[tor-bugs] #27815 [Applications/Tor Browser]: Killing firefox.real child at ~100% load caused parent to segfault

[Tor Bug Tracker & Wiki]

#27815: Killing firefox.real child at ~100% load caused parent to segfault
--------------------------------------+--------------------------
 Reporter:  traumschule               |          Owner:  tbb-team
     Type:  defect                    |         Status:  new
 Priority:  Medium                    |      Milestone:
Component:  Applications/Tor Browser  |        Version:
 Severity:  Normal                    |     Resolution:
 Keywords:                            |  Actual Points:
Parent ID:                            |         Points:
 Reviewer:                            |        Sponsor:
--------------------------------------+--------------------------

Comment (by traumschule):

 In comparison this was a requested exit of Tor Browser 8.5a1:

 {{{
 Sep 22 03:12:06.000 [info] {CONTROL} connection_control_reached_eof():
 Control connection reached EOF. Closing.
 Sep 22 03:12:06.000 [notice] {CONTROL} Owning controller connection has
 closed -- exiting now.
 Sep 22 03:12:06.000 [notice] {GENERAL} Catching signal TERM, exiting
 cleanly.
 Sep 22 03:12:06.000 [notice] {CONTROL} Owning controller connection has
 closed -- exiting now.
 Sep 22 03:12:06.000 [notice] {GENERAL} Catching signal TERM, exiting
 cleanly.
 Sep 22 03:12:06.000 [info] {GENERAL} or_state_save(): Saved state to
 "/path/to/tor-browser_en-US/Browser/TorBrowser/Data/Tor/state"
 JavaScript error: jar:file:///path/to/tor-browser_en-
 US/Browser/omni.ja!/components/nsAsyncShutdown.js, line 114: Error: We
 have already registered a distinct blocker with the same name: Crash
  Reporter: blocking on minidumpgeneration.
 JavaScript error: chrome://torbutton/content/tor-circuit-display.js, line
 466: TypeError: myController is null
 Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 352) has
 been freed.
 Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 366) has
 been freed.
 Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 365) has
 been freed.
 Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 364) has
 been freed.
 Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 363) has
 been freed.
 Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 362) has
 been freed.
 Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 361) has
 been freed.
 Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 360) has
 been freed.
 Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 359) has
 been freed.
 Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 368) has
 been freed.
 Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 357) has
 been freed.
 Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 356) has
 been freed.
 Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 367) has
 been freed.
 Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 354) has
 been freed.
 Sep 22 03:12:17.000 [info] {CIRC} circuit_free_(): Circuit 0 (id: 353) has
 been freed.
 Sep 22 03:12:17.000 [info] {REND} hs_purge_last_hid_serv_requests():
 Purging client last-HS-desc-request-time table
 Sep 22 03:12:17.000 [info] {FS} tor_lockfile_unlock(): Unlocking "/path/to
 /tor-browser_en-US/Browser/TorBrowser/Data/Tor/lock"
 JavaScript error: resource:///modules/sessionstore/SessionSaver.jsm, line
 180: NS_ERROR_FAILURE: Component returned failure code: 0x80004005
 (NS_ERROR_FAILURE) [nsIAppShellService.hiddenDOMWindow]
 WARNING: At least one completion condition is taking too long to complete.
 Conditions: [{"name":"Crash Reporter: blocking on
 minidumpgeneration.","state":"(none)","filename":"/var/tmp/build/firefox-1
 24fa904c4b2/ipc/glue/CrashReporterHost.cpp","lineNumber":189,"stack":"Minidump
 generation"}] Barrier: profile-before-change
 tbb at t43:~$ kill FATAL ERROR: AsyncShutdown timeout in profile-before-
 change Conditions: [{"name":"Crash Reporter: blocking on
 minidumpgeneration.","state":"(none)","filename":"/var/tmp/build/firefox-
 124fa904c4b2/ipc/glue/CrashReporterHost.cpp","lineNumber":189,"stack":"Minidump
 generation"}] At least one completion condition failed to complete within
 a reasonable amount of time. Causing a crash
 to ensure that we do not leave the user with an unresponsive process
 draining resources.
 WARNING: No crash reporter available
 [Parent 13849, Main Thread] ###!!! ABORT: file /var/tmp/build/firefox-
 124fa904c4b2/ipc/glue/CrashReporterHost.cpp, line 189
 [Parent 13849, Main Thread] ###!!! ABORT: file /var/tmp/build/firefox-
 124fa904c4b2/ipc/glue/CrashReporterHost.cpp, line 189
 ./Browser/start-tor-browser: line 375: 13849 Segmentation fault
 TOR_CONTROL_PASSWD=${TOR_CONTROL_PASSWD} ./firefox --class "Tor Browser"
 -profile TorBrowser/Data/Browser/profile.default "${@}" < /dev/null
 }}}

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/27815#comment:1>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online