699776 - crash in nsXPTCStubBase::QueryInterface involving RapportTanzan7.dll or RapportTanzan8.DLL in the stack

Status: NEW

(External Software Affecting Firefox :: Other, defect, P3)

Description

[Robert Kaiser]

This bug was filed from the Socorro interface and is 
report bp-03f624e3-7c3e-4c5b-899e-2952e2111104 .
============================================================= 

Top frames:

0 	ntdll.dll 	KiFastSystemCallRet 	
1 	ntdll.dll 	ZwWaitForSingleObject 	
2 	kernel32.dll 	WaitForSingleObjectEx 	
3 	kernel32.dll 	WaitForSingleObject 	
4 	xul.dll 	google_breakpad::ExceptionHandler::WriteMinidumpOnHandlerThread 	toolkit/crashreporter/google-breakpad/src/client/windows/handler/exception_handler.cc:763
5 	xul.dll 	google_breakpad::ExceptionHandler::HandlePureVirtualCall 	toolkit/crashreporter/google-breakpad/src/client/windows/handler/exception_handler.cc:707
6 	mozcrt19.dll 	_purecall 	obj-firefox/memory/jemalloc/crtsrc/purevirt.c:47
7 	xul.dll 	nsXPTCStubBase::QueryInterface 	
8 	RapportTanzan7.dll 	RapportTanzan7.dll@0x3dc3 	
9 	RapportTanzan7.dll 	RapportTanzan7.dll@0x8db0 	
10 	RapportTanzan7.dll 	RapportTanzan7.dll@0xc0d1 	
11 		@0x7121ffff 	
12 	xul.dll 	XPC_WN_CallMethod 	js/src/xpconnect/src/xpcwrappednativejsops.cpp:1592


This signature had a few crash occurrences on 7 before yesterday, but spiked extremely sharply that day, it's up to #8 topcrash or 1393 processed (i.e. ~14000 reported!) crashes or 177 crashes per million ADU in yesterday's data for Firefox 7.

RapportTanzan7.dll is part of Trusteer Rapport - http://www.trusteer.com/product/trusteer-rapport - which is a security suite.

For some reason, I couldn't see correlation reports for this, but looking into some of the reports, it looks like it's version 3.5.1108.52 of this DLL that is involved in the crashes.

We'll probably need to reach out to Trusteer for this.

Comment 1

[Robert Kaiser]

https://crash-stats.mozilla.com/report/list?signature=_purecall%20%7C%20nsXPTCStubBase%3A%3AQueryInterface%28nsID%20const%26%2C%20void%2A%2A%29 for more reports with that signature, btw.

Comment 2

[Loic]

Another crash from a user: https://crash-stats.mozilla.com/report/index/14b975a3-531a-46e5-b880-e2d0c2111104
It looks like the crashes appear when the add-on WebMail Notifier (2.8 or 2.8.1) https://addons.mozilla.org/en-US/firefox/addon/webmail-notifier/ is installed. Maybe just a false-positive...
RapportTanzan7.DLL is involved too.

Comment 3

[Loic]

I found tis topic http://support.mozilla.com/fr/questions/887181 related to this crash. The culprit could be the program Rapport from from Trusteer Ltd that is aware of the issue. Upgrading to the new program version (Emerald Build 1108.47) of Rapport would seem to resolve the issue: http://www.trusteer.com/webform/download-rapport

I can't confirm because I'm just reporting this issue from another user but maybe it can help.

Comment 5

[Loic]

I read 2 support topics about fixing that bug. Removing software Rapport from Trusteer Ltd has fixed the issue, and FF is able to work again without crash.

Comment 6

[John Hesling [:John99] (NeedInfo me)]

Is it useful to note that Trusteer could cause crashes resulting in 
empty strings such as bp-a2061e06-079b-4078-9815-54fc12111104 
(from sumo https://support.mozilla.com/en-US/questions/892644 )

Per posters in the Sumo forum Trusteer is aware of problems eg https://support.mozilla.com/en-US/questions/892720#answer-270676

Comment 7

[Robert Kaiser]

This has arrived on 8 now and is the #6 topcrash there in yesterdaay's data - the library is RapportTanzan8.DLL in those stacks.

Comment 8

[[:Cww]]

Kev: I'm not sure that just because trusteer is telling users that "we're aware of the problem" that they are aware of how many users are being affected or know exactly what's going on.  Is there a way we can reach out?

Comment 9

[Loic]

(In reply to [:Cww] from comment #8)
> Is there a way we can reach out?

Yes, here: http://www.trusteer.com/support/submit-ticket

Comment 10

[Marcia Knous [:marcia]]

I am also seeing crashes in the explosive report related to https://crash-stats.mozilla.com/report/list?signature=nsBaseAppShell%3A%3AOnProcessNextEvent%28nsIThreadInternal*%2C%20int%2C%20unsigned%20int%29.

Correlations for that one show a different version of RapportTanzan:

126% (199/158) vs.  19% (8275/43766) msvcr80.dll
98% (155/158) vs.   3% (1273/43766) riched20.dll
98% (155/158) vs.   3% (1300/43766) atl80.dll
98% (155/158) vs.   3% (1327/43766) RapportUtil.dll
98% (155/158) vs.   3% (1328/43766) rooksdol.dll
98% (155/158) vs.   3% (1328/43766) rookscom.dll
98% (155/158) vs.   3% (1345/43766) rooksbas.dll
98% (155/158) vs.   7% (2946/43766) msvcp80.dll
99% (156/158) vs.  12% (5414/43766) GdiPlus.dll
83% (131/158) vs.   2% (728/43766) RapportTanzan8.DLL

Comment 11

[Marcia Knous [:marcia]]

Adding other related signatures. In the last week this signature has 19302 crashes across all versions.

Comment 12

[Scoobidiver (away)]

It seems to be fixed in Trusteer Rapport 3.5.1108.55:
* _purecall | nsXPTCStubBase::QueryInterface(nsID const&, void**):
    53% (210/394) vs.   1% (709/95929) RapportTanzan8.DLL
         52% (203/394) vs.   1% (576/95929) 3.5.1108.52
          2% (7/394) vs.   0% (16/95929) 3.5.1108.53
          0% (0/394) vs.   0% (54/95929) 3.5.1108.54
          0% (0/394) vs.   0% (63/95929) 3.5.1108.55
     46% (182/394) vs.   1% (588/95929) RapportTanzan8.dll
         43% (168/394) vs.   0% (432/95929) 3.5.1108.52
          4% (14/394) vs.   0% (21/95929) 3.5.1108.53
          0% (0/394) vs.   0% (44/95929) 3.5.1108.54
          0% (0/394) vs.   0% (91/95929) 3.5.1108.55
* nsBaseAppShell::OnProcessNextEvent(nsIThreadInternal*, int, unsigned int):
     28% (13/47) vs.   1% (709/95929) RapportTanzan8.DLL
         23% (11/47) vs.   1% (576/95929) 3.5.1108.52
          0% (0/47) vs.   0% (16/95929) 3.5.1108.53
          4% (2/47) vs.   0% (54/95929) 3.5.1108.54
          0% (0/47) vs.   0% (63/95929) 3.5.1108.55
     57% (27/47) vs.   1% (588/95929) RapportTanzan8.dll
         51% (24/47) vs.   0% (432/95929) 3.5.1108.52
          0% (0/47) vs.   0% (21/95929) 3.5.1108.53
          6% (3/47) vs.   0% (44/95929) 3.5.1108.54
          0% (0/47) vs.   0% (91/95929) 3.5.1108.55

Comment 13

[Loic]

Attachment: Trusteer RapportSetup.exe 3.5.1105.45 (2011:07:07)

I joined an old version of Trusteer Rapport for Windows OS, v3.5.1105.45 from July 2011, if someone wants to reproduce the crashes of Firefox.

Comment 14

[Kev Needham [:kev]]

Trusteer appears to be based in Israel, and voicemail has been left at the general inquiries desk asking for a product or engineering contact to call. Further, a trouble ticket has been opened (PDX-110348) asking for a product contact to get in touch with us ASAP, and informing them that the crash is a potential blocklist candidate.

Comment 15

[Marcia Knous [:marcia]]

Bug 691847#c21 has the version I tested in the lab. Version 1108.55 seems to not cause a crash in my testing. So if we block versions below that I assume that would be okay. The issue is we have to correlate that to the proper dll. The dlls that we saw associated with these crashes were RapportTanzan7.dll and RapportTanzan8.DLL. In the bin directory there are a quite a few versions of the dll up to 36.

Comment 16

[BugBot [:suhaib / :marco/ :calixte]]

Since the crash volume is low (less than 5 per week), the severity is downgraded to S3. Feel free to change it back if you think the bug is still critical.

For more information, please visit auto_nag documentation.