Closed Bug 1295990 Opened 8 years ago Closed 8 years ago

[e10s] Tab crashes if user profile is in Windows Network and userContent.css is in the profile

Categories

(Core :: Security: Process Sandboxing, defect)

Product:
Core
Component:
Security: Process Sandboxing
Version:
51 Branch
Platform:
Unspecified
Windows
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Tracking Flags:
Tracking Status
firefox48 --- affected
firefox49 --- affected
firefox-esr45 --- affected
firefox50 --- affected
firefox51 --- affected

People

(Reporter: alice0775, Unassigned)

References

Details

(Keywords: crash, Whiteboard: sbwc2,[fixed by backed out Bug 1046166])

Crash Data

* The crash does not occur if userContent.css did not exist.
* The crash does not occur with non-e10s window.


Steps To Reproduce:
1. Provide a user profile(named "aaaa") on PC1 (Windows)
3. Create userContent.css in the profile "aaaa"

4. Add a user profile(named "PC1-aaaa") on PC2 (Windows)
   and point to \\PC1\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\xxxxxxxx.aaaa
5. Start Nightly on PC2
   firefox.exe -P PC1-aaaa

Actual Results:
Tab crashes

Expected Results:
Tab should be properly loaded and also applied userContent.css

Regression window:
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=a94448be42e2b6db4630cc120a3c1bf30374451d&tochange=d1d614497fbfc0cc14cd923037ba014b1a503119

Triggered by:
d1d614497fbf	Wei-Cheng Pan — Bug 1046166 - Send userContent.css URL to content processes. r=dbaron


(I will a provide a crash report when Nightly win32 (2016-Aug-17) is successfully built)
Summary: Tab crashes if user profile was in Windows Network and userContent.css is in the profile → [e10s] Tab crashes if user profile was in Windows Network and userContent.css is in the profile
Summary: [e10s] Tab crashes if user profile was in Windows Network and userContent.css is in the profile → [e10s] Tab crashes if user profile is in Windows Network and userContent.css is in the profile
And I notice a taskbar button of runtime sanity test window(which was added by bug 1156135) remains forever.
Severity: normal → critical
Crash Signature: [@ mozalloc_abort | NS_DebugBreak | ErrorLoadingBuiltinSheet]
Bug 1211873 triggers the crash when inject userContent.css on network shares to content process.
Depends on: 1211873
Indeed, security.sandbox.content.level=1 fixes the crash. And userContent.css is applied as expected.
Component: CSS Parsing and Computation → Security: Process Sandboxing
OS: Unspecified → Windows
Whiteboard: sbwc2
The crash was fixed by backed out the offending Bug 1046166.

b4a5ab929035	Sebastian Hengst — Backed out changeset d1d614497fbf (bug 1046166) on request of developer for crashes. r=backout a=backout
Status: NEW → RESOLVED
Closed: 8 years ago
status-firefox51: affected → ---
tracking-e10s: + → ---
Resolution: --- → FIXED
Whiteboard: sbwc2 → sbwc2,[fixed by backed out Bug 1046166]
Crash volume for signature 'mozalloc_abort | NS_DebugBreak | ErrorLoadingBuiltinSheet':
 - nightly (version 51): 10 crashes from 2016-08-01.
 - aurora  (version 50): 21 crashes from 2016-08-01.
 - beta    (version 49): 13 crashes from 2016-08-02.
 - release (version 48): 36 crashes from 2016-07-25.
 - esr     (version 45): 31 crashes from 2016-05-02.

Crash volume on the last weeks (Week N is from 08-22 to 08-28):
            W. N-1  W. N-2  W. N-3
 - nightly      10       0       0
 - aurora        0       1       4
 - beta          0       0       9
 - release      13       2       0
 - esr           0       0       0

Affected platforms: Windows, Linux

Crash rank on the last 7 days:
             Browser Content     Plugin
 - nightly
 - aurora            #42
 - beta              #634
 - release           #16
 - esr
status-firefox48: --- → affected
status-firefox49: --- → affected
status-firefox50: --- → affected
status-firefox51: --- → affected
status-firefox-esr45: --- → affected
You need to log in before you can comment on or make changes to this bug.