1303531 - Firefox 48.0.2 crashes with Trusteer Rapport 3.5.1609.100 (MessagePump, ProcessNextNativeEvent signatures)

Status: RESOLVED WORKSFORME

(Core :: General, defect)

Description

[Loic]

This bug was filed from the Socorro interface and is 
report bp-36f768ac-acf4-48d9-ad7e-fd0bf2160916.
=============================================================


A user on the French community board reported a crash of FF48 with the latest Trusteer Rapport 3.5.1609.100:
https://forums.mozfr.org/viewtopic.php?f=5&t=130821

Some crash reports:
https://crash-stats.mozilla.com/report/index/bp-36f768ac-acf4-48d9-ad7e-fd0bf2160916
https://crash-stats.mozilla.com/report/index/bp-505abe7e-b58f-4bd2-b007-873572160916
https://crash-stats.mozilla.com/report/index/bp-91c074eb-73f8-4d63-b226-76b272160916
https://crash-stats.mozilla.com/report/index/bp-d13567b4-12f9-4733-b720-9e1012160916

Trusteer Rapport 3.5.1609.100 is flagged as compatible with FF48 on its website.

Comment 1

[Marco Castelluccio [:marco]]

nsAppShell::ProcessNextNativeEvent spiked between Sep 15 and Sep 16 from ~10 crash reports to ~2800.
base::MessagePumpForUI::DoRunLoop from ~5 to ~600.
mozilla::ipc::MessagePump::Run from ~40 to ~600.
base::MessagePumpWin::RunWithDispatcher from ~2 to ~900.

Interestingly, ~95% of crashes with the "nsAppShell::ProcessNextNativeEvent" signature have useragent_locale=fr. So the crash is mainly affecting French users.

Comment 2

[Loic]

We got many reports about crashes with Trusteer. I think it's since the new update of this app to x.100.

Is there a dev from IBM working on Trusteer on BMO?

Comment 3

[Marco Castelluccio [:marco]]

4819 crash reports have been analyzed and the following versions have been found:
 - rooksdol.dll
   - 3.13.0.0: 1590
 - rooksbas.dll
   - 3.2.0.1: 123
 - rapportgp.dll
   - 3.5.1609.100: 136
 - rapportutil.dll
   - 3.5.1609.100: 240
 - rapporttanzanex480.dll
   - 3.5.1609.100: 2684
   - 3.5.1609.98: 17

Comment 4

[Liz Henry (:lizzard) (relman/hg->git project)]

Can someone from Trusteer take a look?

Comment 5

[Marco Castelluccio [:marco]]

Another signature, still high volume and highly correlated with the French locale:
(94.40% in signature vs 08.63% overall) useragent_locale = fr

Comment 6

[Marco Castelluccio [:marco]]

Aaand, another one.

Add them up (https://crash-stats.mozilla.com/search/?signature=%3Dmozilla%3A%3Aipc%3A%3AMessagePump%3A%3ARun&signature=%3Dbase%3A%3AMessagePumpForUI%3A%3ADoRunLoop&signature=%3Dbase%3A%3AMessagePumpWin%3A%3ARunWithDispatcher&signature=%3DnsAppShell%3A%3AProcessNextNativeEvent&signature=%3DNS_ProcessNextEvent%20%7C%20mozilla%3A%3Aipc%3A%3AMessagePump%3A%3ARun&signature=%3Dbase%3A%3AMessagePumpForUI%3A%3AProcessMessageHelper&date=%3E%3D2016-09-16&product=Firefox&version=48.0.2&version=48.0.1&version=48.0&_sort=date&_facets=signature&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#crash-reports) and you get ~10500 reports in ~2 days.

Comment 7

[Liz Henry (:lizzard) (relman/hg->git project)]

Einav from Trusteer responded; they found an issue at one of their clients who has now reconfigured. They expect the problem to be fixed this morning.

Comment 8

[Marco Castelluccio [:marco]]

Looks like the crashes have reduced drastically. Should we close this as WORKSFORME?

Comment 9

[[:philipp]]

in the last 24 hours those crashes are spiking up again and account for 6,5% of browser crashes on windows - looks like an update by trusteer has reintroduced the issue.
can we do some outreach to them again?

Comment 10

[Marco Castelluccio [:marco]]

We're seeing these signatures spiking up again, this time with a correlation to pt-BR locales.
Could you look into it?

Lizzard, do you have other contacts at Trusteer?

Comment 11

[Desigan Chinniah [:cyberdees] [:dees] [London - GMT]]

(In reply to Marco Castelluccio [:marco] from comment #10)
> We're seeing these signatures spiking up again, this time with a correlation
> to pt-BR locales.
> Could you look into it?
> 
> Lizzard, do you have other contacts at Trusteer?

Marco - we have a DL with Trusteer (IBM). You are likely within it?

Comment 12

[Marco Castelluccio [:marco]]

(In reply to Desigan Chinniah [:cyberdees] [:dees] [London - GMT] from comment #11)
> (In reply to Marco Castelluccio [:marco] from comment #10)
> > We're seeing these signatures spiking up again, this time with a correlation
> > to pt-BR locales.
> > Could you look into it?
> > 
> > Lizzard, do you have other contacts at Trusteer?
> 
> Marco - we have a DL with Trusteer (IBM). You are likely within it?

Right, I forgot about that, thanks! I've sent an email to the mailing list.

Comment 13

[Marco Castelluccio [:marco]]

The issue with Firefox 48 was resolved. I've opened bug 1320562 to track the issue in Firefox 50.