Open Bug 1444019 Opened 4 years ago Updated 4 years ago

Crash in TppCallbackCheckThreadAfterCallback


(External Software Affecting Firefox :: Other, defect, P3)

Windows 10


(Not tracked)


(Reporter: jchen, Unassigned)


(Blocks 1 open bug)


(Whiteboard: inj+)

Crash Data

+++ This bug was initially created as a clone of Bug #1360029 +++

There seems to have been a recent uptick in this crash starting with the 03-01:22 Nightly. The previous bug that Marco worked on has been closed for a few months, so I think this is a new crash with the same top frame.

One example is bp-c40c66e6-5488-4e45-85c1-bc9fb0180307 from today's Nightly.


Top 5 frames of crashing thread:

0 ntdll.dll TppCallbackCheckThreadAfterCallback 
1 ntdll.dll TppCallbackEpilog 
2 ntdll.dll TppWorkerThread 
3 kernel32.dll BaseThreadInitThunk 
4 ntdll.dll RtlUserThreadStart 


Marco, does this bug look related to bug 1360029?
Flags: needinfo?(mcastelluccio)
Many crashes from very few users, and, at least on nightly, 100% with mbae64.dll, which AIUI is "Malwarebytes Anti-Exploit".
Seems related to Malwarebytes:
> (100.0% in signature vs 02.26% overall) Module "mbae64.dll" = true
Blocks: 1435797
Flags: needinfo?(mcastelluccio)
Priority: -- → P3
Whiteboard: inj+
Made some checks on my system which was affected by this for the past 3 days. It appears the problem is in Malwarebytes Anti-Exploit standalone v1.12.1.37. Malwarebytes Anti-Malware 3.4.4 which comes with Anti-Exploit built-in is unaffected. Unlike, this issue also occurs with default settings.

Initial Malwarebytes Anti-Exploit beta announcement on March 2 -

Promoted to release candidate on March 8 -

It may be offered as a component update for Malwarebytes Anti-Malware in the future.

I noticed between 2 to 4 crashes when Firefox starts in about:crashes but user experience seams unaffected. You would even know it happens. I discovered I was affected by this issue just because I was debugging something else.
Top crash on the 3-14 Nightly.
Adding another signature, it has correlation to (100.0% in signature vs 04.10% overall) Module "mbae-proxy64.dll" = true.
Crash Signature: [@ TppCallbackCheckThreadAfterCallback] → [@ TppCallbackCheckThreadAfterCallback] [@ TppCallbackEpilog ]
Latest version of Malwarebytes Anti-Exploit has the following changelog:
"Fixed crashes in Firefox browser"

According to [1] this has fixed the issue.
It was actually fixed even earlier in The full list of affected versions is the following:, and
Albert, is it fixed for you?
Flags: needinfo?(liviuprodea)
For me it stopped crashing when I updated to Last crash for me is from 23rd March 2018 around 8PM. I flushed the crash dumps the next day and I am still at 0 crashes. Since then I subsequently updated to 1.12.56 and now I am on
Flags: needinfo?(liviuprodea)
The issue was confirmed fixed by those who tried, myself included as posted on the Malwarebytes forum thread I linked above. For the record I am registered on Malwarebytes forums as pal1000. While was officially announced to contain the fix, it actually landed in When I updated to to the crashes stopped and never came back.
Sounds good. Marcia, can you monitor if the volume goes down as more people get updated?
Flags: needinfo?(mozillamarcia.knous)
(In reply to Marco Castelluccio [:marco] from comment #12)
> Sounds good. Marcia, can you monitor if the volume goes down as more people
> get updated?

This is currently the #1 top crasher on Nightly. Is there something we can blocklist here since we know there's an updated version which doesn't crash?
Starting with 20180409100035, I don't see any more crashes in nightly. Will continue to monitor.
:philipp, could you test if blocklisting the Malwarebytes DLLs work?
Flags: needinfo?(madperson)
i tried putting mbae64.dll onto the blocklist, but that didn't work to get the module out of the browser process.
Flags: needinfo?(madperson)
Aaron, this is another case where the blocklist doesn't work. Are you tracking these cases?
Flags: needinfo?(aklotz)
Yes, I have already set it to block the appropriate bug.
Flags: needinfo?(aklotz)
(In reply to Marcia Knous [:marcia - needinfo? me] from comment #15)
> Starting with 20180409100035, I don't see any more crashes in nightly. Will
> continue to monitor.

No signatures in 61 nightly. 60 beta and 59.02 have crashes, but very low volume at the moment.
Flags: needinfo?(mozillamarcia.knous)
You need to log in before you can comment on or make changes to this bug.