The error seems to be a case of `RPC_E_TOO_LATE` as suspected by :rkraesig in comment 6. There is a non-documented registry key that can be used to debug these kind of issues: by setting `Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\FeatureDevelopmentProperties\BreakOnRpcETooLate` to DWORD 1, if a debugger is attached the first call to `CoInitializeSecurity` will record the call stack and the second call will generate a breakpoint and indicate where to find the call stack. After doing that we indeed break in `combase.dll` with the following output in WinDbg: ``` RPC_E_TOO_LATE indicates that CoInitializeSecurity has already been called Command to display the stack trace for CoInitializeSecurity: dps 0X000001705F3D23C8 (76b0.68b0): Break instruction exception - code 80000003 (first chance) combase!BreakIntoDebugger+0x4: 00007fff`8f4317b8 cc int 3 ``` The call stack for the second call is the same as in the crash, as expected: ``` 8:185> k # Child-SP RetAddr Call Site 00 00000021`80ffe4b0 00007fff`8f4240ce combase!BreakIntoDebugger+0x4 [onecore\com\combase\inc\DebuggerUtils.h @ 33] 01 (Inline Function) --------`-------- combase!BreakIntoAnyDebuggerIfPresent+0x22 [onecore\com\combase\inc\DebuggerUtils.h @ 56] 02 00000021`80ffe4e0 00007fff`8f30144d combase!RpcETooLate+0xbaaf6 [onecore\com\combase\dcomrem\security.cxx @ 3079] 03 00000021`80ffe510 00007fff`0c5d0bfc combase!CoInitializeSecurity+0x22d [onecore\com\combase\dcomrem\security.cxx @ 3409] 04 (Inline Function) --------`-------- xul!mozilla::detail::DynamicallyLinkedFunctionPtrBase<long (*)(void *, long, tagSOLE_AUTHENTICATION_SERVICE *, void *, unsigned long, unsigned long, void *, unsigned long, void *)>::operator()+0x35 [/builds/worker/workspace/obj-build/dist/include/mozilla/DynamicallyLinkedFunctionPtr.h @ 77] 05 (Inline Function) --------`-------- xul!mozilla::mscom::wrapped::CoInitializeSecurity+0xcb [/builds/worker/checkouts/gecko/ipc/mscom/COMWrappers.cpp @ 75] 06 (Inline Function) --------`-------- xul!mozilla::mscom::ProcessRuntime::InitializeSecurity+0x435 [/builds/worker/checkouts/gecko/ipc/mscom/ProcessRuntime.cpp @ 480] 07 00000021`80ffe860 00007fff`0c5fe6ad xul!mozilla::mscom::ProcessRuntime::InitInsideApartment+0x47c [/builds/worker/checkouts/gecko/ipc/mscom/ProcessRuntime.cpp @ 255] 08 (Inline Function) --------`-------- xul!mozilla::mscom::ProcessRuntime::ProcessRuntime+0x1a4 [/builds/worker/checkouts/gecko/ipc/mscom/ProcessRuntime.cpp @ 143] 09 (Inline Function) --------`-------- xul!mozilla::mscom::ProcessRuntime::ProcessRuntime+0x1b0 [/builds/worker/checkouts/gecko/ipc/mscom/ProcessRuntime.cpp @ 47] 0a 00000021`80ffeb60 00007fff`0c5d52dc xul!mozilla::mscom::ProcessRuntime::ProcessRuntime+0x1dd [/builds/worker/checkouts/gecko/ipc/mscom/ProcessRuntime.cpp @ 42] 0b (Inline Function) --------`-------- xul!mozilla::ipc::UtilityProcessImpl::ProcessChild+0x29 [/builds/worker/workspace/obj-build/dist/include/mozilla/ipc/UtilityProcessImpl.h @ 23] 0c (Inline Function) --------`-------- xul!mozilla::MakeUnique+0x3f [/builds/worker/workspace/obj-build/dist/include/mozilla/UniquePtr.h @ 606] 0d (Inline Function) --------`-------- xul!XRE_InitChildProcess+0xe12 [/builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp @ 592] 0e 00000021`80ffec20 00007ff7`e97c3609 xul!mozilla::BootstrapImpl::XRE_InitChildProcess+0xe3c [/builds/worker/checkouts/gecko/toolkit/xre/Bootstrap.cpp @ 63] 0f (Inline Function) --------`-------- firefox!NS_internal_main+0x45c [/builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp @ 403] 10 00000021`80ffeee0 00007ff7`e97e03a8 firefox!wmain+0x2569 [/builds/worker/checkouts/gecko/toolkit/xre/nsWindowsWMain.cpp @ 151] 11 (Inline Function) --------`-------- firefox!invoke_main+0x22 [D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl @ 90] 12 00000021`80fffb50 00007fff`8ec7257d firefox!__scrt_common_main_seh+0x10c [D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl @ 288] 13 00000021`80fffb90 00007fff`8fd2af28 KERNEL32!BaseThreadInitThunk+0x1d 14 00000021`80fffbc0 00000000`00000000 ntdll!RtlUserThreadStart+0x28 ``` But there is indeed a COM call that occured before that with the following call stack: ``` 8:185> dps 0X000001705F3D23C8 00000170`5f3d23c8 00007fff`8f3fd021 combase!CoInitializeSecurity+0xfbe01 [onecore\com\combase\dcomrem\security.cxx @ 3136] 00000170`5f3d23d0 00007fff`8f3569c8 combase!InitializeSecurity+0x88 [onecore\com\combase\dcomrem\security.cxx @ 6257] 00000170`5f3d23d8 00007fff`8f2ceee1 combase!CComApartment::InitRemoting+0xc9 [onecore\com\combase\dcomrem\aprtmnt.cxx @ 885] 00000170`5f3d23e0 00007fff`8f2cb566 combase!CComApartment::StartServer+0x2a [onecore\com\combase\dcomrem\aprtmnt.cxx @ 1215] 00000170`5f3d23e8 00007fff`8f2c886f combase!CRpcResolver::BindToSCMProxy+0x2b [onecore\com\combase\dcomrem\resolver.cxx @ 1645] 00000170`5f3d23f0 00007fff`8f2c82eb combase!CRpcResolver::DelegateActivationToSCM+0x12f [onecore\com\combase\dcomrem\resolver.cxx @ 2155] 00000170`5f3d23f8 00007fff`8f35689e combase!CRpcResolver::CreateInstance+0x1a [onecore\com\combase\dcomrem\resolver.cxx @ 2414] 00000170`5f3d2400 00007fff`8f30f948 combase!CClientContextActivator::CreateInstance+0x138 [onecore\com\combase\objact\actvator.cxx @ 604] 00000170`5f3d2408 00007fff`8f2f1e4c combase!ActivationPropertiesIn::DelegateCreateInstance+0x8c [onecore\com\combase\actprops\actprops.cxx @ 1920] 00000170`5f3d2410 00007fff`8f2c09c1 combase!ICoCreateInstanceEx+0x891 [onecore\com\combase\objact\objact.cxx @ 1921] 00000170`5f3d2418 00007fff`8f2bffae combase!CComActivator::DoCreateInstance+0x15e [onecore\com\combase\objact\immact.hxx @ 380] 00000170`5f3d2420 00007fff`8f290ecf combase!CoCreateInstanceAsUser+0x1df [onecore\com\combase\objact\actapi.cxx @ 441] 00000170`5f3d2428 00007fff`8f28e0fd combase!RuntimeBrokerActivation+0x18d [onecore\com\combase\winrtbase\brokeredactivation.cpp @ 780] 00000170`5f3d2430 00007fff`8f2c3918 combase!WinRTActivateInstanceInternal+0x518 [onecore\com\combase\winrtbase\winrtbase.cpp @ 662] 00000170`5f3d2438 00007fff`8f2be7ac combase!RoActivateInstance+0x1ac [onecore\com\combase\winrtbase\winrtbase.cpp @ 810] 00000170`5f3d2440 00007fff`55f6b4ce windows_storage_onecore!wil::ActivateInstance<IWin32Broker>+0x56 ``` I'm not sure how this relates to Webroot at the moment but I'll keep investigating.
Bug 1895174 Comment 30 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
The error seems to be a case of `RPC_E_TOO_LATE` as suspected by :rkraesig in comment 6. There is a non-documented registry key that can be used to debug these kind of issues: by setting `Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\FeatureDevelopmentProperties\BreakOnRpcETooLate` to DWORD 1, if a debugger is attached the first call to `CoInitializeSecurity` will record the call stack and the second call will generate a breakpoint and indicate where to find the call stack for the first call. After doing that we indeed break in `combase.dll` with the following output in WinDbg: ``` RPC_E_TOO_LATE indicates that CoInitializeSecurity has already been called Command to display the stack trace for CoInitializeSecurity: dps 0X000001705F3D23C8 (76b0.68b0): Break instruction exception - code 80000003 (first chance) combase!BreakIntoDebugger+0x4: 00007fff`8f4317b8 cc int 3 ``` The call stack for the second call is the same as in the crash, as expected: ``` 8:185> k # Child-SP RetAddr Call Site 00 00000021`80ffe4b0 00007fff`8f4240ce combase!BreakIntoDebugger+0x4 [onecore\com\combase\inc\DebuggerUtils.h @ 33] 01 (Inline Function) --------`-------- combase!BreakIntoAnyDebuggerIfPresent+0x22 [onecore\com\combase\inc\DebuggerUtils.h @ 56] 02 00000021`80ffe4e0 00007fff`8f30144d combase!RpcETooLate+0xbaaf6 [onecore\com\combase\dcomrem\security.cxx @ 3079] 03 00000021`80ffe510 00007fff`0c5d0bfc combase!CoInitializeSecurity+0x22d [onecore\com\combase\dcomrem\security.cxx @ 3409] 04 (Inline Function) --------`-------- xul!mozilla::detail::DynamicallyLinkedFunctionPtrBase<long (*)(void *, long, tagSOLE_AUTHENTICATION_SERVICE *, void *, unsigned long, unsigned long, void *, unsigned long, void *)>::operator()+0x35 [/builds/worker/workspace/obj-build/dist/include/mozilla/DynamicallyLinkedFunctionPtr.h @ 77] 05 (Inline Function) --------`-------- xul!mozilla::mscom::wrapped::CoInitializeSecurity+0xcb [/builds/worker/checkouts/gecko/ipc/mscom/COMWrappers.cpp @ 75] 06 (Inline Function) --------`-------- xul!mozilla::mscom::ProcessRuntime::InitializeSecurity+0x435 [/builds/worker/checkouts/gecko/ipc/mscom/ProcessRuntime.cpp @ 480] 07 00000021`80ffe860 00007fff`0c5fe6ad xul!mozilla::mscom::ProcessRuntime::InitInsideApartment+0x47c [/builds/worker/checkouts/gecko/ipc/mscom/ProcessRuntime.cpp @ 255] 08 (Inline Function) --------`-------- xul!mozilla::mscom::ProcessRuntime::ProcessRuntime+0x1a4 [/builds/worker/checkouts/gecko/ipc/mscom/ProcessRuntime.cpp @ 143] 09 (Inline Function) --------`-------- xul!mozilla::mscom::ProcessRuntime::ProcessRuntime+0x1b0 [/builds/worker/checkouts/gecko/ipc/mscom/ProcessRuntime.cpp @ 47] 0a 00000021`80ffeb60 00007fff`0c5d52dc xul!mozilla::mscom::ProcessRuntime::ProcessRuntime+0x1dd [/builds/worker/checkouts/gecko/ipc/mscom/ProcessRuntime.cpp @ 42] 0b (Inline Function) --------`-------- xul!mozilla::ipc::UtilityProcessImpl::ProcessChild+0x29 [/builds/worker/workspace/obj-build/dist/include/mozilla/ipc/UtilityProcessImpl.h @ 23] 0c (Inline Function) --------`-------- xul!mozilla::MakeUnique+0x3f [/builds/worker/workspace/obj-build/dist/include/mozilla/UniquePtr.h @ 606] 0d (Inline Function) --------`-------- xul!XRE_InitChildProcess+0xe12 [/builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp @ 592] 0e 00000021`80ffec20 00007ff7`e97c3609 xul!mozilla::BootstrapImpl::XRE_InitChildProcess+0xe3c [/builds/worker/checkouts/gecko/toolkit/xre/Bootstrap.cpp @ 63] 0f (Inline Function) --------`-------- firefox!NS_internal_main+0x45c [/builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp @ 403] 10 00000021`80ffeee0 00007ff7`e97e03a8 firefox!wmain+0x2569 [/builds/worker/checkouts/gecko/toolkit/xre/nsWindowsWMain.cpp @ 151] 11 (Inline Function) --------`-------- firefox!invoke_main+0x22 [D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl @ 90] 12 00000021`80fffb50 00007fff`8ec7257d firefox!__scrt_common_main_seh+0x10c [D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl @ 288] 13 00000021`80fffb90 00007fff`8fd2af28 KERNEL32!BaseThreadInitThunk+0x1d 14 00000021`80fffbc0 00000000`00000000 ntdll!RtlUserThreadStart+0x28 ``` But there is indeed a COM call that occured before that with the following call stack: ``` 8:185> dps 0X000001705F3D23C8 00000170`5f3d23c8 00007fff`8f3fd021 combase!CoInitializeSecurity+0xfbe01 [onecore\com\combase\dcomrem\security.cxx @ 3136] 00000170`5f3d23d0 00007fff`8f3569c8 combase!InitializeSecurity+0x88 [onecore\com\combase\dcomrem\security.cxx @ 6257] 00000170`5f3d23d8 00007fff`8f2ceee1 combase!CComApartment::InitRemoting+0xc9 [onecore\com\combase\dcomrem\aprtmnt.cxx @ 885] 00000170`5f3d23e0 00007fff`8f2cb566 combase!CComApartment::StartServer+0x2a [onecore\com\combase\dcomrem\aprtmnt.cxx @ 1215] 00000170`5f3d23e8 00007fff`8f2c886f combase!CRpcResolver::BindToSCMProxy+0x2b [onecore\com\combase\dcomrem\resolver.cxx @ 1645] 00000170`5f3d23f0 00007fff`8f2c82eb combase!CRpcResolver::DelegateActivationToSCM+0x12f [onecore\com\combase\dcomrem\resolver.cxx @ 2155] 00000170`5f3d23f8 00007fff`8f35689e combase!CRpcResolver::CreateInstance+0x1a [onecore\com\combase\dcomrem\resolver.cxx @ 2414] 00000170`5f3d2400 00007fff`8f30f948 combase!CClientContextActivator::CreateInstance+0x138 [onecore\com\combase\objact\actvator.cxx @ 604] 00000170`5f3d2408 00007fff`8f2f1e4c combase!ActivationPropertiesIn::DelegateCreateInstance+0x8c [onecore\com\combase\actprops\actprops.cxx @ 1920] 00000170`5f3d2410 00007fff`8f2c09c1 combase!ICoCreateInstanceEx+0x891 [onecore\com\combase\objact\objact.cxx @ 1921] 00000170`5f3d2418 00007fff`8f2bffae combase!CComActivator::DoCreateInstance+0x15e [onecore\com\combase\objact\immact.hxx @ 380] 00000170`5f3d2420 00007fff`8f290ecf combase!CoCreateInstanceAsUser+0x1df [onecore\com\combase\objact\actapi.cxx @ 441] 00000170`5f3d2428 00007fff`8f28e0fd combase!RuntimeBrokerActivation+0x18d [onecore\com\combase\winrtbase\brokeredactivation.cpp @ 780] 00000170`5f3d2430 00007fff`8f2c3918 combase!WinRTActivateInstanceInternal+0x518 [onecore\com\combase\winrtbase\winrtbase.cpp @ 662] 00000170`5f3d2438 00007fff`8f2be7ac combase!RoActivateInstance+0x1ac [onecore\com\combase\winrtbase\winrtbase.cpp @ 810] 00000170`5f3d2440 00007fff`55f6b4ce windows_storage_onecore!wil::ActivateInstance<IWin32Broker>+0x56 ``` I'm not sure how this relates to Webroot at the moment but I'll keep investigating.
The error seems to be a case of `RPC_E_TOO_LATE` as suspected by :rkraesig in comment 6. There is a non-documented registry key that can be used to debug these kind of issues: by setting `Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\FeatureDevelopmentProperties\BreakOnRpcETooLate` to DWORD 1, if a debugger is attached the first call to `CoInitializeSecurity` will record the call stack and the second call will generate a breakpoint and indicate where to find the call stack for the first call. After doing that we indeed break in `combase.dll` with the following output in WinDbg: ``` RPC_E_TOO_LATE indicates that CoInitializeSecurity has already been called Command to display the stack trace for CoInitializeSecurity: dps 0X000001705F3D23C8 (76b0.68b0): Break instruction exception - code 80000003 (first chance) combase!BreakIntoDebugger+0x4: 00007fff`8f4317b8 cc int 3 ``` The call stack for the second call is the same as in the crash, as expected: ``` 8:185> k # Child-SP RetAddr Call Site 00 00000021`80ffe4b0 00007fff`8f4240ce combase!BreakIntoDebugger+0x4 [onecore\com\combase\inc\DebuggerUtils.h @ 33] 01 (Inline Function) --------`-------- combase!BreakIntoAnyDebuggerIfPresent+0x22 [onecore\com\combase\inc\DebuggerUtils.h @ 56] 02 00000021`80ffe4e0 00007fff`8f30144d combase!RpcETooLate+0xbaaf6 [onecore\com\combase\dcomrem\security.cxx @ 3079] 03 00000021`80ffe510 00007fff`0c5d0bfc combase!CoInitializeSecurity+0x22d [onecore\com\combase\dcomrem\security.cxx @ 3409] 04 (Inline Function) --------`-------- xul!mozilla::detail::DynamicallyLinkedFunctionPtrBase<long (*)(void *, long, tagSOLE_AUTHENTICATION_SERVICE *, void *, unsigned long, unsigned long, void *, unsigned long, void *)>::operator()+0x35 [/builds/worker/workspace/obj-build/dist/include/mozilla/DynamicallyLinkedFunctionPtr.h @ 77] 05 (Inline Function) --------`-------- xul!mozilla::mscom::wrapped::CoInitializeSecurity+0xcb [/builds/worker/checkouts/gecko/ipc/mscom/COMWrappers.cpp @ 75] 06 (Inline Function) --------`-------- xul!mozilla::mscom::ProcessRuntime::InitializeSecurity+0x435 [/builds/worker/checkouts/gecko/ipc/mscom/ProcessRuntime.cpp @ 480] 07 00000021`80ffe860 00007fff`0c5fe6ad xul!mozilla::mscom::ProcessRuntime::InitInsideApartment+0x47c [/builds/worker/checkouts/gecko/ipc/mscom/ProcessRuntime.cpp @ 255] 08 (Inline Function) --------`-------- xul!mozilla::mscom::ProcessRuntime::ProcessRuntime+0x1a4 [/builds/worker/checkouts/gecko/ipc/mscom/ProcessRuntime.cpp @ 143] 09 (Inline Function) --------`-------- xul!mozilla::mscom::ProcessRuntime::ProcessRuntime+0x1b0 [/builds/worker/checkouts/gecko/ipc/mscom/ProcessRuntime.cpp @ 47] 0a 00000021`80ffeb60 00007fff`0c5d52dc xul!mozilla::mscom::ProcessRuntime::ProcessRuntime+0x1dd [/builds/worker/checkouts/gecko/ipc/mscom/ProcessRuntime.cpp @ 42] 0b (Inline Function) --------`-------- xul!mozilla::ipc::UtilityProcessImpl::ProcessChild+0x29 [/builds/worker/workspace/obj-build/dist/include/mozilla/ipc/UtilityProcessImpl.h @ 23] 0c (Inline Function) --------`-------- xul!mozilla::MakeUnique+0x3f [/builds/worker/workspace/obj-build/dist/include/mozilla/UniquePtr.h @ 606] 0d (Inline Function) --------`-------- xul!XRE_InitChildProcess+0xe12 [/builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp @ 592] 0e 00000021`80ffec20 00007ff7`e97c3609 xul!mozilla::BootstrapImpl::XRE_InitChildProcess+0xe3c [/builds/worker/checkouts/gecko/toolkit/xre/Bootstrap.cpp @ 63] 0f (Inline Function) --------`-------- firefox!NS_internal_main+0x45c [/builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp @ 403] 10 00000021`80ffeee0 00007ff7`e97e03a8 firefox!wmain+0x2569 [/builds/worker/checkouts/gecko/toolkit/xre/nsWindowsWMain.cpp @ 151] 11 (Inline Function) --------`-------- firefox!invoke_main+0x22 [D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl @ 90] 12 00000021`80fffb50 00007fff`8ec7257d firefox!__scrt_common_main_seh+0x10c [D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl @ 288] 13 00000021`80fffb90 00007fff`8fd2af28 KERNEL32!BaseThreadInitThunk+0x1d 14 00000021`80fffbc0 00000000`00000000 ntdll!RtlUserThreadStart+0x28 ``` But there is indeed a COM call that occured before that with the following call stack: ``` 8:185> dps 0X000001705F3D23C8 00000170`5f3d23c8 00007fff`8f3fd021 combase!CoInitializeSecurity+0xfbe01 [onecore\com\combase\dcomrem\security.cxx @ 3136] 00000170`5f3d23d0 00007fff`8f3569c8 combase!InitializeSecurity+0x88 [onecore\com\combase\dcomrem\security.cxx @ 6257] 00000170`5f3d23d8 00007fff`8f2ceee1 combase!CComApartment::InitRemoting+0xc9 [onecore\com\combase\dcomrem\aprtmnt.cxx @ 885] 00000170`5f3d23e0 00007fff`8f2cb566 combase!CComApartment::StartServer+0x2a [onecore\com\combase\dcomrem\aprtmnt.cxx @ 1215] 00000170`5f3d23e8 00007fff`8f2c886f combase!CRpcResolver::BindToSCMProxy+0x2b [onecore\com\combase\dcomrem\resolver.cxx @ 1645] 00000170`5f3d23f0 00007fff`8f2c82eb combase!CRpcResolver::DelegateActivationToSCM+0x12f [onecore\com\combase\dcomrem\resolver.cxx @ 2155] 00000170`5f3d23f8 00007fff`8f35689e combase!CRpcResolver::CreateInstance+0x1a [onecore\com\combase\dcomrem\resolver.cxx @ 2414] 00000170`5f3d2400 00007fff`8f30f948 combase!CClientContextActivator::CreateInstance+0x138 [onecore\com\combase\objact\actvator.cxx @ 604] 00000170`5f3d2408 00007fff`8f2f1e4c combase!ActivationPropertiesIn::DelegateCreateInstance+0x8c [onecore\com\combase\actprops\actprops.cxx @ 1920] 00000170`5f3d2410 00007fff`8f2c09c1 combase!ICoCreateInstanceEx+0x891 [onecore\com\combase\objact\objact.cxx @ 1921] 00000170`5f3d2418 00007fff`8f2bffae combase!CComActivator::DoCreateInstance+0x15e [onecore\com\combase\objact\immact.hxx @ 380] 00000170`5f3d2420 00007fff`8f290ecf combase!CoCreateInstanceAsUser+0x1df [onecore\com\combase\objact\actapi.cxx @ 441] 00000170`5f3d2428 00007fff`8f28e0fd combase!RuntimeBrokerActivation+0x18d [onecore\com\combase\winrtbase\brokeredactivation.cpp @ 780] 00000170`5f3d2430 00007fff`8f2c3918 combase!WinRTActivateInstanceInternal+0x518 [onecore\com\combase\winrtbase\winrtbase.cpp @ 662] 00000170`5f3d2438 00007fff`8f2be7ac combase!RoActivateInstance+0x1ac [onecore\com\combase\winrtbase\winrtbase.cpp @ 810] 00000170`5f3d2440 00007fff`55f6b4ce windows_storage_onecore!wil::ActivateInstance<IWin32Broker>+0x56 ``` I'm not sure how this relates to Webroot at the moment but I'll keep investigating. Edit: Oh, just realized that the call stack is truncated not because combase didn't record it fully but more likely because I used `dps` without a range. Will post full call stack tomorrow.
The error seems to be a case of `RPC_E_TOO_LATE` as suspected by :rkraesig in comment 6. There is a non-documented registry key that can be used to debug these kind of issues: by setting `Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\FeatureDevelopmentProperties\BreakOnRpcETooLate` to DWORD 1, if a debugger is attached the first call to `CoInitializeSecurity` will record the call stack and the second call will generate a breakpoint and indicate where to find the call stack for the first call. After doing that we indeed break in `combase.dll` with the following output in WinDbg: ``` RPC_E_TOO_LATE indicates that CoInitializeSecurity has already been called Command to display the stack trace for CoInitializeSecurity: dps 0X000001705F3D23C8 (76b0.68b0): Break instruction exception - code 80000003 (first chance) combase!BreakIntoDebugger+0x4: 00007fff`8f4317b8 cc int 3 ``` The call stack for the second call is the same as in the crash, as expected: ``` 8:185> k # Child-SP RetAddr Call Site 00 00000021`80ffe4b0 00007fff`8f4240ce combase!BreakIntoDebugger+0x4 [onecore\com\combase\inc\DebuggerUtils.h @ 33] 01 (Inline Function) --------`-------- combase!BreakIntoAnyDebuggerIfPresent+0x22 [onecore\com\combase\inc\DebuggerUtils.h @ 56] 02 00000021`80ffe4e0 00007fff`8f30144d combase!RpcETooLate+0xbaaf6 [onecore\com\combase\dcomrem\security.cxx @ 3079] 03 00000021`80ffe510 00007fff`0c5d0bfc combase!CoInitializeSecurity+0x22d [onecore\com\combase\dcomrem\security.cxx @ 3409] 04 (Inline Function) --------`-------- xul!mozilla::detail::DynamicallyLinkedFunctionPtrBase<long (*)(void *, long, tagSOLE_AUTHENTICATION_SERVICE *, void *, unsigned long, unsigned long, void *, unsigned long, void *)>::operator()+0x35 [/builds/worker/workspace/obj-build/dist/include/mozilla/DynamicallyLinkedFunctionPtr.h @ 77] 05 (Inline Function) --------`-------- xul!mozilla::mscom::wrapped::CoInitializeSecurity+0xcb [/builds/worker/checkouts/gecko/ipc/mscom/COMWrappers.cpp @ 75] 06 (Inline Function) --------`-------- xul!mozilla::mscom::ProcessRuntime::InitializeSecurity+0x435 [/builds/worker/checkouts/gecko/ipc/mscom/ProcessRuntime.cpp @ 480] 07 00000021`80ffe860 00007fff`0c5fe6ad xul!mozilla::mscom::ProcessRuntime::InitInsideApartment+0x47c [/builds/worker/checkouts/gecko/ipc/mscom/ProcessRuntime.cpp @ 255] 08 (Inline Function) --------`-------- xul!mozilla::mscom::ProcessRuntime::ProcessRuntime+0x1a4 [/builds/worker/checkouts/gecko/ipc/mscom/ProcessRuntime.cpp @ 143] 09 (Inline Function) --------`-------- xul!mozilla::mscom::ProcessRuntime::ProcessRuntime+0x1b0 [/builds/worker/checkouts/gecko/ipc/mscom/ProcessRuntime.cpp @ 47] 0a 00000021`80ffeb60 00007fff`0c5d52dc xul!mozilla::mscom::ProcessRuntime::ProcessRuntime+0x1dd [/builds/worker/checkouts/gecko/ipc/mscom/ProcessRuntime.cpp @ 42] 0b (Inline Function) --------`-------- xul!mozilla::ipc::UtilityProcessImpl::ProcessChild+0x29 [/builds/worker/workspace/obj-build/dist/include/mozilla/ipc/UtilityProcessImpl.h @ 23] 0c (Inline Function) --------`-------- xul!mozilla::MakeUnique+0x3f [/builds/worker/workspace/obj-build/dist/include/mozilla/UniquePtr.h @ 606] 0d (Inline Function) --------`-------- xul!XRE_InitChildProcess+0xe12 [/builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp @ 592] 0e 00000021`80ffec20 00007ff7`e97c3609 xul!mozilla::BootstrapImpl::XRE_InitChildProcess+0xe3c [/builds/worker/checkouts/gecko/toolkit/xre/Bootstrap.cpp @ 63] 0f (Inline Function) --------`-------- firefox!NS_internal_main+0x45c [/builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp @ 403] 10 00000021`80ffeee0 00007ff7`e97e03a8 firefox!wmain+0x2569 [/builds/worker/checkouts/gecko/toolkit/xre/nsWindowsWMain.cpp @ 151] 11 (Inline Function) --------`-------- firefox!invoke_main+0x22 [D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl @ 90] 12 00000021`80fffb50 00007fff`8ec7257d firefox!__scrt_common_main_seh+0x10c [D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl @ 288] 13 00000021`80fffb90 00007fff`8fd2af28 KERNEL32!BaseThreadInitThunk+0x1d 14 00000021`80fffbc0 00000000`00000000 ntdll!RtlUserThreadStart+0x28 ``` But there is indeed a COM call that occured before that with the following call stack: ``` <elided, see next comment> ``` I'm not sure how this relates to Webroot at the moment but I'll keep investigating. Edit: Oh, just realized that the call stack is truncated not because combase didn't record it fully but more likely because I used `dps` without a range. Will post full call stack tomorrow.