1230253 - Crash in [@ nsGlobalWindow::SetDocShell ]

Status: RESOLVED WORKSFORME

(Core :: DOM: Core & HTML, defect)

Description

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

This crash signature is at #3 rank in 44.0a2 top-crashers category.

It's a startup crash, affecting windows only and predominantly affecting version 44.0a2.

Comment 1

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

[Tracking Requested - why for this release]: Top crash on 44.0a2 and discussed in the channel meeting today.

Comment 2

[[:philipp]]

this seems to be caused by malware, as affected users all have a random {id}.xpi version 1.0.5781.6061 present in their modules (not extension!) list - the pattern is very reminiscent of bug 1181737 ...
the first reports seem to have started in 44.0a1 build 20151029045227

Comment 3

[[:philipp]]

...that's part of the yontoo adware: https://www.reasoncoresecurity.com/6e3cd58b-7110-464b-bc01-3d3995933177.xpi-a60d2440953a8a5d5c317a1f0bc50192080207b7.aspx

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

Ritu, do you know who deals with blocklist these days? Could we block the relevant addon?

Comment 5

[[:philipp]]

it's not an addon but a windows .dll masquerading as xpi-file. also its filename will be randomised/different on each infected system, so it isn't possible to blocklist based on that afaik...

Comment 6

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

(In reply to Olli Pettay [:smaug] from comment #4)
> Ritu, do you know who deals with blocklist these days? Could we block the
> relevant addon?

Re-directing the question to Jorge who helps with addon blocks.

Comment 7

[Jorge Villalobos [:jorgev] (he/him)]

If this is a DLL being injected directly into Firefox, there's nothing we can do in the add-on blocklist. I don't know who manages the in-product DLL blocklist. Maybe Kairo knows?

Comment 8

[[:philipp]]

like the last time this happened (bug 1181737) the malware vendors seem to have fixed those crashes with an auto-update as the volume of the crashes is going back towards 0 now...

Comment 9

[Robert Kaiser]

(In reply to Jorge Villalobos [:jorgev] from comment #7)
> If this is a DLL being injected directly into Firefox, there's nothing we
> can do in the add-on blocklist. I don't know who manages the in-product DLL
> blocklist. Maybe Kairo knows?

David Major did when he was still here, in recent weeks philipp has done some patches for DLL blocklist additions - and he already replied here :)

Comment 10

[Jorge Villalobos [:jorgev] (he/him)]

Anything left to do in this bug, then?

Comment 11

[Liz Henry (:lizzard) (relman/hg->git project)]

Here is a reputable report on Yontoo: https://www.symantec.com/security_response/writeup.jsp?docid=2012-052923-1931-99

Only 1 crash in the last 7 days. I think philipp is right and the adware has gotten an update. Wontfix for 44.

Comment 12

[Wayne Mery (:wsmwk)]

All the crashes in the past 6 months are for 52.x versions. None 60.x.  So crash is gone or signature has morphed.

https://crash-stats.mozilla.com/signature/?signature=nsGlobalWindow%3A%3ASetDocShell&date=%3E%3D2018-03-05T02%3A16%3A07.000Z&date=%3C2018-09-05T04%3A16%3A07.000Z&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&_columns=install_time&_sort=-date&page=1