464186 - Closing Gmail crashes Firefox @ libnssutil3.so@0x77ca

Status: RESOLVED WORKSFORME

(Core Graveyard :: Security: UI, defect)

Description

[Benjamin Scott]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.3) Gecko/2008092416 Firefox/3.0.3
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.3) Gecko/2008092416 Firefox/3.0.3

Firefox crashes when I close Gmail.  "Close Gmail" can be signing out, or navigating away to a different page, or closing the tab/window/browser.  If other windows would still be present, they hang around for a second, and then crash.  If closing Gmail meant closing the last window, Firefox will appear to close, but then I get the crash reporting dialog anyway.

Occurs in both Firefox 3.0.3 and 3.1b2pre nightly build downloaded 10 Nov 2008.  Both "official" Mozilla tarballs, not a third-party build or package.

Fedora Linux 8, kernel 2.6.25.14-69.fc8, glibc 2.7-2.

Very reproducible -- happens practically every time.  Very occasionally it doesn't crash -- maybe 1 in 10 or 20 times.

Tried clearing all personal data (cache, cookies, history, etc.) except saved passwords; didn't help.

I did have a number of add-ons installed, including Firebug and Greasemonkey.  But I disabled all addons, restarted Firefox, and the trouble continues.  I've been running with no addons for a day now, and have seen quite a few crashes.  So simply disabling addons doesn't fix it.

However, creating another user profile in Firefox and testing with *that* seems okay.  So it would appear something specific to my regular user profile is hitting a crash bug.

Almost all the crash reports come back with "@ libnssutil3.so@0x77ca" in the title, so that seems to be a common theme.

The crashes have been happening for at least a week.  I've also been seeing sporadic SSL errors in the past day or two; not sure if that's related.

Please let me know if there is anything I can do to help debug this issue.  I don't know much of anything about Firefox development/debugging, but I regard myself as a pretty competent sysadmin, so if you give me pointers to instructions I expect I will be able to follow them.


Reproducible: Always

Steps to Reproduce:
1. Open Gmail
2. Close Gmail
3. Wait a second or so
4. Crash




Crash report IDs for 3.1b2pre:
381c1b88-52a6-4bab-8e38-9d0720081110
9bfcefcd-e1df-40d1-9e7c-feff20081110

Crash report IDs for 3.0.3:
d7af045c-aec9-11dd-a147-001a4bd43e5c
de758e73-aec7-11dd-9bc9-001321b13766
ccdb7594-aec7-11dd-95b1-001cc45a2c28
6de20563-aec7-11dd-b817-001321b13766
c6e9ba97-aec5-11dd-b777-001cc45a2ce4
439db211-ae86-11dd-a7bb-001cc4e2bf68
eb990a19-ae85-11dd-b2f3-001321b13766
d6923575-ae85-11dd-84c7-001cc45a2ce4

Comment 1

[timeless]

most of your crashes come from:
nsNSSComponent::RandomUpdate

except:
nsNSSComponent::UnloadLoadableRoots
bp-439db211-ae86-11dd-a7bb-001cc4e2bf68

nsCryptoHash::Init
bp-eb990a19-ae85-11dd-b2f3-001321b13766
bp-d6923575-ae85-11dd-84c7-001cc45a2ce4

nodata
bp-c6e9ba97-aec5-11dd-b777-001cc45a2ce4

can you run firefox and load /proc/{pid-of firefox-bin}/maps
I'd like to know where the nss3 libraries come from. if they come from /usr/lib and the rest of mozilla doesn't, then you'll have to try to do something about that.

Comment 2

[Benjamin Scott]

It looks like the nss3 libraries are coming from the same directory as the rest of Mozilla, for both 3.0.3 and 3.1.  It's getting libnss_dns and libnss_files from /lib/, but I assume that's the normal *nix name service switch, and not something to do with Mozilla.  I'll attach extracts from the maps files for completeness.

Unrelated: I should probably mention that I'm current with all the latest Fedora updates.

Comment 3

[Benjamin Scott]

Attachment: libraries loaded by Firefox 3.0.3 (extracted from /proc/.../maps/)

Comment 4

[Benjamin Scott]

Attachment: libraries loaded by Firefox 3.1b2pre (extracted from /proc/.../maps/)

Comment 5

[Benjamin Scott]

Elsewhere, someone suggested I try removing the SSL files from my profile.  I'm not exactly sure what that means, but I tried moving files matching patterns (*key* *cert* *sec*) from my profile and then starting Firefox.  Crash still happens.  I moved them back after testing that (overwriting the new ones that got created).

Comment 6

[timeless]

why don't we have symbols for nss? :(

Comment 8

[(not currently active) Ted Mielczarek]

Could be a dupe of bug 499455, hard to tell unless someone can repro on a debug build or something.

Comment 9

[Benjamin Scott]

The crash stopped happening when I switched the host system from Fedora to Ubuntu.  (Not for any particular reason; I just like to try different distributions.)  I kept the same home directory, so it's all the same Firefox config files.  "rpm -Va" doesn't find anything wrong with the Feodra system.  So whatever this is, it's being triggered by the combination of something in my Firefox user profile *and* something about Fedora (if not Fedora 8 or my install in particular).  That's sufficiently esoteric that it might be best to close this bug and worry about more important things, although I'll leave that up to better minds than me.  If there's anything anyone would like me to try, let me know.  I've still got that Fedora install around.

Comment 10

[Johnathan Nightingale [:johnath]]

Thanks for the update, Benjamin. I understand why this is starting to seem sufficiently like a blind alley that you're inclined to write it off. I don't know the details of Fedora's packaging process, but I know that some distros will build their own versions of Firefox and sometimes independently build their own NSS. If you have energy enough to do so, I might recommend filing a bug with Fedora's bug tracker, to make sure they know about it, since it does sound like it might be specific to their packaging.

Comment 11

[Benjamin Scott]

I was actually running an "official" Mozilla build, tarball download, running out of /opt/firefox/, and had verified that it was loading its Mozilla libraries from there and not from Fedora's Firefox build.  So whatever it is, it isn't that.  :)

Comment 12

[Johnathan Nightingale [:johnath]]

Bah.  :)

Comment 13

[Jesse Ruderman]

Benjamin, want to try reproducing this under Valgrind?  That often turns randomly-crashes bugs into clear bugs.  You might have to make your own Firefox build to get useful symbols out of Valgrind, though.

Comment 14

[Jesse Ruderman]

Oh, I missed the comment where you can't reproduce this bug any more.  I'll just mark this as incomplete.  Bug 468701 covers getting NSS symbols, and I've marked it as sg:want because it interferes with figuring out bug reports like this one.