455617 - Crash [@ libgobject-2.0.so.0.1600.4@0x27bfc] when canceling EULA in a fresh profile

Status: RESOLVED WORKSFORME

(Core :: General, defect)

Description

[Daniel Holbert [:dholbert]]

Steps to reproduce:
  1. Start with a nightly from 2008/09/15 or earlier
     (it looks like the EULA was completely disabled in the 9/16 nightly, so I can't reproduce it in that one)

  2. Run firefox, providing an empty directory for the profile:
         mkdir ~/deleteme; ./firefox -no-remote -profile ~/deleteme

  3. Press "Esc" when EULA appears

EXPECTED RESULTS:
 Firefox should exit, I guess. Definitely shouldn't crash.

ACTUAL RESULTS:
 Crash! (with Crash Reporter dialog appearing)

The crashes all seem to be at libgobject-2.0.so.0.1600.4@0x27bfc:
http://crash-stats.mozilla.com/report/index/e6442951-8448-11dd-9ecd-001a4bd43ed6
http://crash-stats.mozilla.com/report/index/08372375-843c-11dd-9a39-0013211cbf8a
http://crash-stats.mozilla.com/report/index/22b5e7f0-843c-11dd-96df-001cc4e2bf68
http://crash-stats.mozilla.com/report/index/77504c33-843d-11dd-ac62-001cc45a2ce4

They're all segfaulting on random addresses in the 0xb6XXXXXX range, which are non-null and hence could be scary.  Marking security-sensitive / [sg:crit?] at Jesse's advice.

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1b1pre) Gecko/20080915020438 Minefield/3.1b1pre

Comment 1

[Daniel Holbert [:dholbert]]

Note: I don't know what the future plans are for the EULA in the nightlies & official builds.  If the EULA morphs into a form other than a modal dialog (e.g. if it's just shown in a FirstRun tab), then this bug will no longer be relevant.

Comment 2

[Jesse Ruderman]

No web pages are loaded until after this window goes away, right?  I don't think we have to treat this as a security hole in that case, unless it's a more general bug that could affect windows other than the EULA window.

Comment 3

[Daniel Holbert [:dholbert]]

(In reply to comment #2)
> No web pages are loaded until after this window goes away, right?

Correct.

> I don't
> think we have to treat this as a security hole in that case, unless it's a more
> general bug that could affect windows other than the EULA window.

Yeah, I'd agree.

Comment 5

[Benjamin Smedberg]

It looks like we're processing a reflow event after we've closed the relevant window... but it's not a security issue.

Comment 6

[Daniel Holbert [:dholbert]]

See also bug 464389, a similar issue with the "Safe Mode" dialog.

Comment 7

[chris hofmann]

looks like we get a handful of these crashes each day.  is there anything that we can or want to do with this and bug 464389?

Comment 8

[Daniel Veditz [:dveditz]]

I think we close this one: we don't have the EULA dialog on any releases anymore. I don't know if safe-mode (bug 464389) accounts for all the crashes you're still seeing, but I'm sure it's not the EULA dialog so this bug is not going to go anywhere.