313 [Tor Browser]: Crash in Canvas patch seen on OS X Tor Browser

[Tor Bug Tracker & Wiki]

#17313: Crash in Canvas patch seen on OS X Tor Browser
-----------------------------+--------------------------
 Reporter:  arthuredelstein  |          Owner:  tbb-team
     Type:  defect           |         Status:  new
 Priority:  Medium           |      Milestone:
Component:  Tor Browser      |        Version:
 Severity:  Normal           |     Resolution:
 Keywords:  tbb-crash        |  Actual Points:
Parent ID:                   |         Points:
  Sponsor:                   |
-----------------------------+--------------------------
Changes (by arthuredelstein):

 * severity:   => Normal


Comment:

 I confirmed that this crash does not happen in a non-debug build (not
 optimized.) This makes sense, as VerifyIsSafeToGC(...) at jsgc.cpp:6919 is
 inside an #ifdef DEBUG clause.

 I did a few diagnostics -- it turns out that if I comment out
 `CanvasPermissionPromptHelper.init();`
 and
 `CanvasPermissionPromptHelper.uninit();`
 in [https://gitweb.torproject.org/tor-
 browser.git/diff/browser/base/content/browser.js?h=tor-
 browser-38.3.0esr-5.5-2&id=65a1a301e584d28f84879625f0dd0e8cd708e5a4
 browser/base/content/browser.js], then the crash goes away. But if instead
 I comment out only the contents of the `observe` function in
 `CanvasPermissionPromptHelper` then the crash still happens.

 Using lldb, I also found that the string apparently causing this crash is
 "canvas-permissions-prompt" (aka the observer "topic"). So it appears that
 something is going wrong in the conversion of the topic string from a
 char[] to a JS string -- maybe it's not being properly marked "safe-to-
 gc"?

 In any case, the mozilla-central string conversion code path appears to be
 somewhat different -- this bug may already be fixed there. So it may make
 sense to postpone tracking this bug down until we rebase to mozilla-
 central or FF45ESR.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/17313#comment:4>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online