Skip to content
Snippets Groups Projects
New look: Off

Tor 0.4.3.0-alpha-dev asserts when quitting while visiting an onion service

    • Closed Issue created by Trac @tracbot

    Reproducibility: often

    Steps: Quit Tor Browser Nightly.

    What happened: Crash.

    Expected result: No crash.

    Trac:
    Username: rex4539

    To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information

    Child items ...

    • Activity

    • Trac changed milestone to %Tor: 0.4.3.x-final in legacy/trac

      changed milestone to %Tor: 0.4.3.x-final in legacy/trac

    • Trac added 043-must in Legacy / Trac component::core tor/tor in Legacy / Trac crash in Legacy / Trac milestone::Tor: 0.4.3.x-final in Legacy / Trac owner::dgoulet in Legacy / Trac points::0.1 in Legacy / Trac priority::very high in Legacy / Trac regression in Legacy / Trac reporter::rex4539 in Legacy / Trac resolution::fixed in Legacy / Trac severity::normal in Legacy / Trac status::closed in Legacy / Trac tbb-wants in Legacy / Trac type::defect in Legacy / Trac labels

      added 043-must in Legacy / Trac component::core tor/tor in Legacy / Trac crash in Legacy / Trac milestone::Tor: 0.4.3.x-final in Legacy / Trac owner::dgoulet in Legacy / Trac points::0.1 in Legacy / Trac priority::very high in Legacy / Trac regression in Legacy / Trac reporter::rex4539 in Legacy / Trac resolution::fixed in Legacy / Trac severity::normal in Legacy / Trac status::closed in Legacy / Trac tbb-wants in Legacy / Trac type::defect in Legacy / Trac labels

    • Trac
      Trac @tracbot ·
      Author

      Trac:
      Username: rex4539

      tor.real_2019-12-26-211706_MacBook-Pro-2018.crash

    • Trac
      Trac @tracbot ·
      Author

      Trac:
      Username: rex4539

    • Georg Koppen
      Georg Koppen @gk ·
      Reporter

      Looks like a tor issue.

      Trac:
      Version: Tor: 0.4.2.5 to N/A
      Component: Applications/Tor Browser to Core Tor/Tor

    • Georg Koppen
      Georg Koppen @gk ·
      Reporter

      Let's see whether I set the right bit.

      Trac:
      Milestone: N/A to Tor: 0.4.3.x-final

    • Roger Dingledine
      Roger Dingledine @arma ·
      Reporter

      Traceback extracted from the crash report:

      Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   libsystem_kernel.dylib              0x00007fff7387f7fa __pthread_kill + 10
1   libsystem_pthread.dylib             0x00007fff7393cbc1 pthread_kill + 432
2   libsystem_c.dylib                   0x00007fff73806a1c abort + 120
3   tor.real                            0x0000000108638bee tor_raw_abort_ + 14
4   tor.real                            0x0000000108633eee tor_abort_ + 14
5   tor.real                            0x0000000108594645 rend_cache_lookup_entry + 341
6   tor.real                            0x0000000108596d04 rend_client_report_intro_point_failure + 68
7   tor.real                            0x000000010854bed1 hs_circ_cleanup_on_free + 65
8   tor.real                            0x00000001084c5d53 circuit_free_ + 131
9   tor.real                            0x00000001084c6cc8 circuit_free_all + 392
10  tor.real                            0x000000010849d456 tor_free_all + 86
11  tor.real                            0x000000010849b345 tor_run_main + 1109
12  tor.real                            0x0000000108501b16 tor_main + 118
13  tor.real                            0x000000010848b01b main + 27
14  libdyld.dylib                       0x00007fff737387fd start + 1
    • Roger Dingledine
      Roger Dingledine @arma ·
      Reporter

      I think the Tor Browser nightly includes Tor master, i.e. this was a pre-release Tor 0.4.3.0-alpha-dev. We should figure out which git commit it was from.

      Or if somebody can reproduce it on a recent nightly and tell us which one, then we can rederive the version too.

    • Trac
      Trac @tracbot ·
      Author

      tbb-nightly.2020.01.09

      Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   libsystem_kernel.dylib        	0x00007fff6dae07fa __pthread_kill + 10
1   libsystem_pthread.dylib       	0x00007fff6db9dbc1 pthread_kill + 432
2   libsystem_c.dylib             	0x00007fff6da67a1c abort + 120
3   tor.real                      	0x0000000100ec1f1e tor_raw_abort_ + 14
4   tor.real                      	0x0000000100ebd1ee tor_abort_ + 14
5   tor.real                      	0x0000000100e1d945 rend_cache_lookup_entry + 341
6   tor.real                      	0x0000000100e20004 rend_client_report_intro_point_failure + 68
7   tor.real                      	0x0000000100dd51d1 hs_circ_cleanup_on_free + 65
8   tor.real                      	0x0000000100d4ee83 circuit_free_ + 131
9   tor.real                      	0x0000000100d4fdf8 circuit_free_all + 392
10  tor.real                      	0x0000000100d26496 tor_free_all + 86
11  tor.real                      	0x0000000100d24385 tor_run_main + 1109
12  tor.real                      	0x0000000100d8ae16 tor_main + 118
13  tor.real                      	0x0000000100d1401b main + 27
14  libdyld.dylib                 	0x00007fff6d9997fd start + 1

      Trac:
      Username: rex4539

    • Trac
      Trac @tracbot ·
      Author

      Trac:
      Username: rex4539

      tor.real_2020-01-11-121948_MacBook-Pro-2018.crash

    • Trac
      Trac @tracbot ·
      Author

      Trac:
      Username: rex4539

    • Trac
      Trac @tracbot ·
      Author

      Reproduced in the debugger too.

      Jan 11 10:32:46.000 [notice] Catching signal TERM, exiting cleanly.
Jan 11 10:32:46.000 [err] tor_assertion_failed_: Bug: src/feature/rend/rendcache.c:529: rend_cache_lookup_entry: Assertion rend_cache failed; aborting. (on Tor 0.4.3.0-alpha-dev 4f02812242d1fd90)
Jan 11 10:32:46.000 [err] Bug: Tor 0.4.3.0-alpha-dev (git-4f02812242d1fd90): Assertion rend_cache failed in rend_cache_lookup_entry at src/feature/rend/rendcache.c:529: . Stack trace: (on Tor 0.4.3.0-alpha-dev 4f02812242d1fd90)
Jan 11 10:32:46.000 [err] Bug:     0   tor.real                            0x00000001001ae049 log_backtrace_impl + 89 (on Tor 0.4.3.0-alpha-dev 4f02812242d1fd90)
Jan 11 10:32:46.000 [err] Bug:     1   tor.real                            0x00000001001a9fa2 tor_assertion_failed_ + 322 (on Tor 0.4.3.0-alpha-dev 4f02812242d1fd90)
Jan 11 10:32:46.000 [err] Bug:     2   tor.real                            0x000000010010a940 rend_cache_lookup_entry + 336 (on Tor 0.4.3.0-alpha-dev 4f02812242d1fd90)
Jan 11 10:32:46.000 [err] Bug:     3   tor.real                            0x000000010010d004 rend_client_report_intro_point_failure + 68 (on Tor 0.4.3.0-alpha-dev 4f02812242d1fd90)
Jan 11 10:32:46.000 [err] Bug:     4   tor.real                            0x00000001000c21d1 hs_circ_cleanup_on_free + 65 (on Tor 0.4.3.0-alpha-dev 4f02812242d1fd90)
Jan 11 10:32:46.000 [err] Bug:     5   tor.real                            0x000000010003be83 circuit_free_ + 131 (on Tor 0.4.3.0-alpha-dev 4f02812242d1fd90)
Jan 11 10:32:46.000 [err] Bug:     6   tor.real                            0x000000010003cdf8 circuit_free_all + 392 (on Tor 0.4.3.0-alpha-dev 4f02812242d1fd90)
Jan 11 10:32:46.000 [err] Bug:     7   tor.real                            0x0000000100013496 tor_free_all + 86 (on Tor 0.4.3.0-alpha-dev 4f02812242d1fd90)
Jan 11 10:32:46.000 [err] Bug:     8   tor.real                            0x0000000100011385 tor_run_main + 1109 (on Tor 0.4.3.0-alpha-dev 4f02812242d1fd90)
Jan 11 10:32:46.000 [err] Bug:     9   tor.real                            0x0000000100077e16 tor_main + 118 (on Tor 0.4.3.0-alpha-dev 4f02812242d1fd90)
Jan 11 10:32:46.000 [err] Bug:     10  tor.real                            0x000000010000101b main + 27 (on Tor 0.4.3.0-alpha-dev 4f02812242d1fd90)
Jan 11 10:32:46.000 [err] Bug:     11  libdyld.dylib                       0x00007fff6d9997fd start + 1 (on Tor 0.4.3.0-alpha-dev 4f02812242d1fd90)

      Trac:
      Username: rex4539

    • Roger Dingledine
      Roger Dingledine @arma ·
      Reporter

      Trac:
      Summary: Tor crashes when quitting Tor Browser nightly on macOS to Tor 0.4.3.0-alpha-dev asserts when quitting Tor Browser nightly on macOS

    • Roger Dingledine
      Roger Dingledine @arma ·
      Reporter

      cc'ing dgoulet and asn since the assert is in the onion service code

      Trac:
      Cc: N/A to dgoulet, asn

    • Trac
      Trac @tracbot ·
      Author

      Steps to reproduce:

      1. Set https://3g2upl4pq6kufc4m.onion/ as startpage.
      2. Quit Tor Browser.
      3. Launch Tor Browser.
      4. Quit Tor Browser.

      Tor Browser will now always crash on quit.

      Trac:
      Username: rex4539

    • Roger Dingledine
      Roger Dingledine @arma ·
      Reporter

      Managed to reproduce it once, on Linux, with just the tor binary, under valgrind. I started tor, launched an apt update which went to the debian onion service, and ^C'ed at a lucky time.

      ^CJan 11 08:15:32.000 [notice] Interrupt: exiting cleanly.
Jan 11 08:15:32.000 [err] tor_assertion_failed_(): Bug: src/feature/rend/rendcache.c:529: rend_cache_lookup_entry: Assertion rend_cache failed; aborting. (on Tor 0.4.3.0-alpha-dev 5888db496746e2fe)
Jan 11 08:15:32.000 [err] Bug: Tor 0.4.3.0-alpha-dev (git-5888db496746e2fe): Assertion rend_cache failed in rend_cache_lookup_entry at src/feature/rend/rendcache.c:529: . Stack trace: (on Tor 0.4.3.0-alpha-dev 5888db496746e2fe)
Jan 11 08:15:32.000 [err] Bug:     src/app/tor(log_backtrace_impl+0x56) [0x31f386] (on Tor 0.4.3.0-alpha-dev 5888db496746e2fe)
Jan 11 08:15:32.000 [err] Bug:     src/app/tor(tor_assertion_failed_+0x147) [0x31a3e7] (on Tor 0.4.3.0-alpha-dev 5888db496746e2fe)
Jan 11 08:15:32.000 [err] Bug:     src/app/tor(rend_cache_lookup_entry+0x112) [0x25acb2] (on Tor 0.4.3.0-alpha-dev 5888db496746e2fe)
Jan 11 08:15:32.000 [err] Bug:     src/app/tor(rend_client_report_intro_point_failure+0x45) [0x25db05] (on Tor 0.4.3.0-alpha-dev 5888db496746e2fe)
Jan 11 08:15:32.000 [err] Bug:     src/app/tor(hs_circ_cleanup_on_free+0x94) [0x211f84] (on Tor 0.4.3.0-alpha-dev 5888db496746e2fe)
Jan 11 08:15:32.000 [err] Bug:     src/app/tor(+0x8a672) [0x192672] (on Tor 0.4.3.0-alpha-dev 5888db496746e2fe)
Jan 11 08:15:32.000 [err] Bug:     src/app/tor(circuit_free_all+0xca) [0x19307a] (on Tor 0.4.3.0-alpha-dev 5888db496746e2fe)
Jan 11 08:15:32.000 [err] Bug:     src/app/tor(tor_free_all+0x51) [0x169ab1] (on Tor 0.4.3.0-alpha-dev 5888db496746e2fe)
Jan 11 08:15:32.000 [err] Bug:     src/app/tor(tor_run_main+0x1125) [0x168725] (on Tor 0.4.3.0-alpha-dev 5888db496746e2fe)
Jan 11 08:15:32.000 [err] Bug:     src/app/tor(tor_main+0x3a) [0x165fba] (on Tor 0.4.3.0-alpha-dev 5888db496746e2fe)
Jan 11 08:15:32.000 [err] Bug:     src/app/tor(main+0x19) [0x165b79] (on Tor 0.4.3.0-alpha-dev 5888db496746e2fe)
Jan 11 08:15:32.000 [err] Bug:     /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xeb) [0x521b09b] (on Tor 0.4.3.0-alpha-dev 5888db496746e2fe)
Jan 11 08:15:32.000 [err] Bug:     src/app/tor(_start+0x2a) [0x165bca] (on Tor 0.4.3.0-alpha-dev 5888db496746e2fe)
      ==4027== Process terminating with default action of signal 6 (SIGABRT)
==4027==    at 0x522E7BB: raise (raise.c:51)
==4027==    by 0x5219534: abort (abort.c:79)
==4027==    by 0x31FA5D: tor_raw_abort_ (torerr.c:227)
==4027==    by 0x31A68D: tor_abort_ (util_bug.c:176)
==4027==    by 0x25ACB6: rend_cache_lookup_entry (rendcache.c:529)
==4027==    by 0x25DB04: rend_client_report_intro_point_failure (rendclient.c:803)
==4027==    by 0x211F83: cleanup_on_free_client_circ (hs_circuit.c:631)
==4027==    by 0x211F83: hs_circ_cleanup_on_free (hs_circuit.c:1274)
==4027==    by 0x192671: circuit_free_.part.19 (circuitlist.c:1139)
==4027==    by 0x193079: circuit_free_ (circuitlist.c:1127)
==4027==    by 0x193079: circuit_free_all (circuitlist.c:1312)
==4027==    by 0x169AB0: tor_free_all (shutdown.c:123)
==4027==    by 0x168724: tor_run_main (main.c:1318)
==4027==    by 0x165FB9: tor_main (tor_api.c:164)

      There is definitely some sort of race, where you have to ^C it at just the right time.

    • Georg Koppen
      Georg Koppen @gk ·
      Reporter

      Not only macOS-related as visible on Linux, too (tried with 5888db49).

      Trac:
      Summary: Tor 0.4.3.0-alpha-dev asserts when quitting Tor Browser nightly on macOS to Tor 0.4.3.0-alpha-dev asserts when quitting Tor Browser nightly

    • Roger Dingledine
      Roger Dingledine @arma ·
      Reporter

      Trac:
      Summary: Tor 0.4.3.0-alpha-dev asserts when quitting Tor Browser nightly to Tor 0.4.3.0-alpha-dev asserts when quitting while visiting an onion service

    • Roger Dingledine
      Roger Dingledine @arma ·
      Reporter

      I got it to trigger on commit cbc49545, which looks super related.

      See also legacy/trac#32020 (moved) and legacy/trac#25568 (moved), courtesy asn.

    • Roger Dingledine
      Roger Dingledine @arma ·
      Reporter

      and commit 58879477 (a few commits behind the buggy one) doesn't obviously have the bug. It's hard to claim that for sure though because it's a race that's hard to trigger. So, dgoulet, that's where to start looking. :)

    • Trac
      Trac @tracbot ·
      Author

      I can confirm that I can reproduce with cbc49545 and unable to reproduce with 58879477.

      Trac:
      Username: rex4539

    • Nick Mathewson
      Nick Mathewson @nickm ·
      Owner

      Trac:
      Keywords: N/A deleted, 043-must regression tbb-wants crash added

    • David Goulet
      David Goulet @dgoulet ·
      Owner

      Branch: ticket32847_043_01 PR: https://github.com/torproject/tor/pull/1656

      Trac:
      Status: new to accepted
      Priority: High to Very High
      Cc: dgoulet, asn to asn
      Owner: tbb-team to dgoulet
      Points: N/A to 0.1

    • David Goulet
      David Goulet @dgoulet ·
      Owner

      Trac:
      Status: accepted to needs_review

    • Trac
      Trac @tracbot ·
      Author

      I'm unable to reproduce after the fix.

      Trac:
      Username: rex4539

    • George Kadianakis
      George Kadianakis @asn ·
      Contributor

      LGTM! Unfortunately, it's missing a changes file to be mergeable. Putting in needs_revision until changes file appears.

      (Also reviewed during pairing session with dgoulet)

      Trac:
      Status: needs_review to needs_revision

    • George Kadianakis
      George Kadianakis @asn ·
      Contributor

      Oops, dgoulet pointed out that there is no need for a changes file since legacy/trac#32020 (moved) hasn't been released yet.

      Merged! Thanks!

      Trac:
      Status: needs_revision to closed
      Resolution: N/A to fixed

    • Trac closed

      closed

    • Trac changed time estimate to 48m

      changed time estimate to 48m

    • Trac moved from legacy/trac#32847 (moved)

      moved from legacy/trac#32847 (moved)

    • Trac added Bug label and removed 1 deleted label

      added Bug label and removed 1 deleted label

    • Trac added Crash For TBB Team Regression labels and removed 1 deleted label

      added Crash For TBB Team Regression labels and removed 1 deleted label

    • Gaba added For Applications team label

      added For Applications team label

    • Gaba removed For TBB Team label

      removed For TBB Team label

    Please register or sign in to reply