Closed nike4613 closed 2 months ago
Reporting in that I too am experiencing these crashes, (From the discussions in Discord)
If I run that profile with Firefox ESR128, does the problem reproduce?
If I run that profile with Firefox ESR128, does the problem reproduce?
It honestly hadn't occurred to me that the profiles would be transferable. I'll check now.
Anyway, I should note that setting privacy.bounceTrackingProtection.enabled
to false
at least mitigates the issue.
I assume this is a Firefox ESR issue. However, I am not familiar with C and don't know how to fix it.
I'm not sure why my issue was referenced and cross linked to here, as my crashes were not "per hour" or "per profile" (I only have one profile in Floorp), but consistently every time I clicked on the selector.
If I run that profile with Firefox ESR128, does the problem reproduce?
I can't manage to repro on ESR128. I'm probably going to five it one more shot though.
I create refresh Floorp feature.
I can't read & write the C language, so I'll consider the release of this feature as a correction.
A patch has been delivered to the beta build to fix for crashes. Can anyone verify this?
(I read the C language hard and tried to fix it.)
I fixed this issue
Pre-Submission Checklist
Bug Summary
On some profiles, the main process crashes every hour. I have one profile that does, and two that don't. On the Discord, there are at least two other people who have the same problem.
I built from source for symbols, and here is the exception analysis from WinDbg:
!analyze -v
``` 0:000> !analyze -v ******************************************************************************* * * * Exception Analysis * * * ******************************************************************************* KEY_VALUES_STRING: 1 Key : AV.Dereference Value: NullPtr Key : AV.Fault Value: Read Key : Analysis.CPU.mSec Value: 1952 Key : Analysis.Elapsed.mSec Value: 3954 Key : Analysis.IO.Other.Mb Value: 0 Key : Analysis.IO.Read.Mb Value: 1363 Key : Analysis.IO.Write.Mb Value: 1361 Key : Analysis.Init.CPU.mSec Value: 1140 Key : Analysis.Init.Elapsed.mSec Value: 16778 Key : Analysis.Memory.CommitPeak.Mb Value: 1763 Key : Failure.Bucket Value: NULL_POINTER_READ_c0000005_xul.dll!mozilla::BounceTrackingProtection::PurgeBounceTrackers Key : Failure.Hash Value: {8b4b4691-d91d-97f0-279c-c1b73ee60b15} Key : Timeline.OS.Boot.DeltaSec Value: 119957 Key : Timeline.Process.Start.DeltaSec Value: 3602 Key : WER.OS.Branch Value: vb_release Key : WER.OS.Version Value: 10.0.19041.1 Key : WER.Process.Version Value: 128.1.0.4131 FILE_IN_CAB: floorp.exe.510556.dmp NTGLOBALFLAG: 0 APPLICATION_VERIFIER_FLAGS: 0 CONTEXT: (.ecxr) rax=0003001100000000 rbx=000002896e9a9d00 rcx=0000000000000000 rdx=00007fffb0cb4cca rsi=0000008f83bfee08 rdi=000002895cc38ba0 rip=00007fffb0cb4d0f rsp=0000008f83bfeca0 rbp=00000289521952f0 r8=000002894c8e1d80 r9=00007ff8c8790000 r10=00000ffff5c9b2da r11=0040005004005004 r12=0000008f83bfee58 r13=0000008f83bfee30 r14=0000000000000000 r15=000002894ebc3d18 iopl=0 nv up ei pl zr na po nc cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246 xul!mozilla::BounceTrackingState::HasBounceTrackingStateForSite+0x2bf [inlined in xul!mozilla::BounceTrackingProtection::PurgeBounceTrackers+0x91f]: 00007fff`b0cb4d0f 488b01 mov rax,qword ptr [rcx] ds:00000000`00000000=???????????????? Resetting default scope EXCEPTION_RECORD: (.exr -1) ExceptionAddress: 00007fffb0cb4d0f (xul!mozilla::BounceTrackingState::HasBounceTrackingStateForSite+0x00000000000002bf) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: 0000000000000000 Attempt to read from address 0000000000000000 PROCESS_NAME: floorp.exe READ_ADDRESS: 0000000000000000 ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s. EXCEPTION_CODE_STR: c0000005 EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: 0000000000000000 STACK_TEXT: 0000008f`83bfeca0 00007fff`b0cbc940 : 00007ff8`00000000 0000008f`00000000 00007fff`b052dfa0 00007fff`00000000 : xul!mozilla::BounceTrackingProtection::PurgeBounceTrackers+0x91f 0000008f`83bfef00 00007fff`ad2fa6fe : 00007ff8`00000000 00000289`42dd2530 00000000`00000000 00000289`42ee88c0 : xul!std::_Func_impl_no_alloc<`lambda at Y:\src\Floorp\toolkit\components\antitracking\bouncetrackingprotection\BounceTrackingProtection.cpp:159:7',void,nsITimer *>::_Do_call+0x30 0000008f`83bfef60 00007fff`ad2f7139 : 0000cd9e`fa4578f4 00000289`42575a20 0000cd9e`fa4578b4 00000289`42575920 : xul!nsTimerEvent::Run+0x96e 0000008f`83bff130 00007fff`ad2f1660 : 0000cd9e`fa457924 00000000`000000b1 0000cd9e`fa457944 00000289`62866e80 : xul!mozilla::RunnableTask::Run+0x19 0000008f`83bff160 00007fff`ad2f01fb : 00000000`00000000 00000289`4c8e7208 00000289`42577240 00000000`00000000 : xul!mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal+0xbe0 0000008f`83bff350 00007fff`ad2f7f92 : 0000008f`83bff5af 00000289`42577240 00000289`42521560 00000289`42577258 : xul!mozilla::TaskController::ProcessPendingMTTask+0x5b 0000008f`83bff3f0 00007fff`ad302ac3 : 00000289`42200018 00007ff8`5ac7982e 00000000`00000000 00000000`000000d0 : xul!mozilla::detail::RunnableFunction<`lambda at Y:\src\Floorp\xpcom\threads\TaskController.cpp:237:7'>::Run+0x12 0000008f`83bff420 00007fff`ad307a98 : 00000000`00000000 00000289`4251e2a0 00030011`00000000 00007fff`ad312737 : xul!nsThread::ProcessNextEvent+0x453 0000008f`83bff580 00007fff`ad9b7e1b : 62336236`36312d63 007d3161`35363431 0000cd9e`fa457c94 0000008f`83bff730 : xul!NS_ProcessNextEvent+0x68 0000008f`83bff5d0 00007fff`ad976e30 : 00030011`00000000 00007ff8`5ac7ac9c 0000008f`83bff9c0 00007ff8`59cc3a31 : xul!mozilla::ipc::MessagePump::Run+0x13b 0000008f`83bff630 00007fff`ad976da7 : 00000000`4ca3e401 00000289`53524220 00000289`535243d8 00000289`4ca3e4a0 : xul!MessageLoop::RunHandler+0x50 0000008f`83bff680 00007fff`b047d6b8 : 00000000`00000020 00007ff8`5ac7da4d 0000cd9e`fa457ea4 00000000`4ca3e400 : xul!MessageLoop::Run+0x57 0000008f`83bff6d0 00007fff`b052ea29 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : xul!nsBaseAppShell::Run+0x28 0000008f`83bff710 00007fff`b0de12f8 : 00000289`4ca3e4a0 00000289`42200000 00000289`4ca56240 00000000`00000000 : xul!nsAppShell::Run+0xe9 0000008f`83bff770 00007fff`b0ecf276 : 00000000`00000000 0000008f`83bffb70 00000289`4ca56240 0000008f`83bffb70 : xul!nsAppStartup::Run+0x48 0000008f`83bff7c0 00007fff`b0ecf8cc : 00000289`42200018 00007ff8`5ac7982e 00000289`4255b040 00000000`00000000 : xul!XREMain::XRE_main+0x4066 0000008f`83bffb50 00007ff6`b5e41d34 : 00000000`00000029 00000000`00000000 00000000`00000029 00000289`41fa7e20 : xul!XRE_main+0x9c 0000008f`83bffc30 00007ff6`b5e93f68 : 00007ff6`b5e950b0 00000000`00000000 00000000`00000000 00000000`00000000 : floorp!wmain+0xd24 0000008f`83bffe30 00007ff8`c8087374 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : floorp!__scrt_common_main_seh+0x10c 0000008f`83bffe70 00007ff8`c87dcc91 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0x14 0000008f`83bffea0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x21 STACK_COMMAND: ~0s; .ecxr ; kb FAULTING_SOURCE_LINE: Y:\src\Floorp\toolkit\components\antitracking\bouncetrackingprotection\BounceTrackingProtection.cpp FAULTING_SOURCE_FILE: Y:\src\Floorp\toolkit\components\antitracking\bouncetrackingprotection\BounceTrackingProtection.cpp FAULTING_SOURCE_LINE_NUMBER: 540 FAULTING_SOURCE_CODE: 299: continue; 300: } 301: 302: nsAutoCString baseDomain; > 303: rv = contentPrincipal->GetBaseDomain(baseDomain); 304: if (NS_WARN_IF(NS_FAILED(rv))) { 305: continue; 306: } 307: 308: if (aSiteHost.Equals(baseDomain)) { SYMBOL_NAME: xul!mozilla::BounceTrackingProtection::PurgeBounceTrackers+91f MODULE_NAME: xul IMAGE_NAME: xul.dll FAILURE_BUCKET_ID: NULL_POINTER_READ_c0000005_xul.dll!mozilla::BounceTrackingProtection::PurgeBounceTrackers BUCKET_ID_MODPRIVATE: 1 OS_VERSION: 10.0.19041.1 BUILDLAB_STR: vb_release OSPLATFORM_TYPE: x64 OSNAME: Windows 10 IMAGE_VERSION: 128.1.0.4131 FAILURE_ID_HASH: {8b4b4691-d91d-97f0-279c-c1b73ee60b15} Followup: MachineOwner --------- ```Full backtrace
``` 0:000> kb # RetAddr : Args to Child : Call Site 00 00007ff8`c6244030 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!NtWaitForMultipleObjects+0x14 01 00007ff8`c6243f2e : 00000000`000029d8 00000000`00000096 00000000`d000022d 00000000`d000022d : KERNELBASE!WaitForMultipleObjectsEx+0xf0 02 00007ff8`c80e1f5a : 00000000`00000000 00000000`00000001 0000008f`83bfd7c0 00000000`00000096 : KERNELBASE!WaitForMultipleObjects+0xe 03 00007ff8`c80e1996 : 00000000`00000000 00000000`00000000 00000000`00000003 ffffffff`ffffffff : kernel32!WerpReportFaultInternal+0x58a 04 00007ff8`c6313699 : 00000000`00000000 0000008f`83bffea0 00007ff8`c8070000 0000008f`83bfd7e8 : kernel32!WerpReportFault+0xbe 05 00007ff8`c8835898 : 0000008f`83bfd870 00007ff8`c88d6e9c 00000000`00000000 0000008f`83bfd808 : KERNELBASE!UnhandledExceptionFilter+0x3d9 06 00007ff8`c881ce56 : 00007ff8`c890473c 00007ff8`c8790000 0000008f`83bfd870 00007ff8`c87c0e7b : ntdll!RtlUserThreadStart$filt$0+0xa2 07 00007ff8`c883292f : 00000000`00000000 0000008f`83bfdd70 0000008f`83bfe430 00000000`00000000 : ntdll!_C_specific_handler+0x96 08 00007ff8`c87e2554 : 00000000`00000000 0000008f`83bfdd70 0000008f`83bfe430 00000000`00000000 : ntdll!RtlpExecuteHandlerForException+0xf 09 00007ff8`c883143e : 0000008f`83bfe398 00000289`4c926068 00000289`6e9a9d00 0000008f`83bfdfb0 : ntdll!RtlDispatchException+0x244 0a 00007fff`b0cb4d0f : 00000289`4c8e7200 00000000`0000c2b1 00000000`00000000 00007fff`b052e06e : ntdll!KiUserExceptionDispatch+0x2e 0b (Inline Function) : --------`-------- --------`-------- --------`-------- --------`-------- : xul!nsCOMPtrThe nullref is occurring here, in bounce tracking protection: https://github.com/Floorp-Projects/Floorp/blob/8249fc70ced355ba33336608a1d73490af0d2003/toolkit/components/antitracking/bouncetrackingprotection/BounceTrackingState.cpp#L303
contentPrincipal
is indeed null, suggesting thatbrowser->GetContentPrincipal
is failing without returning a failure error code.The
about:config
options in theprivacy.bounceTrackingProtection
namespace match between profiles that do and do not exhibit the crash. For completeness, here are their values:Reproduction Steps
I do not know how to create a profile that reliably reproduces this, however I and others have profiles that do so reliably.
Expected Behavior
No crash.
Actual Behavior
The profile crashes, reliably, every hour.
Screenshots
N/A
Browser Version
v11.17.*, including in particular commit 8249fc70ced355ba33336608a1d73490af0d2003
Operating System
Windows 10 22H2, Windows 11 23H2
Additional Context
No response