Open Bug 1444019 Opened 4 years ago Updated 4 years ago
Crash in Tpp
Callback Check Thread After Callback
+++ This bug was initially created as a clone of Bug #1360029 +++ There seems to have been a recent uptick in this crash starting with the 03-01:22 Nightly. The previous bug that Marco worked on has been closed for a few months, so I think this is a new crash with the same top frame. One example is bp-c40c66e6-5488-4e45-85c1-bc9fb0180307 from today's Nightly. ============================================================= Top 5 frames of crashing thread: 0 ntdll.dll TppCallbackCheckThreadAfterCallback 1 ntdll.dll TppCallbackEpilog 2 ntdll.dll TppWorkerThread 3 kernel32.dll BaseThreadInitThunk 4 ntdll.dll RtlUserThreadStart ============================================================= Marco, does this bug look related to bug 1360029?
Many crashes from very few users, and, at least on nightly, 100% with mbae64.dll, which AIUI is "Malwarebytes Anti-Exploit".
Seems related to Malwarebytes: > (100.0% in signature vs 02.26% overall) Module "mbae64.dll" = true
Made some checks on my system which was affected by this for the past 3 days. It appears the problem is in Malwarebytes Anti-Exploit standalone v220.127.116.11. Malwarebytes Anti-Malware 3.4.4 which comes with Anti-Exploit 18.104.22.1682 built-in is unaffected. Unlike https://bugzilla.mozilla.org/show_bug.cgi?id=1418594, this issue also occurs with default settings. Initial Malwarebytes Anti-Exploit beta 22.214.171.124 announcement on March 2 - https://forums.malwarebytes.com/topic/205225-mbae-112-build-37-latest-experimental-build/ Promoted to release candidate on March 8 - https://forums.malwarebytes.com/topic/205865-malwarebytes-anti-exploit-112-build-37-released/ It may be offered as a component update for Malwarebytes Anti-Malware in the future. I noticed between 2 to 4 crashes when Firefox starts in about:crashes but user experience seams unaffected. You would even know it happens. I discovered I was affected by this issue just because I was debugging something else.
Dsscussion at Malwarebytes forums about this issue: https://forums.malwarebytes.com/topic/224586-new-tabs-dont-open-sites-in-firefox-58-with-mbae-112137/
Top crash on the 3-14 Nightly.
Adding another signature, it has correlation to (100.0% in signature vs 04.10% overall) Module "mbae-proxy64.dll" = true.
Crash Signature: [@ TppCallbackCheckThreadAfterCallback] → [@ TppCallbackCheckThreadAfterCallback] [@ TppCallbackEpilog ]
Latest version of Malwarebytes Anti-Exploit 126.96.36.199 has the following changelog: "Fixed crashes in Firefox browser" According to  this has fixed the issue. https://forums.malwarebytes.com/topic/224586-new-tabs-dont-open-sites-in-firefox-58-with-mbae-112137/?do=findComment&comment=1226775
It was actually fixed even earlier in 188.8.131.52. The full list of affected versions is the following: 184.108.40.206, 220.127.116.11 and 18.104.22.168.
Albert, is it fixed for you?
For me it stopped crashing when I updated to 22.214.171.124. Last crash for me is from 23rd March 2018 around 8PM. I flushed the crash dumps the next day and I am still at 0 crashes. Since then I subsequently updated to 1.12.56 and now I am on 126.96.36.199.
The issue was confirmed fixed by those who tried 188.8.131.52, myself included as posted on the Malwarebytes forum thread I linked above. For the record I am registered on Malwarebytes forums as pal1000. While 184.108.40.206 was officially announced to contain the fix, it actually landed in 220.127.116.11. When I updated to 18.104.22.168 to 22.214.171.124 the crashes stopped and never came back.
Sounds good. Marcia, can you monitor if the volume goes down as more people get updated?
(In reply to Marco Castelluccio [:marco] from comment #12) > Sounds good. Marcia, can you monitor if the volume goes down as more people > get updated? Yes.
This is currently the #1 top crasher on Nightly. Is there something we can blocklist here since we know there's an updated version which doesn't crash?
Starting with 20180409100035, I don't see any more crashes in nightly. Will continue to monitor.
:philipp, could you test if blocklisting the Malwarebytes DLLs work?
i tried putting mbae64.dll onto the blocklist, but that didn't work to get the module out of the browser process.
Aaron, this is another case where the blocklist doesn't work. Are you tracking these cases?
Yes, I have already set it to block the appropriate bug.
(In reply to Marcia Knous [:marcia - needinfo? me] from comment #15) > Starting with 20180409100035, I don't see any more crashes in nightly. Will > continue to monitor. No signatures in 61 nightly. 60 beta and 59.02 have crashes, but very low volume at the moment.
You need to log in before you can comment on or make changes to this bug.