512739 - Crash [@ RtlFreeHeap]

Status: RESOLVED INCOMPLETE

(Firefox :: General, defect)

Description

[Kevin Brosnan]

Looks to be a Vista only bug from looking at crash stats 

http://crash-stats.mozilla.com/report/list?product=Firefox&platform=windows&query_search=signature&query_type=startswith&query=RtlFreeHeap&date=&range_value=2&range_unit=weeks&do_query=1&signature=RtlFreeHeap

In the last day there were 3,500 crashes.

On irc I had a user give the following reports. 
bp-b195f8be-2c4b-480a-a597-546552090826 8/26/2009 9:04 AM
bp-83eb3596-cd8d-4e37-9903-e256c2090826 8/26/2009 8:41 AM
bp-dda6b6f8-a574-4428-91d4-850c02090826 8/26/2009 8:35 AM
bp-236504e4-66fe-4cf8-80ea-079912090826 8/26/2009 7:11 AM
bp-5dc34671-6ebf-4a46-83f2-3a00d2090826 8/26/2009 7:11 AM
bp-8f6ac97c-4183-494e-9469-2fd012090826 8/26/2009 7:06 AM
bp-81d71661-3934-4afa-835d-e28642090826 8/26/2009 6:52 AM
bp-f0105129-103f-42ef-8506-a7f152090826 8/26/2009 6:52 AM
bp-ccb3f8a6-07f1-4b34-ad4c-b52762090826 8/26/2009 6:50 AM
bp-01d73109-c5e4-4b28-ae04-1a8592090825 8/26/2009 6:50 AM
bp-85d09904-4a39-4019-a187-2008e2090825 8/25/2009 5:25 PM
bp-97e1de7c-b0a6-4192-b5d2-7adf92090825 8/25/2009 5:23 PM
bp-8078de18-75b1-47ab-a55d-8e2572090825 8/25/2009 5:22 PM
bp-e842648f-8283-4e8a-b3ec-60fbc2090825 8/25/2009 5:20 PM
bp-9469624b-fb08-4061-ab1b-79fe92090825 8/25/2009 5:19 PM
bp-7615f6d9-cf05-48dd-bfce-5377c2090825 8/25/2009 5:19 PM

Nothing particularly malware like listed in the modules section. But given some of the files listed in the modules (anti-virus, Apple's bonjour) sounds sounds like a LSP issue.

Comment 1

[Nelson Bolyard (seldom reads bugmail)]

What evidence suggests this has anything to do with NSS?

Comment 2

[Nelson Bolyard (seldom reads bugmail)]

I don't know who should own this, but I see no indications that it's NSS.

Comment 3

[[:Cww]]

Maybe changing the summary will make the magic crash-stats linking work.

Comment 4

[Jesse]

This is caused by TR/Agent.70656.13

This was found with Avira, and removed with Malwarebytes. I could not visit any site with Mozilla with the Trojan, after scanning with Malwarebyes the trojans were removed and I have no further issues running mozilla.

Comment 5

[(not currently active) Ted Mielczarek]

I think this signature is probably too generic, but most of these crashes really do look like the same thing. And yeah, a lot of them have modules with suspicious names in the stack.

Comment 6

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

The analysis at http://dbaron.org/log/20090922-crashes shows:

  RtlFreeHeap (106 crashes)
    100% (106/106) vs.   6% (451/7100) glu32.dll
    100% (106/106) vs.   6% (452/7100) opengl32.dll
    100% (106/106) vs.  17% (1207/7100) ddraw.dll
    100% (106/106) vs.  17% (1213/7100) dciman32.dll
    100% (106/106) vs.  24% (1700/7100) dhcpcsvc6.DLL
    100% (106/106) vs.  25% (1753/7100) WindowsCodecs.dll
    100% (106/106) vs.  25% (1772/7100) nlaapi.dll
    100% (106/106) vs.  25% (1791/7100) Wldap32.dll
    100% (106/106) vs.  25% (1800/7100) winnsi.dll
    100% (106/106) vs.  25% (1805/7100) IPHLPAPI.DLL
    100% (106/106) vs.  25% (1807/7100) WSHTCPIP.DLL
    100% (106/106) vs.  26% (1825/7100) nsi.dll
    100% (106/106) vs.  26% (1837/7100) dwmapi.dll
     99% (105/106) vs.  25% (1771/7100) NapiNSP.dll
    100% (106/106) vs.  27% (1883/7100) wship6.dll
     98% (104/106) vs.  26% (1822/7100) propsys.dll
    100% (106/106) vs.  28% (2006/7100) powrprof.dll
     96% (102/106) vs.  25% (1787/7100) pnrpnsp.dll
    100% (106/106) vs.  31% (2167/7100) oleacc.dll
    100% (106/106) vs.  39% (2767/7100) lpk.dll
    100% (106/106) vs.  45% (3210/7100) dhcpcsvc.dll
    100% (106/106) vs.  53% (3748/7100) rsaenh.dll
    100% (106/106) vs.  61% (4327/7100) msctf.dll
     55% (58/106) vs.  20% (1428/7100) avrt.dll
     55% (58/106) vs.  20% (1432/7100) MMDevAPI.dll
    100% (106/106) vs.  66% (4694/7100) normaliz.dll
     52% (55/106) vs.  18% (1311/7100) AudioEng.dll
    100% (106/106) vs.  67% (4769/7100) iertutil.dll

Comment 7

[Scoobidiver (away)]

Now that RtlFreeHeap is in the skiplist, I close it as incomplete.