1444019 - Crash in TppCallbackCheckThreadAfterCallback

Status: NEW

(External Software Affecting Firefox :: Other, defect, P3)

Description

[(inactive) Jim Chen [:jchen] [:darchons]]

+++ This bug was initially created as a clone of Bug #1360029 +++

There seems to have been a recent uptick in this crash starting with the 03-01:22 Nightly. The previous bug that Marco worked on has been closed for a few months, so I think this is a new crash with the same top frame.

One example is bp-c40c66e6-5488-4e45-85c1-bc9fb0180307 from today's Nightly.

=============================================================

Top 5 frames of crashing thread:

0 ntdll.dll TppCallbackCheckThreadAfterCallback 
1 ntdll.dll TppCallbackEpilog 
2 ntdll.dll TppWorkerThread 
3 kernel32.dll BaseThreadInitThunk 
4 ntdll.dll RtlUserThreadStart 

=============================================================

Marco, does this bug look related to bug 1360029?

Comment 1

[Julien Cristau [:jcristau]]

Many crashes from very few users, and, at least on nightly, 100% with mbae64.dll, which AIUI is "Malwarebytes Anti-Exploit".

Comment 2

[Marco Castelluccio [:marco]]

Seems related to Malwarebytes:
> (100.0% in signature vs 02.26% overall) Module "mbae64.dll" = true

Comment 3

[Albert Pal]

Made some checks on my system which was affected by this for the past 3 days. It appears the problem is in Malwarebytes Anti-Exploit standalone v1.12.1.37. Malwarebytes Anti-Malware 3.4.4 which comes with Anti-Exploit 1.11.4.262 built-in is unaffected. Unlike https://bugzilla.mozilla.org/show_bug.cgi?id=1418594, this issue also occurs with default settings.

Initial Malwarebytes Anti-Exploit beta 1.12.1.37 announcement on March 2 - https://forums.malwarebytes.com/topic/205225-mbae-112-build-37-latest-experimental-build/

Promoted to release candidate on March 8 - https://forums.malwarebytes.com/topic/205865-malwarebytes-anti-exploit-112-build-37-released/

It may be offered as a component update for Malwarebytes Anti-Malware in the future.

I noticed between 2 to 4 crashes when Firefox starts in about:crashes but user experience seams unaffected. You would even know it happens. I discovered I was affected by this issue just because I was debugging something else.

Comment 4

[Albert Pal]

Dsscussion at Malwarebytes forums about this issue:
https://forums.malwarebytes.com/topic/224586-new-tabs-dont-open-sites-in-firefox-58-with-mbae-112137/

Comment 5

[Andrew McCreight [:mccr8]]

Top crash on the 3-14 Nightly.

Comment 6

[Marcia Knous [:marcia]]

Adding another signature, it has correlation to (100.0% in signature vs 04.10% overall) Module "mbae-proxy64.dll" = true.

Comment 7

[Itiel]

Latest version of Malwarebytes Anti-Exploit 1.12.1.56 has the following changelog:
"Fixed crashes in Firefox browser"

According to [1] this has fixed the issue.


https://forums.malwarebytes.com/topic/224586-new-tabs-dont-open-sites-in-firefox-58-with-mbae-112137/?do=findComment&comment=1226775

Comment 8

[Albert Pal]

It was actually fixed even earlier in 1.12.1.48. The full list of affected versions is the following: 1.12.1.37, 1.12.1.42 and 1.12.1.43.

Comment 9

[Marco Castelluccio [:marco]]

Albert, is it fixed for you?

Comment 10

[Albert Pal]

For me it stopped crashing when I updated to 1.12.1.48. Last crash for me is from 23rd March 2018 around 8PM. I flushed the crash dumps the next day and I am still at 0 crashes. Since then I subsequently updated to 1.12.56 and now I am on 1.12.1.57.

Comment 11

[Albert Pal]

The issue was confirmed fixed by those who tried 1.12.1.48, myself included as posted on the Malwarebytes forum thread I linked above. For the record I am registered on Malwarebytes forums as pal1000. While 1.12.1.56 was officially announced to contain the fix, it actually landed in 1.12.1.48. When I updated to 1.12.1.43 to 1.12.1.48 the crashes stopped and never came back.

Comment 12

[Marco Castelluccio [:marco]]

Sounds good. Marcia, can you monitor if the volume goes down as more people get updated?

Comment 13

[Marcia Knous [:marcia]]

(In reply to Marco Castelluccio [:marco] from comment #12)
> Sounds good. Marcia, can you monitor if the volume goes down as more people
> get updated?

Yes.

Comment 14

[Ryan VanderMeulen [:RyanVM]]

This is currently the #1 top crasher on Nightly. Is there something we can blocklist here since we know there's an updated version which doesn't crash?

Comment 15

[Marcia Knous [:marcia]]

Starting with 20180409100035, I don't see any more crashes in nightly. Will continue to monitor.

Comment 16

[Marco Castelluccio [:marco]]

:philipp, could you test if blocklisting the Malwarebytes DLLs work?

Comment 17

[[:philipp]]

i tried putting mbae64.dll onto the blocklist, but that didn't work to get the module out of the browser process.

Comment 18

[Marco Castelluccio [:marco]]

Aaron, this is another case where the blocklist doesn't work. Are you tracking these cases?

Comment 19

[(No longer employed by Mozilla) Aaron Klotz]

Yes, I have already set it to block the appropriate bug.

Comment 20

[Marcia Knous [:marcia]]

(In reply to Marcia Knous [:marcia - needinfo? me] from comment #15)
> Starting with 20180409100035, I don't see any more crashes in nightly. Will
> continue to monitor.

No signatures in 61 nightly. 60 beta and 59.02 have crashes, but very low volume at the moment.