1352206 - Crash in __fnINOUTLPMEASUREITEMSTRUCT & wsprintfA

Status: RESOLVED INCOMPLETE

(Core :: Networking, defect)

Description

[[:philipp]]

[Tracking Requested - why for this release]:

This bug was filed from the Socorro interface and is 
report bp-e1a171d6-bc23-4814-a70f-524ff2170329.
=============================================================
Crashing Thread (14)
Frame 	Module 	Signature 	Source
0 	user32.dll 	__fnINOUTLPMEASUREITEMSTRUCT 	
1 	nss3.dll 	PR_Lock 	nsprpub/pr/src/threads/combined/prulock.c:306
2 	xul.dll 	mozilla::net::nsSocketOutputStream::Write(char const*, unsigned int, unsigned int*) 	netwerk/base/nsSocketTransport2.cpp:614
3 	xul.dll 	mozilla::net::nsHttpConnection::OnReadSegment(char const*, unsigned int, unsigned int*) 	netwerk/protocol/http/nsHttpConnection.cpp:1668
4 	xul.dll 	mozilla::net::nsHttpTransaction::ReadRequestSegment(nsIInputStream*, void*, char const*, unsigned int, unsigned int, unsigned int*) 	netwerk/protocol/http/nsHttpTransaction.cpp:698
5 	xul.dll 	nsBufferedInputStream::ReadSegments(nsresult (*)(nsIInputStream*, void*, char const*, unsigned int, unsigned int, unsigned int*), void*, unsigned int, unsigned int*) 	netwerk/base/nsBufferedStreams.cpp:349
6 	xul.dll 	mozilla::net::nsHttpTransaction::ReadSegments(mozilla::net::nsAHttpSegmentReader*, unsigned int, unsigned int*) 	netwerk/protocol/http/nsHttpTransaction.cpp:729
7 	xul.dll 	mozilla::net::nsAHttpTransaction::ReadSegmentsAgain(mozilla::net::nsAHttpSegmentReader*, unsigned int, unsigned int*, bool*) 	netwerk/protocol/http/nsAHttpTransaction.h:85
8 	xul.dll 	mozilla::net::nsHttpConnection::OnSocketWritable() 	netwerk/protocol/http/nsHttpConnection.cpp:1732
9 	xul.dll 	mozilla::net::nsHttpConnection::OnOutputStreamReady(nsIAsyncOutputStream*) 	netwerk/protocol/http/nsHttpConnection.cpp:2241
10 	xul.dll 	mozilla::net::nsHttpConnection::Activate(mozilla::net::nsAHttpTransaction*, unsigned int, int) 	netwerk/protocol/http/nsHttpConnection.cpp:558
11 	xul.dll 	mozilla::net::nsHttpConnectionMgr::DispatchAbstractTransaction(mozilla::net::nsHttpConnectionMgr::nsConnectionEntry*, mozilla::net::nsAHttpTransaction*, unsigned int, mozilla::net::nsHttpConnection*, int) 	netwerk/protocol/http/nsHttpConnectionMgr.cpp:1793
12 	xul.dll 	mozilla::net::nsHttpConnectionMgr::DispatchTransaction(mozilla::net::nsHttpConnectionMgr::nsConnectionEntry*, mozilla::net::nsHttpTransaction*, mozilla::net::nsHttpConnection*) 	netwerk/protocol/http/nsHttpConnectionMgr.cpp:1698
13 	xul.dll 	mozilla::net::nsHttpConnectionMgr::TryDispatchTransaction(mozilla::net::nsHttpConnectionMgr::nsConnectionEntry*, bool, mozilla::net::nsHttpTransaction*) 	netwerk/protocol/http/nsHttpConnectionMgr.cpp:1593
14 	xul.dll 	mozilla::net::nsHttpConnectionMgr::ProcessNewTransaction(mozilla::net::nsHttpTransaction*) 	netwerk/protocol/http/nsHttpConnectionMgr.cpp:1924
15 	xul.dll 	mozilla::net::nsHttpConnectionMgr::OnMsgNewTransaction(int, mozilla::net::ARefBase*) 	netwerk/protocol/http/nsHttpConnectionMgr.cpp:2221
16 	xul.dll 	mozilla::net::ConnEvent::Run() 	netwerk/protocol/http/nsHttpConnectionMgr.cpp:209
17 	xul.dll 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp:1216
18 	xul.dll 	NS_ProcessNextEvent(nsIThread*, bool) 	xpcom/glue/nsThreadUtils.cpp:361
19 	xul.dll 	mozilla::net::nsSocketTransportService::Run() 	netwerk/base/nsSocketTransportService2.cpp:939
20 	xul.dll 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp:1216
21 	xul.dll 	NS_ProcessNextEvent(nsIThread*, bool) 	xpcom/glue/nsThreadUtils.cpp:361
22 	xul.dll 	mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp:338
23 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc:225
24 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc:205
25 	xul.dll 	nsThread::ThreadFunc(void*) 	xpcom/threads/nsThread.cpp:467
26 	nss3.dll 	_PR_NativeRunThread 	nsprpub/pr/src/threads/combined/pruthr.c:397
27 	nss3.dll 	pr_root 	nsprpub/pr/src/md/windows/w95thred.c:95
28 	ucrtbase.dll 	_o__CIpow 	
29 	kernel32.dll 	BaseThreadInitThunk 	
30 	ntdll.dll 	__RtlUserThreadStart 	
31 	ntdll.dll 	_RtlUserThreadStart

these two signatures sprung up in volume yesterday on 2017-03-29 across different firefox versions, which suggests some sort of external interference. on 53.0b this is accounting for 1% of browser crashes in the past 24 hours.
however correlations for addons or modules don't provide any particular clues. the crashes are predominantly affecting windows 7 users with a 32bit version of the browser and spanish locales seem to be somewhat overrepresented in those reports. tentatively filing it in the networking component due to the crash stack.

Comment 1

[alex_mayorga]

¡Hola Philip!

FWIW, one of the comments of the crashes had this URL on it www.procondutor.com.br

¡Gracias!
Alex

Comment 2

[Julien Cristau [:jcristau]]

Too late for firefox 52, mass-wontfix.

Comment 3

[Liz Henry (:lizzard) (relman/hg->git project)]

Some of the crashes for 52/53 on both signatures are marked as high exploitability so I'm hiding this till someone has a chance to investigate.

Comment 4

[Patrick McManus [:mcmanus]]

i wonder if there is something correlated that will end up on a blocklist..

Comment 5

[Dragana Damjanovic [:dragana]]

(In reply to Patrick McManus [:mcmanus] from comment #4)
> i wonder if there is something correlated that will end up on a blocklist..

From comment 0 there is not correlations for modules and addons. A looked into some crashes but I do not see anything that could help :(

Comment 6

[Daniel Veditz [:dveditz]]

This spiked starting March 29 for just a couple days, and then a few more days to ramp down to a low level though still more than before the spike started. We did ship Firefox 52.0.2 on March 28 (suspicious timing!) but a quarter of the crashes I see are on older versions. Doesn't look like we can blame any particular site, but maybe some advertisement or tracking script was unleashed on that day?

There _is_ a correlation with Win 7: of the 1300+ crashes I'm looking at all but one are on Win 7.

Why are there four anonymous functions between mozilla::net::nsSocketOutputStream::Write() and the crashing user32.dll function? According to the module list everything loaded has symbols. Is this correlated with something hooking Windows APIs without showing up in the modules list? Malware or A-V might do that.

Probably will have to close this INCOMPLETE, but whoever caused the crashes seems to have stopped so maybe that's OK.

Comment 7

[Liz Henry (:lizzard) (relman/hg->git project)]

I don't see any new crashes for either signature. Probably would make sense to close this as incomplete. Patrick, are you OK with that?

Comment 8

[Patrick McManus [:mcmanus]]

I'm ok - its not actionable as is..