1895446 - Firefox crashes on save file to disk

Status: NEW

(External Software Affecting Firefox :: Other, defect, P3)

Description

[bloggz]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0

Steps to reproduce:

Using Firefox to save any file results in a crash (not all the time, but more often than not).

Examples include:

• Attempting to save an exported CSV file.
• Selecting some text on a page, "Print selection", then save as a PDF.
• Right-clicking on an image and selecting save image.

The Save As dialog pops up, you select the folder and file name, as soon as you click "Save" Firefox crashes.

This is using Windows 11 (23H2), I have tried it using the MSIX version of Firefox from the Microsoft store, I then removed that and installed the normal (installer) version of Firefox. I get the same crashes on either.

Actual results:

When saving a file, the "Save As" dialog pops up, you select the folder and file name, as soon as you click "Save" Firefox crashes.

A ".part" file (with a random name) appears to be created in the desired location, this file appears to contain the desired file data, i.e. if you rename it (by removing the .part extension) then the file contains the data / image etc. As if the file was downloaded, but then the crash happened before the .part file was renamed to the final filename?

Appears similar to these other posts:
https://connect.mozilla.org/t5/discussions/save-file-crashes-firefox/m-p/3304
https://connect.mozilla.org/t5/discussions/firefox-118-0-crash-on-file-download/m-p/40357
https://connect.mozilla.org/t5/discussions/firefox-crashes-downloading-pictures-files-etc/m-p/38802

Expected results:

File should be saved to the desired location without Firefox crashing.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Firefox::Installer' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Marco Bonardo [:mak]]

Could you please check if you see recent crashes in about:crashes page, and post their ids to this bug report?
If they are unsubmitted please submit those crashes before, so we can access them.

Comment 3

[bloggz]

Sure thing:
bp-defa451f-33a3-4afa-a8ca-421400240510
bp-f3d897c9-d98a-4eb4-8ef9-206130240510

Comment 4

[Marco Bonardo [:mak]]

Do you have a Symantec product installed? This looks like DLL injection from a security software, and they are crashing Firefox.
It's very similar to Bug 1649485.

Comment 5

[bloggz]

Interesting! Not Symantec as far as I know, but CrowdStrike yes. Probably doing similar things?

Is there anything further I can do to test it, or workaround it?

Comment 6

[Marco Bonardo [:mak]]

I think this looks like dll injection, or anyway some kind of unexpected interaction, from a third party app. The stack is pointing to ffm64.dll and I see other reports on crash-stats with the same signature,

Greg, do you know if recently this was reported more commonly? I found Bug 1649485, but it has a slight different signature and is related to Symantec.
There's also "Bug 1836696 - Connections hang using Crowdstrike Falcon Sensor" that may or may not be related.

Comment 7

[Greg Stoll :gstoll]

The crash signature for this indicates that this is happening to more people than just the reporter. I'll follow up with Broadcom (who has signed ffm64.dll) and see if they can take a look.

:bloggz - if you follow the steps here to block ffm64.dll from loading and restart Firefox, does that make the problem go away? (I wouldn't recommend running Firefox for too long like this, as you won't be getting protection from your security software)

Comment 8

[bloggz]

Thanks for the blocking info, unfortunately I don't see the block icon, so I likely don't have permission to use that feature.

Looking at the location of the ffm64.dll file:

"C:\Program Files\Manufacturer\Endpoint Agent"

It looks like it maybe linked to Broadcom / Symantec DLP (Data Loss Prevention) software. I do believe that we have DLP processes running on these endpoints.

This may be in consistent with it interrupting file operations? Unsure though, what are your thoughts?

Source:
https://knowledge.broadcom.com/external/article/160045/best-practice-dlp-endpoint-agents-with-a.html

Comment 9

[Greg Stoll :gstoll]

Yes, I’m pretty sure that’s a Broadcom DLL used for DLP, and that’s the kind of thing that can interfere with downloads so everything makes sense.

I have reached out to Broadcom asking them to take a look, but if you have a way to get support I think it always means more coming from a paying customer 🙂 I’ll keep this bug updated with what we hear from them. Thanks again for the detailed bug report!

Comment 10

[bloggz]

No worries, I’ll lodge a ticket and get it sent up the chain.

It’s good to have this extra info, it will hopefully get it to the right people. Thanks for all your assistance, much appreciated.

Comment 11

[bloggz]

Update: I've lodged a ticket with the service desk, who are escalating it.

In the meantime I messed around with "about:third-party" a bit more and managed to get the option to Block the ffm64.dll module. I did this by hitting the "Refresh System Info" (or similar wording) button, and that seemed to reload the page and then the "Block" option was available.

When blocking "ffm64.dll" I do not appear to get the same crashing when trying to save a file to disk, so that does appear to be the cause of the crashes.

Comment 12

[bloggz]

Side note, the module info for "ffm64.dll" is as follows:

Application: AgentInstall-x64_16_0
Publisher: Symantec Corp.
File version: 16.0.10004.60136
Vendor info: Broadcom Inc
Occurrences: 16
Avg. Blocking time (ms): -

Comment 13

[BugBot [:suhaib / :marco/ :calixte]]

The bug has a crash signature, thus the bug will be considered confirmed.