1165877 - crash in rookscom.dll@0x1735 (Trusteer Rapport)

Status: RESOLVED WORKSFORME

(Firefox :: General, defect)

Description

[Robert Kaiser]

This bug was filed from the Socorro interface and is 
report bp-19b06e75-9f34-4457-b0c9-713352150515.
=============================================================

The affected crashes have a ton on rookscom.dll frames coming from an HTTP channel, ending in an Unhandled C++ Exception. This happens on all Windows versions.

http://www.freefixer.com/library/file/rookscom.dll-103961/ tells that the library belongs to Trusteer Rapport, and we see correlations paint that picture as well (see below).

The signature is #12 in 38.0.1, with 1.3% of the total crashes, but as about half of those happen during the first 60 seconds of startup and many people hit it multiple times, it ends up as #2 in Top Crash Scores.

Comments tell that people are hitting it quite a few times and get really angry as they think it's the Firefox upgrade, not their installation of Trusteer Rapport.

From the correlations, it looks like a newer versions of Rapport exists and *might* not crash (we see that there are no people crashing with this exact signature on that newer version, but they seem to be few and that doesn't mean they don't crash elsewhere).

Here's the correlations for 38.0.1 on Windows:

100% (395/395) vs.	2% (796/34262)	RapportGP.dll
100% (395/395) vs.	2% (789/34262)	14590.0.0.0
  0% (0/395)   vs.	0% (7/34262)  	3.5.1412.158

100% (395/395) vs.	2% (853/34262)	TRF.dll
100% (395/395) vs.	2% (789/34262)	5.4.9.5
  0% (0/395)   vs.	0% (64/34262) 	5.9.56.5

100% (395/395) vs.	2% (853/34262)	atl80.dll (8.0.50727.762)

100% (395/395) vs.	2% (853/34262)	RapportUtil.dll
  0% (1/395)   vs.	0% (2/34262)  	3.5.1404.92
100% (394/395) vs.	2% (787/34262)	3.5.1404.94
  0% (0/395)   vs.	0% (64/34262) 	3.5.1412.158

100% (395/395) vs.	2% (855/34262)	rooksdol.dll
100% (395/395) vs.	2% (791/34262)	2.172.0.0
  0% (0/395)   vs.	0% (64/34262) 	2.190.0.0

100% (395/395) vs.	2% (855/34262)	rookscom.dll
100% (395/395) vs.	2% (791/34262)	2.25.0.0
  0% (0/395)   vs.	0% (64/34262) 	2.35.0.0

I guess all those DLLs belong to Trusteer Rapport, given that almost the same amount of crashes come in with them loaded at all (see the part after "vs.") - the amount with the newer versions looks somewhat low, but maybe that's just because they don't crash with this. :)

Comment 1

[Robert Kaiser]

[Tracking Requested - why for this release]:
Outside of the beta and release population, Rapport doesn't seem to be installed much so I can't tell if newer versions are affected, but they might be. Nominating for tracking for release and beta, though.

Comment 2

[Sylvestre Ledru [:Sylvestre]]

David, can you help with that? thanks

Tracking as it is a top crash and almost a startup crash.

Comment 3

[(Away)]

(In reply to Robert Kaiser (:[e-mail]) from comment #0)
> From the correlations, it looks like a newer versions of Rapport exists and
> *might* not crash (we see that there are no people crashing with this exact
> signature on that newer version, but they seem to be few and that doesn't
> mean they don't crash elsewhere).

Indeed, the newer versions crash elsewhere: bp-51e90596-3d65-4128-816e-7ce272150518

rooksbas.dll 	2.126.0.0
rooksdol.dll 	2.190.0.0
rookscom.dll 	2.35.0.0
RapportTanzan380.DLL 	3.5.1412.158
RapportGP.DLL 	3.5.1412.158
RapportUtil.dll 	3.5.1412.158

Comment 4

[(Away)]

From the crash reports, Trusteer seems to have gotten themselves into an infinite recursion, and ran out of stack :(

Comment 5

[(Away)]

We can't do anything about this from the Firefox side.

For a major application we should always try talking to the vendor. Could you or Lawrence get in touch with Trusteer? It seems he successfully made contact in bug 1140287 comment 26.

Comment 6

[Sylvestre Ledru [:Sylvestre]]

Sure. Lawrence, can you get in touch your Trusteer contact (or give me his contact)? Thanks

Comment 7

[Lawrence Mandel [:lmandel] (use needinfo)]

Sylvestre - I added the contacts to the relman rolodex. Can you please follow up on this one?

Comment 8

[Sylvestre Ledru [:Sylvestre]]

Sure, I contacted them. Thanks!

Comment 9

[Sylvestre Ledru [:Sylvestre]]

They already replied:
"We found the problem and we will start to deploy a fix at the beginning of the week. "

Comment 10

[Sylvestre Ledru [:Sylvestre]]

More info:
"This fix is expected to reach the entire population mid next week."

Comment 11

[:Gijs (he/him)]

(In reply to Sylvestre Ledru [:sylvestre] from comment #10)
> More info:
> "This fix is expected to reach the entire population mid next week."

Based on this and lack of current reports, resolving as wfm.