[CLOSED] FF 4.0-7.0.1: many crashes on Mac with NoScript

[lp]

I've been getting a lot of crashes since Firefox 4.0, up to, and including the current stable version, 7.0.1, apparently in connection with NoScript. I get them randomly on different web pages (I have maybe 20 tabs open in two windows), sometimes within one minute since starting Firefox - even while it's restoring its session. If I disable NoScript, I cannot get it to crash at all (tested for about one week). I have all plugins disabled, and only Master Password Timeout, AdBlock Plus and NoScript (and RequestPolicy since about two weeks ago, but it crashed in last months even without that). Disabling ABE doesn't seem to help at all. The crashes only happen for me on Mac OS X (10.6.8, Snow Leopard) - not on Linux. I tested on Ubuntu and Fedora with Firefox 4 and 6, and Debian Squeeze with Iceweasel 3.6, couldn't get it to crash even with many more tabs open. On Mac, it crashes both with hardware acceleration enabled and with it disabled, only the stack trace looks somewhat different (WebGL is disabled in settings, in case that matters).

Here is the latest crash report from today: https://crash-stats.mozilla.com/report/ ... d952111018

Any idea what is causing this? Thanks in advance!

[Tom T.]

As a preliminary measure, could you please create a completely clean profile for your Mac system, then install only NoScript, and see if this problem still occurs?
This could rule out possible corruption of the Mac profile itself, since your other platforms would have their own profiles.
Or possible conflicts with MPT and/or ABP. Thanks.

[lp]

Thanks, Tom. I created a new profile, installed NoScript (default settings, I just disabled the yellow popup bar when it appeared), set FF to reopen open tabs, closed it, copied storedsessions.js from the old profile, started it again and then browsed about two hours. It crashed as I wasn't browsing anymore, just wanted to go get a glass of water. The crash report can be already seen at Mozilla's crash-stats site.

Update: Firefox suddenly brought the Mac mini to massive swapping as I was typing this message (Activity Monitor showed 2.17 GB and increasing - I had to kill it, the system almost stopped responding). I just typed everything again. It's the first time I see something like this - using FF since its Phoenix 0.5 days...

[Tom T.]

Before I escalate this, may I ask you another small favor or two?

Thanks, Tom. I created a new profile, installed NoScript (default settings, <snip>, copied storedsessions.js from the old profile, <snip>

The purpose of creating a clean profile is to check for *any* possible corruption. Copying anything at all from the problematic profile, including storedsessions.js, dilutes this value, even if that isn't the cause. So, could you please once again create a clean profile from scratch, not copy anything from the old one, and test again?

<snip> set FF to reopen open tabs <snio>

Could you try it with FF set *not* to reopen tabs, as either an eliminator or isolator of the problem?
These should be helpful. Thanks.

[lp]

I created a new profile (without copying anything or changing any single FF setting), installed NoScript and started browsing. After about 6 hours, I didn't get any crash. Not even one.

Then, I remembered that I used FIPS mode in my old profile, and yesterday as well. I went and enabled it, then restarted FF and continued browsing. In less than half an hour, FF crashed twice. The second crash happened one minute after the first one.

So I disabled FIPS mode, restarted FF and been browsing ever since. It's now more than 4 fours, no crash.

[Tom T.]

I created a new profile (without copying anything or changing any single FF setting), installed NoScript and started browsing. After about 6 hours, I didn't get any crash. Not even one.

Then, I remembered that I used FIPS mode in my old profile, and yesterday as well. I went and enabled it, then restarted FF and continued browsing. In less than half an hour, FF crashed twice. The second crash happened one minute after the first one.

So I disabled FIPS mode, restarted FF and been browsing ever since. It's now more than 4 fours, no crash.

Excellent. We've isolated the problem. Thanks for doing the full diagnostics, and for remembering what changed in the usage.

I don't use FIPS mode myself, so was a bit surprised to see that the document you linked to had this banner at the top:

This article is no longer maintained, so its content might be out of date

Can you search MZ for an up-to-date reference on FIPS?

In the meantime, a brief search didn't show anything in NS documentation about using NS with FIPS, so I'll escalate this to Giorgio. Hopefully, he'll be back to you in the next day or two (and perhaps add a FIPS FAQ). Thanks for the additional info.

Edit: Do you use FIPS mode on your *nix platforms? If not, could you please try enabling it and seeing whether the other systems crash as well? It would be helpful to know whether there's an incompatibility with NS and FIPS in general, or only on Mac.

[Giorgio Maone]

It looks like a Firefox threading-related bug, albeit triggered by NoScript's presence.
Please report it here putting me, :bz and David Bienvenu in CC.

On a side note, do you still need FIPS and why?

Thank you.

[lp]

It looks like a Firefox threading-related bug, albeit triggered by NoScript's presence.
Please report it here putting me, :bz and David Bienvenu in CC.

Thank you, Giorgio - I just filed the bug report.

On a side note, do you still need FIPS and why?

Mostly because of the better security (strong encryption for stored passwords, as opposed to the breakable one used when not in FIPS mode). I also tried to enable FIPS on Linux, but it doesn't want to - perhaps it's bug 460534. Unfortunately, I have no Windows system to test on.

[lp]

Thanks, Tom!

Can you search MZ for an up-to-date reference on FIPS?

I did, but the article on support.mozilla.com is the only reference on FIPS Google finds (both on mozillazine and on the entire Web).

Edit: Do you use FIPS mode on your *nix platforms? If not, could you please try enabling it and seeing whether the other systems crash as well? It would be helpful to know whether there's an incompatibility with NS and FIPS in general, or only on Mac.

I tried, but it doesn't work (it just won't activate, probably due to bug 460534). With no WIndows system to test, no way for me to tell if it's Mac only. Hopefully the Firefox developers have some ideas where this is coming from...

[therube]

Linked: Bug 696336 - Crash with NoScript in FIPS mode

[Tom T.]

On a side note, do you still need FIPS and why?

Mostly because of the better security (strong encryption for stored passwords,

Take a look at Password Safe, a free tool with encryption by world-famous cryptographer Bruce Schneier.

Totally self-contained: Nothing is stored on a third-party web site; no need to contact any website; it's all stored in the 2 MB Program File. In fact. you can run it from a USB Flash drive. The actual, always-encrypted pw file is very small - mine is 16 kb, with 63 entries. This one file is all that you have to back up. If your HD dies or whatever, just reinstall the tiny program, and copy your backed-up pw file to the program's folder (replace or overwrite the empty default file).

Originally, this was Windows-only, but a brief look shows that there are ways to run it on Linux. I don't know if anyone's ported it to Mac yet; it's possible. (Perhaps you could?)

I've been using it for years. Being naturally paranoid , I'd never trust a browser or third party to store such things. If you like, I'll send you my pw file, and you can try to break it. Apparently, it would take the NSA thousands of centuries. You just choose a good, crypto-strength Master Password to open the safe. That's all you need to remember (and write down, and store in a very safe place -- not near the computer, of course ).

It will auto-browse to the site for you, auto-enter user/pass and hit login for you, with one click each. There is room to store stuff like answers to "security questions". Much more. Check it out.

DISCLAIMER: Personal opinion only; not an official endorsement by this forum, its Admin/Developer, or any other person, nor can this site offer support for third-party products. Offered in the hope that it may be of some use, but because I can't control the product, your use of it, etc., I cannot accept any responsibility or liability from your use of it, or the consequences thereof. IF YOU DO NOT ACCEPT THESE TERMS, DO NOT CONSIDER, HEED, OR USE THIS OPINION.

Thanks, Tom!

You're very welcome.

[lp]

Take a look at Password Safe, a free tool with encryption by world-famous cryptographer Bruce Schneier.

The problem with third-party password managers is that either they aren't open-source or that the author loses interest after 1-2 years and then no more security patches. I've been using Revelation on Linux for years (I think the original author stopped development in 2007, but the Debian security team does patch it whenever necessary). On Mac, that's a real problem: I looked up more than 10 password managers - only one, Password Gorilla (compatible with Password Safe and written in Tcl/Tk) seems to still be actively maintained.

I just found a better solution for Mac: there's a Firefox extension that allows the Firefox password manager to integrate with Keychain, the secure storage in Mac OS X (used by native Mac applications). I installed it, works great! Now both Firefox and Safari can access the passwords, no matter what I've used to first login on a site, automatic timeout, control which can get to access what, strong crypto maintained by Apple with OS updates. I'm no longer using FIPS.

If you like, I'll send you my pw file, and you can try to break it.

Please don't...

DISCLAIMER: Personal opinion only; not an official endorsement by this forum, its Admin/Developer, or any other person, nor can this site offer support for third-party products. Offered in the hope that it may be of some use, but because I can't control the product, your use of it, etc., I cannot accept any responsibility or liability from your use of it, or the consequences thereof. IF YOU DO NOT ACCEPT THESE TERMS, DO NOT CONSIDER, HEED, OR USE THIS OPINION.[/quote]

Relax, I'm in Europe... we're fortunately not that overrun by lawyers and sue-happy people.

[Tom T.]

I just found a better solution for Mac: there's a Firefox extension that allows the Firefox password manager to integrate with Keychain, the secure storage in Mac OS X (used by native Mac applications). I installed it, works great! Now both Firefox and Safari can access the passwords, no matter what I've used to first login on a site, automatic timeout, control which can get to access what, strong crypto maintained by Apple with OS updates. I'm no longer using FIPS.

Excellent!

If you like, I'll send you my pw file, and you can try to break it.

Please don't...

Actually, if you'd said "yes", I'd have created a fake one, just in case ...

="Tom T."DISCLAIMER<snip>

Relax, I'm in Europe... we're fortunately not that overrun by lawyers and sue-happy people.

You nailed it ....

(seriously, even without the lawsuits, we need to let users know that we can't offer tech support or any other assistance for X just because a team member has said, "I use Product X and like it. Have a look.")

Will close out the issue now. Thanks for the report.