1189319 - Windows 10 crash in kernelbase.dll@0xb3e28 with Trusteer Rapport

Status: RESOLVED WORKSFORME

(Firefox :: General, defect)

Description

[[:philipp]]

This bug was filed from the Socorro interface and is 
report bp-ff46b2ec-2341-4848-97a8-5975e2150730.
=============================================================

Crashing Thread
Frame 	Module 	Signature 	Source
Ø 0 	kernelbase.dll 	kernelbase.dll@0xb3e28 	
1 	msvcr80.dll 	_CxxThrowException 	f:\sp\vctools\crt_bld\self_x86\crt\prebuild\eh\throw.cpp:159
2 	msvcr80.dll 	operator new(unsigned int) 	f:\sp\vctools\crt_bld\self_x86\crt\src\new.cpp:63
Ø 3 	rapportgp.dll 	rapportgp.dll@0xaf811 	
Ø 4 	rapportgp.dll 	rapportgp.dll@0xb04c0 	
Ø 5 	rapportgp.dll 	rapportgp.dll@0xb05e1 	
Ø 6 	rapportgp.dll 	rapportgp.dll@0xb1a72 	
Ø 7 	rapportgp.dll 	rapportgp.dll@0x22b4e 	
Ø 8 	rapportgp.dll 	rapportgp.dll@0x23121 	
Ø 9 	rapportgp.dll 	rapportgp.dll@0x109c0 	
Ø 10 	rapportgp.dll 	rapportgp.dll@0x24969 	
Ø 11 	rapportgp.dll 	rapportgp.dll@0x24d65 	
Ø 12 	rapportgp.dll 	rapportgp.dll@0x2172e 	
Ø 13 	rapportgp.dll 	rapportgp.dll@0x21762 	
Ø 14 	ntdll.dll 	ntdll.dll@0x5a063 	
Ø 15 	ntdll.dll 	ntdll.dll@0x5a02e

most of the time it's a startup crash and comments indicate that this started after the windows 10 update. can we do some outreach to ibm/trusteer rapport?

Comment 1

[[:philipp]]

[Tracking Requested - why for this release]:
to get this on the radar of relman

Comment 2

[jen strickland :jenstrickland]

Tracked for 40 as this is a critical crash on Win10.

Comment 3

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

David, KaiRo mentioned this in the channel meeting today. Is there anything we can do about this one?

Comment 4

[(Away)]

I'm not certain about this but it looks like Trusteer is trying to allocate -1 bytes, which fails with a bad_alloc exception.

I believe we have Trusteer contact information in the relman rolodex. We should reach out and see if they're aware of any issues on Win10. In parallel it would be helpful if QA could find an installer and STR.

Here are the module versions that are associated with this crash:
rooksbas.dll 	2.126.0.0
rooksdol.dll 	2.194.0.0
RapportTanzan390.DLL 	3.5.1412.176
RapportGP.DLL 	3.5.1412.176
RapportUtil.dll 	3.5.1412.176

Comment 5

[(Away)]

Before anyone thinks about blocklisting, I'll point out that it won't be effective. The Trusteer software loads too early, according to our crash annotations.

Comment 6

[[:philipp]]

feedback of an affected user at sumo: "I got in touch with Rapport and they don`t support Windows 10 at the moment." - https://support.mozilla.org/en-US/questions/1075081

Comment 7

[(Away)]

I don't reproduce this with Win10 RTM and Trusteer 1412.176. There may be additional factors at work causing this to happen only to a subset of users.

Comment 8

[Lawrence Mandel [:lmandel] (use needinfo)]

I sent the following support request to IBM Trusteer:

Hello,

We have new reports of a Firefox start-up crash related to Trusteer Rapport. The crash impacts multiple Firefox versions but is most substantially seen on the latest release, Firefox 39.0. (This version was released on July 2, 2015.)

The details are in https://bugzilla.mozilla.org/show_bug.cgi?id=1189319

We have not yet been able to reproduce the crash in house. It has been suggested that the crash is related to Windows 10. At this point we're looking for additional information that may help us reproduce the crash and identify the source. Can you please have someone review the report and engage with our devs via Bugzilla or e-mail?

Thank you,

Lawrence Mandel

Comment 9

[Lawrence Mandel [:lmandel] (use needinfo)]

ni Florin to see if his team has access to Trusteer and is able to reproduce.

Comment 10

[Ilan Fraiman]

Hi.
Thank you for contacting us. We are handling this and we will rollout a fix later today.

Best Regards,
Ilan

Comment 11

[[:philipp]]

thank you ilan, there is also a second type of startup crash with firefox on windows 10 and trusteer rapport present, in case you are not aware of it yet:
operator new(unsigned int) | rapportgp.dll@0xaf811

https://crash-stats.mozilla.com/search/?product=Firefox&platform=Windows&signature=%3Doperator+new%28unsigned+int%29+|+rapportgp.dll%400xaf811&_facets=platform_version&_facets=version&_facets=user_comments&_facets=uptime&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#facet-user_comments

Comment 12

[Andrei Vaida [:avaida]]

(In reply to Lawrence Mandel [:lmandel] (use needinfo) from comment #9)
> ni Florin to see if his team has access to Trusteer and is able to reproduce.

We tried to reproduce this crash on our Windows 10 (Pro x64, Build 10240) test machines, using Trusteer Rapport (Emerald Build 1412.176) with Firefox 39 and Firefox 40, unfortunately without success.

Please note that on Beta 40.0b9 (20150730171029), this add-on wasn't installed nor shown in the toolbar, so I'm guessing the information from Comment 6 might be reliable.

Comment 13

[[:philipp]]

those signatures have completely ceased in the past week, so the fix rolled out by trusteer looks successful.