Open Bug 1444019 Opened 7 years ago Updated 2 years ago

Crash in TppCallbackCheckThreadAfterCallback

Categories

(External Software Affecting Firefox :: Other, defect, P3)

Product:
External Software Affecting Firefox
Component:
Other
Platform:
x86_64
Windows 10
Type:
defect

Tracking

(Not tracked)

People

(Reporter: jchen, Unassigned)

References

(Blocks 1 open bug)

Details

(Whiteboard: inj+)

Crash Data

+++ This bug was initially created as a clone of Bug #1360029 +++ There seems to have been a recent uptick in this crash starting with the 03-01:22 Nightly. The previous bug that Marco worked on has been closed for a few months, so I think this is a new crash with the same top frame. One example is bp-c40c66e6-5488-4e45-85c1-bc9fb0180307 from today's Nightly. ============================================================= Top 5 frames of crashing thread: 0 ntdll.dll TppCallbackCheckThreadAfterCallback 1 ntdll.dll TppCallbackEpilog 2 ntdll.dll TppWorkerThread 3 kernel32.dll BaseThreadInitThunk 4 ntdll.dll RtlUserThreadStart ============================================================= Marco, does this bug look related to bug 1360029?
Flags: needinfo?(mcastelluccio)
Many crashes from very few users, and, at least on nightly, 100% with mbae64.dll, which AIUI is "Malwarebytes Anti-Exploit".
Seems related to Malwarebytes: > (100.0% in signature vs 02.26% overall) Module "mbae64.dll" = true
Blocks: 1435797
Flags: needinfo?(mcastelluccio)
Priority: -- → P3
Whiteboard: inj+
Made some checks on my system which was affected by this for the past 3 days. It appears the problem is in Malwarebytes Anti-Exploit standalone v1.12.1.37. Malwarebytes Anti-Malware 3.4.4 which comes with Anti-Exploit 1.11.4.262 built-in is unaffected. Unlike https://bugzilla.mozilla.org/show_bug.cgi?id=1418594, this issue also occurs with default settings. Initial Malwarebytes Anti-Exploit beta 1.12.1.37 announcement on March 2 - https://forums.malwarebytes.com/topic/205225-mbae-112-build-37-latest-experimental-build/ Promoted to release candidate on March 8 - https://forums.malwarebytes.com/topic/205865-malwarebytes-anti-exploit-112-build-37-released/ It may be offered as a component update for Malwarebytes Anti-Malware in the future. I noticed between 2 to 4 crashes when Firefox starts in about:crashes but user experience seams unaffected. You would even know it happens. I discovered I was affected by this issue just because I was debugging something else.
Top crash on the 3-14 Nightly.
Adding another signature, it has correlation to (100.0% in signature vs 04.10% overall) Module "mbae-proxy64.dll" = true.
Crash Signature: [@ TppCallbackCheckThreadAfterCallback] → [@ TppCallbackCheckThreadAfterCallback] [@ TppCallbackEpilog ]
Latest version of Malwarebytes Anti-Exploit 1.12.1.56 has the following changelog: "Fixed crashes in Firefox browser" According to [1] this has fixed the issue. https://forums.malwarebytes.com/topic/224586-new-tabs-dont-open-sites-in-firefox-58-with-mbae-112137/?do=findComment&comment=1226775
It was actually fixed even earlier in 1.12.1.48. The full list of affected versions is the following: 1.12.1.37, 1.12.1.42 and 1.12.1.43.
Albert, is it fixed for you?
Flags: needinfo?(liviuprodea)
For me it stopped crashing when I updated to 1.12.1.48. Last crash for me is from 23rd March 2018 around 8PM. I flushed the crash dumps the next day and I am still at 0 crashes. Since then I subsequently updated to 1.12.56 and now I am on 1.12.1.57.
Flags: needinfo?(liviuprodea)
The issue was confirmed fixed by those who tried 1.12.1.48, myself included as posted on the Malwarebytes forum thread I linked above. For the record I am registered on Malwarebytes forums as pal1000. While 1.12.1.56 was officially announced to contain the fix, it actually landed in 1.12.1.48. When I updated to 1.12.1.43 to 1.12.1.48 the crashes stopped and never came back.
Sounds good. Marcia, can you monitor if the volume goes down as more people get updated?
Flags: needinfo?(mozillamarcia.knous)
(In reply to Marco Castelluccio [:marco] from comment #12) > Sounds good. Marcia, can you monitor if the volume goes down as more people > get updated? Yes.
This is currently the #1 top crasher on Nightly. Is there something we can blocklist here since we know there's an updated version which doesn't crash?
Starting with 20180409100035, I don't see any more crashes in nightly. Will continue to monitor.
:philipp, could you test if blocklisting the Malwarebytes DLLs work?
Flags: needinfo?(madperson)
i tried putting mbae64.dll onto the blocklist, but that didn't work to get the module out of the browser process.
Flags: needinfo?(madperson)
Aaron, this is another case where the blocklist doesn't work. Are you tracking these cases?
Flags: needinfo?(aklotz)
Yes, I have already set it to block the appropriate bug.
Flags: needinfo?(aklotz)
(In reply to Marcia Knous [:marcia - needinfo? me] from comment #15) > Starting with 20180409100035, I don't see any more crashes in nightly. Will > continue to monitor. No signatures in 61 nightly. 60 beta and 59.02 have crashes, but very low volume at the moment.
Flags: needinfo?(mozillamarcia.knous)
Severity: normal → S3
You need to log in before you can comment on or make changes to this bug.