Closed Bug 1005988 Opened 11 years ago Closed 11 years ago

crash in intel_aes_gcmENC

Categories

(NSS :: Libraries, defect, P1)

Product:
NSS
Component:
Libraries
Version:
3.16.1
Platform:
x86
Windows NT
Type:
defect

Tracking

(firefox30 unaffected, firefox31+ verified, firefox32+ verified)

Status:
VERIFIED FIXED
Milestone:
3.16.1
Tracking Flags:
Tracking Status
firefox30 --- unaffected
firefox31 + verified
firefox32 + verified

People

(Reporter: u279076, Assigned: wtc)

Details

(4 keywords)

Crash Data

This bug was filed from the Socorro interface and is report bp-9ffdb662-68a5-42a2-9632-157972140503. ============================================================= 0 freebl3.dll intel_aes_gcmENC security/nss/lib/freebl/intel-gcm-x86-masm.asm 1 @0x2b77800 2 freebl3.dll intel_AES_GCM_EncryptUpdate security/nss/lib/freebl/intel-gcm-wrap.c 3 nss3.dll PL_HashTableLookupConst nsprpub/lib/ds/plhash.c 4 softokn3.dll NSC_Encrypt security/nss/lib/softoken/pkcs11c.c 5 nss3.dll PK11_Encrypt security/nss/lib/pk11wrap/pk11obj.c 6 nss3.dll ssl3_AESGCM security/nss/lib/ssl/ssl3con.c 7 nss3.dll ssl3_CompressMACEncryptRecord security/nss/lib/ssl/ssl3con.c 8 nss3.dll ssl3_SendRecord security/nss/lib/ssl/ssl3con.c 9 nss3.dll ssl3_SendApplicationData security/nss/lib/ssl/ssl3con.c 10 nss3.dll ssl_SecureSend security/nss/lib/ssl/sslsecur.c 11 nss3.dll ssl_Send security/nss/lib/ssl/sslsock.c 12 xul.dll PSMSend security/manager/ssl/src/nsNSSIOLayer.cpp 13 xul.dll nsSSLIOLayerWrite security/manager/ssl/src/nsNSSIOLayer.cpp 14 xul.dll nsSocketOutputStream::Write(char const *,unsigned int,unsigned int *) netwerk/base/src/nsSocketTransport2.cpp 15 xul.dll mozilla::net::nsHttpConnection::OnReadSegment(char const *,unsigned int,unsigned int *) netwerk/protocol/http/nsHttpConnection.cpp 16 xul.dll mozilla::net::SpdySession3::OnReadSegment(char const *,unsigned int,unsigned int *) netwerk/protocol/http/SpdySession3.cpp 17 nss3.dll nss3.dll@0xe240 18 @0x9e1a808 19 xul.dll mozilla::net::SpdyStream3::ReadSegments(mozilla::net::nsAHttpSegmentReader *,unsigned int,unsigned int *) netwerk/protocol/http/SpdyStream3.cpp 20 xul.dll mozilla::net::SpdySession3::ReadSegments(mozilla::net::nsAHttpSegmentReader *,unsigned int,unsigned int *) netwerk/protocol/http/SpdySession3.cpp 21 xul.dll mozilla::net::nsHttpConnection::OnSocketWritable() netwerk/protocol/http/nsHttpConnection.cpp 22 xul.dll nsSocketOutputStream::OnSocketReady(tag_nsresult) netwerk/base/src/nsSocketTransport2.cpp 23 xul.dll nsSocketTransport::OnSocketReady(PRFileDesc *,short) netwerk/base/src/nsSocketTransport2.cpp 24 xul.dll nsSocketTransportService::DoPollIteration(bool) netwerk/base/src/nsSocketTransportService2.cpp 25 xul.dll nsSocketTransportService::Run() netwerk/base/src/nsSocketTransportService2.cpp 26 xul.dll nsThread::ProcessNextEvent(bool,bool *) xpcom/threads/nsThread.cpp 27 xul.dll NS_ProcessNextEvent(nsIThread *,bool) xpcom/glue/nsThreadUtils.cpp 28 xul.dll mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate *) ipc/glue/MessagePump.cpp 29 xul.dll _SEH_epilog4 30 @0x6f3f7e8 31 nss3.dll _PR_NativeRunThread nsprpub/pr/src/threads/combined/pruthr.c 32 nss3.dll pr_root nsprpub/pr/src/md/windows/w95thred.c 33 msvcr100.dll _callthreadstartex f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c 34 msvcr100.dll _threadstartex f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c 35 kernel32.dll kernel32.dll@0x1919f 36 ntdll.dll ntdll.dll@0x4a8cb 37 ntdll.dll ntdll.dll@0x4a8a1 ============================================================= More reports: https://crash-stats.mozilla.com/report/list?product=Firefox&signature=intel_aes_gcmENC This shows up as a new topcrash in Firefox 31. It is current at #4, accounting for 3.49% of all crashes in Firefox 31. According to today's explosiveness report, it first showed up on May 1st, went away on May 2nd, and has been high volume since May 3rd. Note, I am seeing crashes in almost equal share of Firefox 31 and 32, as well as Thunderbird 31/32. Source: https://crash-analysis.mozilla.com/rkaiser/2014-05-04/2014-05-04.firefox.31.explosiveness.html Possible leads: * A couple of the comments mention uploading photos to Facebook. * Intel and NVIDIA make up the top vendors in the correlations so maybe this is with dual GPU systems? * All crashes happen on 32-bit Windows, version 7 or above (Windows 7 has the largest share @ 52%) Add-on Correlations: 31% (4/13) vs. 1% (4/486) jid1-Mc8icFbaxhJLuQ@jetpack 31% (4/13) vs. 1% (5/486) jid1-n85lxPv1NAWVTQ@jetpack 31% (4/13) vs. 1% (6/486) {c36177c0-224a-11da-8cd6-0800200c9a91} (Fasterfox, https://addons.mozilla.org/addon/12878) 38% (5/13) vs. 9% (45/486) {e4a8a97b-f2ed-450b-b12d-ee082ba24781} (Greasemonkey, https://addons.mozilla.org/addon/748) 31% (4/13) vs. 3% (17/486) {e968fc70-8f95-4ab9-9e79-304de2a71ee1} (User Agent Switcher, https://addons.mozilla.org/addon/59) 31% (4/13) vs. 4% (18/486) {19503e42-ca3c-4c27-b1e2-9cdb2170ee34} (FlashGot, https://addons.mozilla.org/addon/220) 31% (4/13) vs. 7% (32/486) support@lastpass.com (LastPass Password Manager, https://addons.mozilla.org/addon/8542) 54% (7/13) vs. 32% (157/486) {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} (Adblock Plus, https://addons.mozilla.org/addon/1865) 15% (2/13) vs. 2% (11/486) artur.dubovoy@gmail.com (Flash Video Downloader, https://addons.mozilla.org/addon/6584) 8% (1/13) vs. 0% (1/486) oldnewsfeed@jetpack 8% (1/13) vs. 0% (1/486) youtubedownloader@anoniamto.com 8% (1/13) vs. 0% (1/486) jid0-IFNJwTT7u9Ns9yrqEzSh8cj2amQ@jetpack 8% (1/13) vs. 0% (1/486) extension@hidemyass.com 8% (1/13) vs. 0% (2/486) e46480cf-7cf6-495e-af69-573053f52c72@b33ab36d-5952-49aa-adb2-a41b3dbe51a5.com 8% (1/13) vs. 1% (5/486) {c0c9a2c7-2e5c-4447-bc53-97718bc91e1b} (Easy YouTube Video Downloader, https://addons.mozilla.org/addon/10137) 15% (2/13) vs. 9% (45/486) {b9db16a4-6edc-47ec-a1f4-b86292ed211d} (Video DownloadHelper, https://addons.mozilla.org/addon/3006) 8% (1/13) vs. 2% (8/486) YoutubeDownloader@PeterOlayev.com (1-Click YouTube Video Downloader, https://addons.mozilla.org/addon/13990) 8% (1/13) vs. 2% (8/486) anti_banner@kaspersky.com 8% (1/13) vs. 2% (9/486) {fe272bd1-5f76-4ea4-8501-a05d35d823fc} 100% (13/13) vs. 94% (458/486) {972ce4c6-7e08-4474-a285-3208198ce6fd} (Default, https://addons.mozilla.org/addon/8150) 8% (1/13) vs. 3% (13/486) personas@christopher.beard (Personas, https://addons.mozilla.org/addon/10900) Module Correlations: 100% (13/13) vs. 48% (232/486) mf.dll 100% (13/13) vs. 48% (232/486) mfreadwrite.dll 100% (13/13) vs. 48% (234/486) mfplat.dll 100% (13/13) vs. 49% (237/486) dxva2.dll 100% (13/13) vs. 52% (255/486) avrt.dll 46% (6/13) vs. 4% (19/486) ntasn1.dll 69% (9/13) vs. 28% (135/486) wshbth.dll 46% (6/13) vs. 6% (28/486) igdusc32.dll 46% (6/13) vs. 6% (28/486) igd10iumd32.dll 46% (6/13) vs. 7% (33/486) RTWorkQ.dll 46% (6/13) vs. 7% (34/486) nvumdshim.dll 46% (6/13) vs. 8% (39/486) nvinit.dll 85% (11/13) vs. 47% (226/486) d3d11.dll 46% (6/13) vs. 9% (46/486) ncrypt.dll 46% (6/13) vs. 11% (54/486) ondemandconnroutehelper.dll 85% (11/13) vs. 51% (249/486) icm32.dll 54% (7/13) vs. 21% (102/486) WINMMBASE.dll 54% (7/13) vs. 21% (102/486) bcryptPrimitives.dll 54% (7/13) vs. 21% (102/486) SHCore.dll 54% (7/13) vs. 21% (102/486) combase.dll 38% (5/13) vs. 6% (29/486) Bcp47Langs.dll 38% (5/13) vs. 6% (29/486) twinapi.dll 92% (12/13) vs. 60% (291/486) d2d1.dll 38% (5/13) vs. 7% (34/486) nvdxgiwrap.dll 38% (5/13) vs. 7% (34/486) nvd3d9wrap.dll 92% (12/13) vs. 61% (296/486) d3d10_1.dll 92% (12/13) vs. 61% (296/486) d3d10_1core.dll 100% (13/13) vs. 70% (338/486) explorerframe.dll 100% (13/13) vs. 70% (338/486) dui70.dll 46% (6/13) vs. 16% (77/486) kernel.appcore.dll 100% (13/13) vs. 70% (339/486) duser.dll 92% (12/13) vs. 63% (308/486) dxgi.dll 38% (5/13) vs. 11% (52/486) IconCodecService.dll 46% (6/13) vs. 19% (90/486) winhttp.dll 100% (13/13) vs. 74% (362/486) FWPUCLNT.DLL 31% (4/13) vs. 6% (28/486) _etoured.dll 31% (4/13) vs. 6% (30/486) lpxpcom.dll 69% (9/13) vs. 45% (221/486) cscapi.dll 92% (12/13) vs. 69% (335/486) apphelp.dll 100% (13/13) vs. 77% (375/486) nlaapi.dll 100% (13/13) vs. 77% (376/486) cryptsp.dll 100% (13/13) vs. 78% (377/486) DWrite.dll 100% (13/13) vs. 78% (377/486) NapiNSP.dll 69% (9/13) vs. 47% (228/486) ntshrui.dll 100% (13/13) vs. 78% (378/486) pnrpnsp.dll 23% (3/13) vs. 1% (6/486) pcacli.dll 23% (3/13) vs. 1% (6/486) MrmCoreR.dll 23% (3/13) vs. 2% (10/486) DevDispItemProvider.dll 23% (3/13) vs. 2% (10/486) provsvc.dll 23% (3/13) vs. 2% (11/486) dlnashext.dll 100% (13/13) vs. 79% (385/486) ntmarta.dll 31% (4/13) vs. 10% (51/486) SearchFolder.dll 31% (4/13) vs. 11% (52/486) davhlpr.dll 46% (6/13) vs. 26% (127/486) mpr.dll 31% (4/13) vs. 11% (53/486) nvStereoApiI.dll 46% (6/13) vs. 26% (128/486) bcrypt.dll 31% (4/13) vs. 11% (55/486) davclnt.dll 31% (4/13) vs. 11% (55/486) ntlanman.dll 31% (4/13) vs. 11% (55/486) nvSCPAPI.dll 31% (4/13) vs. 11% (55/486) drprov.dll 31% (4/13) vs. 12% (57/486) Nv3DVStreaming.dll 31% (4/13) vs. 12% (58/486) StructuredQuery.dll 31% (4/13) vs. 12% (59/486) NetworkExplorer.dll 31% (4/13) vs. 13% (63/486) thumbcache.dll 31% (4/13) vs. 13% (63/486) tiptsf.dll 100% (13/13) vs. 83% (403/486) sspicli.dll 62% (8/13) vs. 45% (217/486) linkinfo.dll 100% (13/13) vs. 83% (404/486) nssckbi.dll 31% (4/13) vs. 14% (68/486) nvapi.dll 100% (13/13) vs. 83% (405/486) nssdbm3.dll 100% (13/13) vs. 83% (405/486) softokn3.dll 31% (4/13) vs. 14% (69/486) actxprxy.dll 23% (3/13) vs. 7% (32/486) devrtl.dll 100% (13/13) vs. 84% (406/486) freebl3.dll 92% (12/13) vs. 76% (370/486) secur32.dll 100% (13/13) vs. 84% (408/486) propsys.dll 23% (3/13) vs. 7% (35/486) sfc_os.dll 100% (13/13) vs. 84% (410/486) samcli.dll 100% (13/13) vs. 84% (410/486) netutils.dll 100% (13/13) vs. 84% (410/486) srvcli.dll 100% (13/13) vs. 84% (410/486) wkscli.dll 31% (4/13) vs. 15% (75/486) nvwgf2um.dll 15% (2/13) vs. 0% (2/486) igdumdim32.dll 54% (7/13) vs. 39% (189/486) dhcpcsvc6.DLL 15% (2/13) vs. 1% (4/486) d3dcompiler_47.dll 100% (13/13) vs. 86% (416/486) rasadhlp.dll 15% (2/13) vs. 1% (5/486) PlayToDevice.dll 38% (5/13) vs. 25% (120/486) msdmo.dll 15% (2/13) vs. 2% (8/486) globinputhost.dll 15% (2/13) vs. 2% (8/486) wpdshext.dll 15% (2/13) vs. 2% (8/486) Windows.Globalization.dll 100% (13/13) vs. 86% (420/486) AudioSes.dll 100% (13/13) vs. 87% (421/486) browsercomps.dll 100% (13/13) vs. 87% (421/486) rsaenh.dll 100% (13/13) vs. 87% (421/486) winrnr.dll 100% (13/13) vs. 87% (421/486) MMDevAPI.dll 100% (13/13) vs. 87% (422/486) firefox.exe 15% (2/13) vs. 2% (11/486) twinapi.appcore.dll 23% (3/13) vs. 10% (49/486) nvspcap.dll 100% (13/13) vs. 87% (423/486) dbghelp.dll 23% (3/13) vs. 10% (50/486) PortableDeviceApi.dll 100% (13/13) vs. 87% (425/486) winnsi.dll 100% (13/13) vs. 87% (425/486) IPHLPAPI.DLL 100% (13/13) vs. 88% (427/486) profapi.dll 15% (2/13) vs. 3% (16/486) PhotoMetadataHandler.dll 54% (7/13) vs. 42% (203/486) ksuser.dll 100% (13/13) vs. 88% (428/486) devobj.dll 15% (2/13) vs. 3% (17/486) mssprxy.dll 100% (13/13) vs. 88% (429/486) cfgmgr32.dll 100% (13/13) vs. 88% (429/486) CRYPTBASE.dll 100% (13/13) vs. 88% (429/486) sechost.dll 100% (13/13) vs. 88% (429/486) KERNELBASE.dll 100% (13/13) vs. 89% (431/486) powrprof.dll 54% (7/13) vs. 43% (208/486) dhcpcsvc.dll 100% (13/13) vs. 89% (433/486) dnsapi.dll 15% (2/13) vs. 5% (22/486) libGLESv2.dll 15% (2/13) vs. 5% (22/486) libEGL.dll 100% (13/13) vs. 90% (435/486) dwmapi.dll 100% (13/13) vs. 90% (435/486) mswsock.dll 100% (13/13) vs. 90% (436/486) nsi.dll 15% (2/13) vs. 6% (27/486) GdiPlus.dll 92% (12/13) vs. 83% (403/486) fastprox.dll 92% (12/13) vs. 83% (403/486) wbemcomn.dll 92% (12/13) vs. 83% (403/486) wbemsvc.dll 23% (3/13) vs. 14% (68/486) xmllite.dll 15% (2/13) vs. 6% (31/486) OFFICE.ODF 92% (12/13) vs. 83% (405/486) wbemprox.dll 31% (4/13) vs. 22% (106/486) winsta.dll 15% (2/13) vs. 7% (32/486) ATL90.dll 38% (5/13) vs. 30% (145/486) WindowsCodecs.dll 23% (3/13) vs. 15% (71/486) msvcr90.dll 100% (13/13) vs. 92% (447/486) msctf.dll 8% (1/13) vs. 0% (1/486) Windows.Media.Streaming.dll 8% (1/13) vs. 0% (1/486) zlib132_tgit.dll 8% (1/13) vs. 0% (1/486) MSWB7.dll 8% (1/13) vs. 0% (1/486) msvcr120.dll 8% (1/13) vs. 0% (1/486) msvcp120.dll 8% (1/13) vs. 0% (1/486) MSVCR120_CLR0400.dll 8% (1/13) vs. 0% (1/486) elslad.dll 8% (1/13) vs. 0% (1/486) libgit232_tgit.dll 8% (1/13) vs. 0% (1/486) ELSCore.dll 8% (1/13) vs. 0% (1/486) uiautomationcore.dll 8% (1/13) vs. 0% (1/486) dfshim.dll 8% (1/13) vs. 0% (2/486) mscoreei.dll 8% (1/13) vs. 0% (2/486) clr.dll 8% (1/13) vs. 0% (2/486) mscoree.dll 8% (1/13) vs. 1% (3/486) DXGIDebug.dll 8% (1/13) vs. 1% (4/486) msftedit.dll 8% (1/13) vs. 1% (4/486) gitdll32.dll 8% (1/13) vs. 1% (4/486) TortoiseGit32.dll 8% (1/13) vs. 1% (4/486) TortoiseGitStub32.dll 15% (2/13) vs. 9% (42/486) GROOVEEX.DLL 8% (1/13) vs. 1% (5/486) wlidprov.dll 8% (1/13) vs. 1% (5/486) TortoiseOverlays.dll 8% (1/13) vs. 1% (5/486) IDStore.dll 8% (1/13) vs. 1% (5/486) WMASF.DLL 8% (1/13) vs. 1% (5/486) WMVCORE.DLL 15% (2/13) vs. 9% (43/486) GrooveIntlResource.dll 8% (1/13) vs. 1% (6/486) anti_banner_native_proxy.dll 8% (1/13) vs. 1% (6/486) BtMmHook.dll 8% (1/13) vs. 1% (6/486) audiodev.dll 8% (1/13) vs. 2% (8/486) windowscodecsext.dll 8% (1/13) vs. 2% (9/486) atiumdag.dll 8% (1/13) vs. 2% (9/486) atiumdva.dll 8% (1/13) vs. 2% (9/486) detoured.dll 8% (1/13) vs. 2% (9/486) atiu9pag.dll 8% (1/13) vs. 2% (10/486) mfnetcore.dll 8% (1/13) vs. 3% (13/486) mfcore.dll
Richard, Benjamin suggested you may be able to have a look at this.
Flags: needinfo?(rlb)
The first report against mozilla-central was with Firefox 32.0a1 20140429030201. https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=4d926af89907&tochange=d7c07694f339 This may implicate bug 993569.
#1 crash for TB31
Keywords: regression, topcrash-thunderbird
tracking-firefox31: ? → +
tracking-firefox32: ? → +
Flags: needinfo?(rlb) → needinfo?(wtc)
Reassigning this to NSS component
Assignee: nobody → nobody
Component: Security → Libraries
Flags: needinfo?(dkeeler)
Product: Core → NSS
Version: Trunk → trunk
Thanks for the bug report. I know about this bug. I will check in a fix today.
Assignee: nobody → wtc
Status: NEW → ASSIGNED
Flags: needinfo?(wtc)
Priority: -- → P1
Target Milestone: --- → 3.16.1
Fixed in mozilla-central: https://hg.mozilla.org/mozilla-central/rev/ca5aed9f1c37 Fixed in mozilla-aurora: https://hg.mozilla.org/releases/mozilla-aurora/rev/0e571cde7fec
Status: ASSIGNED → RESOLVED
Closed: 11 years ago
status-firefox31: affected → fixed
status-firefox32: affected → fixed
Resolution: --- → FIXED
Version: trunk → 3.16.1
Flags: needinfo?(dkeeler)
(In reply to Wan-Teh Chang from comment #7) > Fixed in mozilla-central: > https://hg.mozilla.org/mozilla-central/rev/ca5aed9f1c37 > > Fixed in mozilla-aurora: > https://hg.mozilla.org/releases/mozilla-aurora/rev/0e571cde7fec Thanks for the fast turnaround. I'll give crash-stats a couple days to catch up before I call this verified fixed.
Thanks. Crash is gone from Thunderbird nightly
The last build I see reporting this is from 2014-05-05 which certainly suggests this is fixed in Firefox as well. I'd like to give it a few more days to allow more people to update just to be sure though.
Still no crashes with this signature after the 20140505004003 build. Wan-Teh, is there any other way you can suggest that we test this fix? Thanks!
Status: RESOLVED → VERIFIED
status-firefox31: fixed → verified
status-firefox32: fixed → verified
Liz: The best way to verify this fix is to review the checkin https://hg.mozilla.org/releases/mozilla-aurora/rev/0e571cde7fec. Search for "intel-gcm-x86-masm.asm". You will see that intel-gcm-x86-masm.asm was removed from a makefile and therefore won't be part of Firefox. (The intel_aes_gcmENC function is defined in intel-gcm-x86-masm.asm.) If intel_aes_gcmENC is not part of Firefox, then Firefox cannot possibly crash in intel_aes_gcmENC.
You need to log in before you can comment on or make changes to this bug.