Closed Bug 1005988 Opened 10 years ago Closed 10 years ago

crash in intel_aes_gcmENC

Categories

(NSS :: Libraries, defect, P1)

3.16.1
x86
Windows NT
defect

Tracking

(firefox30 unaffected, firefox31+ verified, firefox32+ verified)

VERIFIED FIXED
3.16.1
Tracking Status
firefox30 --- unaffected
firefox31 + verified
firefox32 + verified

People

(Reporter: u279076, Assigned: wtc)

Details

(4 keywords)

Crash Data

This bug was filed from the Socorro interface and is 
report bp-9ffdb662-68a5-42a2-9632-157972140503.
=============================================================
0 	freebl3.dll 	intel_aes_gcmENC 	security/nss/lib/freebl/intel-gcm-x86-masm.asm
1 		@0x2b77800 	
2 	freebl3.dll 	intel_AES_GCM_EncryptUpdate 	security/nss/lib/freebl/intel-gcm-wrap.c
3 	nss3.dll 	PL_HashTableLookupConst 	nsprpub/lib/ds/plhash.c
4 	softokn3.dll 	NSC_Encrypt 	security/nss/lib/softoken/pkcs11c.c
5 	nss3.dll 	PK11_Encrypt 	security/nss/lib/pk11wrap/pk11obj.c
6 	nss3.dll 	ssl3_AESGCM 	security/nss/lib/ssl/ssl3con.c
7 	nss3.dll 	ssl3_CompressMACEncryptRecord 	security/nss/lib/ssl/ssl3con.c
8 	nss3.dll 	ssl3_SendRecord 	security/nss/lib/ssl/ssl3con.c
9 	nss3.dll 	ssl3_SendApplicationData 	security/nss/lib/ssl/ssl3con.c
10 	nss3.dll 	ssl_SecureSend 	security/nss/lib/ssl/sslsecur.c
11 	nss3.dll 	ssl_Send 	security/nss/lib/ssl/sslsock.c
12 	xul.dll 	PSMSend 	security/manager/ssl/src/nsNSSIOLayer.cpp
13 	xul.dll 	nsSSLIOLayerWrite 	security/manager/ssl/src/nsNSSIOLayer.cpp
14 	xul.dll 	nsSocketOutputStream::Write(char const *,unsigned int,unsigned int *) 	netwerk/base/src/nsSocketTransport2.cpp
15 	xul.dll 	mozilla::net::nsHttpConnection::OnReadSegment(char const *,unsigned int,unsigned int *) 	netwerk/protocol/http/nsHttpConnection.cpp
16 	xul.dll 	mozilla::net::SpdySession3::OnReadSegment(char const *,unsigned int,unsigned int *) 	netwerk/protocol/http/SpdySession3.cpp
17 	nss3.dll 	nss3.dll@0xe240 	
18 		@0x9e1a808 	
19 	xul.dll 	mozilla::net::SpdyStream3::ReadSegments(mozilla::net::nsAHttpSegmentReader *,unsigned int,unsigned int *) 	netwerk/protocol/http/SpdyStream3.cpp
20 	xul.dll 	mozilla::net::SpdySession3::ReadSegments(mozilla::net::nsAHttpSegmentReader *,unsigned int,unsigned int *) 	netwerk/protocol/http/SpdySession3.cpp
21 	xul.dll 	mozilla::net::nsHttpConnection::OnSocketWritable() 	netwerk/protocol/http/nsHttpConnection.cpp
22 	xul.dll 	nsSocketOutputStream::OnSocketReady(tag_nsresult) 	netwerk/base/src/nsSocketTransport2.cpp
23 	xul.dll 	nsSocketTransport::OnSocketReady(PRFileDesc *,short) 	netwerk/base/src/nsSocketTransport2.cpp
24 	xul.dll 	nsSocketTransportService::DoPollIteration(bool) 	netwerk/base/src/nsSocketTransportService2.cpp
25 	xul.dll 	nsSocketTransportService::Run() 	netwerk/base/src/nsSocketTransportService2.cpp
26 	xul.dll 	nsThread::ProcessNextEvent(bool,bool *) 	xpcom/threads/nsThread.cpp
27 	xul.dll 	NS_ProcessNextEvent(nsIThread *,bool) 	xpcom/glue/nsThreadUtils.cpp
28 	xul.dll 	mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate *) 	ipc/glue/MessagePump.cpp
29 	xul.dll 	_SEH_epilog4 	
30 		@0x6f3f7e8 	
31 	nss3.dll 	_PR_NativeRunThread 	nsprpub/pr/src/threads/combined/pruthr.c
32 	nss3.dll 	pr_root 	nsprpub/pr/src/md/windows/w95thred.c
33 	msvcr100.dll 	_callthreadstartex 	f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c
34 	msvcr100.dll 	_threadstartex 	f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c
35 	kernel32.dll 	kernel32.dll@0x1919f 	
36 	ntdll.dll 	ntdll.dll@0x4a8cb 	
37 	ntdll.dll 	ntdll.dll@0x4a8a1 	
=============================================================
More reports:
https://crash-stats.mozilla.com/report/list?product=Firefox&signature=intel_aes_gcmENC

This shows up as a new topcrash in Firefox 31. It is current at #4, accounting for 3.49% of all crashes in Firefox 31. According to today's explosiveness report, it first showed up on May 1st, went away on May 2nd, and has been high volume since May 3rd.

Note, I am seeing crashes in almost equal share of Firefox 31 and 32, as well as Thunderbird 31/32.

Source:
https://crash-analysis.mozilla.com/rkaiser/2014-05-04/2014-05-04.firefox.31.explosiveness.html

Possible leads:
* A couple of the comments mention uploading photos to Facebook.
* Intel and NVIDIA make up the top vendors in the correlations so maybe this is with dual GPU systems?
* All crashes happen on 32-bit Windows, version 7 or above (Windows 7 has the largest share @ 52%)

Add-on Correlations:
31% (4/13) vs.   1% (4/486) jid1-Mc8icFbaxhJLuQ@jetpack
31% (4/13) vs.   1% (5/486) jid1-n85lxPv1NAWVTQ@jetpack
31% (4/13) vs.   1% (6/486) {c36177c0-224a-11da-8cd6-0800200c9a91} (Fasterfox, https://addons.mozilla.org/addon/12878)
38% (5/13) vs.   9% (45/486) {e4a8a97b-f2ed-450b-b12d-ee082ba24781} (Greasemonkey, https://addons.mozilla.org/addon/748)
31% (4/13) vs.   3% (17/486) {e968fc70-8f95-4ab9-9e79-304de2a71ee1} (User Agent Switcher, https://addons.mozilla.org/addon/59)
31% (4/13) vs.   4% (18/486) {19503e42-ca3c-4c27-b1e2-9cdb2170ee34} (FlashGot, https://addons.mozilla.org/addon/220)
31% (4/13) vs.   7% (32/486) support@lastpass.com (LastPass Password Manager, https://addons.mozilla.org/addon/8542)
54% (7/13) vs.  32% (157/486) {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} (Adblock Plus, https://addons.mozilla.org/addon/1865)
15% (2/13) vs.   2% (11/486) artur.dubovoy@gmail.com (Flash Video Downloader, https://addons.mozilla.org/addon/6584)
8% (1/13) vs.   0% (1/486) oldnewsfeed@jetpack
8% (1/13) vs.   0% (1/486) youtubedownloader@anoniamto.com
8% (1/13) vs.   0% (1/486) jid0-IFNJwTT7u9Ns9yrqEzSh8cj2amQ@jetpack
8% (1/13) vs.   0% (1/486) extension@hidemyass.com
8% (1/13) vs.   0% (2/486) e46480cf-7cf6-495e-af69-573053f52c72@b33ab36d-5952-49aa-adb2-a41b3dbe51a5.com
8% (1/13) vs.   1% (5/486) {c0c9a2c7-2e5c-4447-bc53-97718bc91e1b} (Easy YouTube Video Downloader, https://addons.mozilla.org/addon/10137)
15% (2/13) vs.   9% (45/486) {b9db16a4-6edc-47ec-a1f4-b86292ed211d} (Video DownloadHelper, https://addons.mozilla.org/addon/3006)
8% (1/13) vs.   2% (8/486) YoutubeDownloader@PeterOlayev.com (1-Click YouTube Video Downloader, https://addons.mozilla.org/addon/13990)
8% (1/13) vs.   2% (8/486) anti_banner@kaspersky.com
8% (1/13) vs.   2% (9/486) {fe272bd1-5f76-4ea4-8501-a05d35d823fc}
100% (13/13) vs.  94% (458/486) {972ce4c6-7e08-4474-a285-3208198ce6fd} (Default, https://addons.mozilla.org/addon/8150)
8% (1/13) vs.   3% (13/486) personas@christopher.beard (Personas, https://addons.mozilla.org/addon/10900)

Module Correlations:
100% (13/13) vs.  48% (232/486) mf.dll
100% (13/13) vs.  48% (232/486) mfreadwrite.dll
100% (13/13) vs.  48% (234/486) mfplat.dll
100% (13/13) vs.  49% (237/486) dxva2.dll
100% (13/13) vs.  52% (255/486) avrt.dll
46% (6/13) vs.   4% (19/486) ntasn1.dll
69% (9/13) vs.  28% (135/486) wshbth.dll
46% (6/13) vs.   6% (28/486) igdusc32.dll
46% (6/13) vs.   6% (28/486) igd10iumd32.dll
46% (6/13) vs.   7% (33/486) RTWorkQ.dll
46% (6/13) vs.   7% (34/486) nvumdshim.dll
46% (6/13) vs.   8% (39/486) nvinit.dll
85% (11/13) vs.  47% (226/486) d3d11.dll
46% (6/13) vs.   9% (46/486) ncrypt.dll
46% (6/13) vs.  11% (54/486) ondemandconnroutehelper.dll
85% (11/13) vs.  51% (249/486) icm32.dll
54% (7/13) vs.  21% (102/486) WINMMBASE.dll
54% (7/13) vs.  21% (102/486) bcryptPrimitives.dll
54% (7/13) vs.  21% (102/486) SHCore.dll
54% (7/13) vs.  21% (102/486) combase.dll
38% (5/13) vs.   6% (29/486) Bcp47Langs.dll
38% (5/13) vs.   6% (29/486) twinapi.dll
92% (12/13) vs.  60% (291/486) d2d1.dll
38% (5/13) vs.   7% (34/486) nvdxgiwrap.dll
38% (5/13) vs.   7% (34/486) nvd3d9wrap.dll
92% (12/13) vs.  61% (296/486) d3d10_1.dll
92% (12/13) vs.  61% (296/486) d3d10_1core.dll
100% (13/13) vs.  70% (338/486) explorerframe.dll
100% (13/13) vs.  70% (338/486) dui70.dll
46% (6/13) vs.  16% (77/486) kernel.appcore.dll
100% (13/13) vs.  70% (339/486) duser.dll
92% (12/13) vs.  63% (308/486) dxgi.dll
38% (5/13) vs.  11% (52/486) IconCodecService.dll
46% (6/13) vs.  19% (90/486) winhttp.dll
100% (13/13) vs.  74% (362/486) FWPUCLNT.DLL
31% (4/13) vs.   6% (28/486) _etoured.dll
31% (4/13) vs.   6% (30/486) lpxpcom.dll
69% (9/13) vs.  45% (221/486) cscapi.dll
92% (12/13) vs.  69% (335/486) apphelp.dll
100% (13/13) vs.  77% (375/486) nlaapi.dll
100% (13/13) vs.  77% (376/486) cryptsp.dll
100% (13/13) vs.  78% (377/486) DWrite.dll
100% (13/13) vs.  78% (377/486) NapiNSP.dll
69% (9/13) vs.  47% (228/486) ntshrui.dll
100% (13/13) vs.  78% (378/486) pnrpnsp.dll
23% (3/13) vs.   1% (6/486) pcacli.dll
23% (3/13) vs.   1% (6/486) MrmCoreR.dll
23% (3/13) vs.   2% (10/486) DevDispItemProvider.dll
23% (3/13) vs.   2% (10/486) provsvc.dll
23% (3/13) vs.   2% (11/486) dlnashext.dll
100% (13/13) vs.  79% (385/486) ntmarta.dll
31% (4/13) vs.  10% (51/486) SearchFolder.dll
31% (4/13) vs.  11% (52/486) davhlpr.dll
46% (6/13) vs.  26% (127/486) mpr.dll
31% (4/13) vs.  11% (53/486) nvStereoApiI.dll
46% (6/13) vs.  26% (128/486) bcrypt.dll
31% (4/13) vs.  11% (55/486) davclnt.dll
31% (4/13) vs.  11% (55/486) ntlanman.dll
31% (4/13) vs.  11% (55/486) nvSCPAPI.dll
31% (4/13) vs.  11% (55/486) drprov.dll
31% (4/13) vs.  12% (57/486) Nv3DVStreaming.dll
31% (4/13) vs.  12% (58/486) StructuredQuery.dll
31% (4/13) vs.  12% (59/486) NetworkExplorer.dll
31% (4/13) vs.  13% (63/486) thumbcache.dll
31% (4/13) vs.  13% (63/486) tiptsf.dll
100% (13/13) vs.  83% (403/486) sspicli.dll
62% (8/13) vs.  45% (217/486) linkinfo.dll
100% (13/13) vs.  83% (404/486) nssckbi.dll
31% (4/13) vs.  14% (68/486) nvapi.dll
100% (13/13) vs.  83% (405/486) nssdbm3.dll
100% (13/13) vs.  83% (405/486) softokn3.dll
31% (4/13) vs.  14% (69/486) actxprxy.dll
23% (3/13) vs.   7% (32/486) devrtl.dll
100% (13/13) vs.  84% (406/486) freebl3.dll
92% (12/13) vs.  76% (370/486) secur32.dll
100% (13/13) vs.  84% (408/486) propsys.dll
23% (3/13) vs.   7% (35/486) sfc_os.dll
100% (13/13) vs.  84% (410/486) samcli.dll
100% (13/13) vs.  84% (410/486) netutils.dll
100% (13/13) vs.  84% (410/486) srvcli.dll
100% (13/13) vs.  84% (410/486) wkscli.dll
31% (4/13) vs.  15% (75/486) nvwgf2um.dll
15% (2/13) vs.   0% (2/486) igdumdim32.dll
54% (7/13) vs.  39% (189/486) dhcpcsvc6.DLL
15% (2/13) vs.   1% (4/486) d3dcompiler_47.dll
100% (13/13) vs.  86% (416/486) rasadhlp.dll
15% (2/13) vs.   1% (5/486) PlayToDevice.dll
38% (5/13) vs.  25% (120/486) msdmo.dll
15% (2/13) vs.   2% (8/486) globinputhost.dll
15% (2/13) vs.   2% (8/486) wpdshext.dll
15% (2/13) vs.   2% (8/486) Windows.Globalization.dll
100% (13/13) vs.  86% (420/486) AudioSes.dll
100% (13/13) vs.  87% (421/486) browsercomps.dll
100% (13/13) vs.  87% (421/486) rsaenh.dll
100% (13/13) vs.  87% (421/486) winrnr.dll
100% (13/13) vs.  87% (421/486) MMDevAPI.dll
100% (13/13) vs.  87% (422/486) firefox.exe
15% (2/13) vs.   2% (11/486) twinapi.appcore.dll
23% (3/13) vs.  10% (49/486) nvspcap.dll
100% (13/13) vs.  87% (423/486) dbghelp.dll
23% (3/13) vs.  10% (50/486) PortableDeviceApi.dll
100% (13/13) vs.  87% (425/486) winnsi.dll
100% (13/13) vs.  87% (425/486) IPHLPAPI.DLL
100% (13/13) vs.  88% (427/486) profapi.dll
15% (2/13) vs.   3% (16/486) PhotoMetadataHandler.dll
54% (7/13) vs.  42% (203/486) ksuser.dll
100% (13/13) vs.  88% (428/486) devobj.dll
15% (2/13) vs.   3% (17/486) mssprxy.dll
100% (13/13) vs.  88% (429/486) cfgmgr32.dll
100% (13/13) vs.  88% (429/486) CRYPTBASE.dll
100% (13/13) vs.  88% (429/486) sechost.dll
100% (13/13) vs.  88% (429/486) KERNELBASE.dll
100% (13/13) vs.  89% (431/486) powrprof.dll
54% (7/13) vs.  43% (208/486) dhcpcsvc.dll
100% (13/13) vs.  89% (433/486) dnsapi.dll
15% (2/13) vs.   5% (22/486) libGLESv2.dll
15% (2/13) vs.   5% (22/486) libEGL.dll
100% (13/13) vs.  90% (435/486) dwmapi.dll
100% (13/13) vs.  90% (435/486) mswsock.dll
100% (13/13) vs.  90% (436/486) nsi.dll
15% (2/13) vs.   6% (27/486) GdiPlus.dll
92% (12/13) vs.  83% (403/486) fastprox.dll
92% (12/13) vs.  83% (403/486) wbemcomn.dll
92% (12/13) vs.  83% (403/486) wbemsvc.dll
23% (3/13) vs.  14% (68/486) xmllite.dll
15% (2/13) vs.   6% (31/486) OFFICE.ODF
92% (12/13) vs.  83% (405/486) wbemprox.dll
31% (4/13) vs.  22% (106/486) winsta.dll
15% (2/13) vs.   7% (32/486) ATL90.dll
38% (5/13) vs.  30% (145/486) WindowsCodecs.dll
23% (3/13) vs.  15% (71/486) msvcr90.dll
100% (13/13) vs.  92% (447/486) msctf.dll
8% (1/13) vs.   0% (1/486) Windows.Media.Streaming.dll
8% (1/13) vs.   0% (1/486) zlib132_tgit.dll
8% (1/13) vs.   0% (1/486) MSWB7.dll
8% (1/13) vs.   0% (1/486) msvcr120.dll
8% (1/13) vs.   0% (1/486) msvcp120.dll
8% (1/13) vs.   0% (1/486) MSVCR120_CLR0400.dll
8% (1/13) vs.   0% (1/486) elslad.dll
8% (1/13) vs.   0% (1/486) libgit232_tgit.dll
8% (1/13) vs.   0% (1/486) ELSCore.dll
8% (1/13) vs.   0% (1/486) uiautomationcore.dll
8% (1/13) vs.   0% (1/486) dfshim.dll
8% (1/13) vs.   0% (2/486) mscoreei.dll
8% (1/13) vs.   0% (2/486) clr.dll
8% (1/13) vs.   0% (2/486) mscoree.dll
8% (1/13) vs.   1% (3/486) DXGIDebug.dll
8% (1/13) vs.   1% (4/486) msftedit.dll
8% (1/13) vs.   1% (4/486) gitdll32.dll
8% (1/13) vs.   1% (4/486) TortoiseGit32.dll
8% (1/13) vs.   1% (4/486) TortoiseGitStub32.dll
15% (2/13) vs.   9% (42/486) GROOVEEX.DLL
8% (1/13) vs.   1% (5/486) wlidprov.dll
8% (1/13) vs.   1% (5/486) TortoiseOverlays.dll
8% (1/13) vs.   1% (5/486) IDStore.dll
8% (1/13) vs.   1% (5/486) WMASF.DLL
8% (1/13) vs.   1% (5/486) WMVCORE.DLL
15% (2/13) vs.   9% (43/486) GrooveIntlResource.dll
8% (1/13) vs.   1% (6/486) anti_banner_native_proxy.dll
8% (1/13) vs.   1% (6/486) BtMmHook.dll
8% (1/13) vs.   1% (6/486) audiodev.dll
8% (1/13) vs.   2% (8/486) windowscodecsext.dll
8% (1/13) vs.   2% (9/486) atiumdag.dll
8% (1/13) vs.   2% (9/486) atiumdva.dll
8% (1/13) vs.   2% (9/486) detoured.dll
8% (1/13) vs.   2% (9/486) atiu9pag.dll
8% (1/13) vs.   2% (10/486) mfnetcore.dll
8% (1/13) vs.   3% (13/486) mfcore.dll
Richard, Benjamin suggested you may be able to have a look at this.
Flags: needinfo?(rlb)
The first report against mozilla-central was with Firefox 32.0a1 20140429030201.
https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=4d926af89907&tochange=d7c07694f339

This may implicate bug 993569.
#1 crash for TB31
Flags: needinfo?(rlb) → needinfo?(wtc)
Reassigning this to NSS component
Assignee: nobody → nobody
Component: Security → Libraries
Flags: needinfo?(dkeeler)
Product: Core → NSS
Version: Trunk → trunk
Thanks for the bug report. I know about this bug. I will check in a fix
today.
Assignee: nobody → wtc
Status: NEW → ASSIGNED
Flags: needinfo?(wtc)
Priority: -- → P1
Target Milestone: --- → 3.16.1
Fixed in mozilla-central: https://hg.mozilla.org/mozilla-central/rev/ca5aed9f1c37

Fixed in mozilla-aurora: https://hg.mozilla.org/releases/mozilla-aurora/rev/0e571cde7fec
Status: ASSIGNED → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
Version: trunk → 3.16.1
Flags: needinfo?(dkeeler)
(In reply to Wan-Teh Chang from comment #7)
> Fixed in mozilla-central:
> https://hg.mozilla.org/mozilla-central/rev/ca5aed9f1c37
> 
> Fixed in mozilla-aurora:
> https://hg.mozilla.org/releases/mozilla-aurora/rev/0e571cde7fec

Thanks for the fast turnaround. I'll give crash-stats a couple days to catch up before I call this verified fixed.
Thanks.
Crash is gone from Thunderbird nightly
The last build I see reporting this is from 2014-05-05 which certainly suggests this is fixed in Firefox as well. I'd like to give it a few more days to allow more people to update just to be sure though.
Still no crashes with this signature after the 20140505004003 build. 

Wan-Teh, is there any other way you can suggest that we test this fix?  Thanks!
Status: RESOLVED → VERIFIED
Liz:

The best way to verify this fix is to review the checkin
https://hg.mozilla.org/releases/mozilla-aurora/rev/0e571cde7fec.
Search for "intel-gcm-x86-masm.asm". You will see that
intel-gcm-x86-masm.asm was removed from a makefile and
therefore won't be part of Firefox. (The intel_aes_gcmENC
function is defined in intel-gcm-x86-masm.asm.)

If intel_aes_gcmENC is not part of Firefox, then Firefox
cannot possibly crash in intel_aes_gcmENC.
You need to log in before you can comment on or make changes to this bug.