Closed Bug 538687 Opened 12 years ago Closed 6 years ago

[WangWang Protocol Handler] spike in crashes in npww.dll in early Jan 2010 [@ npww.dll@0x1634 ]

Categories

(External Software Affecting Firefox :: Other, defect)

x86
Windows XP
defect
Not set
normal

Tracking

(Not tracked)

RESOLVED INCOMPLETE

People

(Reporter: chofmann, Unassigned)

References

()

Details

(Keywords: crash, regression, testcase, Whiteboard: [crashkill][explosive])

Crash Data

running at 45-60 crashes per day and now a recent uptick.

this moves it to #45 topcrash in 3.6b5

20091216-crashdata 58 npww.dll
20091217-crashdata 51 npww.dll
20091218-crashdata 52 npww.dll
20091219-crashdata 46 npww.dll
20091220-crashdata 61 npww.dll
20091221-crashdata 53 npww.dll
20091222-crashdata 54 npww.dll
20091223-crashdata 79 npww.dll
20091224-crashdata 47 npww.dll
20091225-crashdata 50 npww.dll
20091226-crashdata 43 npww.dll
20091227-crashdata 70 npww.dll
20091228-crashdata 93 npww.dll
20091229-crashdata 46 npww.dll
20091230-crashdata 57 npww.dll
20091231-crashdata 40 npww.dll
20100101-crashdata 45 npww.dll
20100102-crashdata 52 npww.dll
20100103-crashdata 82 npww.dll
20100104-crashdata 80 npww.dll
20100105-crashdata 79 npww.dll
20100106-crashdata 100 npww.dll
20100107-crashdata 82 npww.dll

stack looks like

http://crash-stats.mozilla.com/report/index/b8151ea8-6f3a-4e87-beee-f5c762100101

Frame  	Module  	Signature [Expand]  	Source
0 	npww.dll 	npww.dll@0x1634 	
1 	xul.dll 	DoStopPlugin 	layout/generic/nsObjectFrame.cpp:2252
2 	xul.dll 	nsStopPluginRunnable::Run 	layout/generic/nsObjectFrame.cpp:2302
3 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:527
4 	xul.dll 	nsBaseAppShell::Run 	widget/src/xpwidgets/nsBaseAppShell.cpp:170
5 	xul.dll 	nsAppStartup::Run 	toolkit/components/startup/src/nsAppStartup.cpp:182
6 	nspr4.dll 	PR_GetEnv 	
7 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:120
8 	firefox.exe 	__tmainCRTStartup 	obj-firefox/memory/jemalloc/crtsrc/crtexe.c:591
9 	kernel32.dll 	BaseThreadInitThunk 	
10 	ntdll.dll 	__RtlUserThreadStart 	
11 	ntdll.dll 	_RtlUserThreadStart 


several malware bytes report installation of the .dll is at

FF - plugin: c:\documents and settings\administrator\application data
\mozilla\firefox\profiles\4x3ekcqo.default\extensions
\{4d144bc3-23fb-47de-90c5-63ccb0139ccf}\plugins\npww.dll 

chromium idenified the .dll as the WanWang protocol handler plugin and blocked it a while back

http://code.google.com/p/chromium/issues/detail?id=3953


checking --- 20100107-crashdata.csv npww.dll
release total-crashes
              npww.dll crashes
                         pct.
all     227282  82      0.000360785
3.0.15  2178    1       0.000459137
3.0.16  12640           0
3.5.5   6264            0
3.5.6   40343   1       2.47874e-05
3.6b5   23204   69      0.00297363
3.6b4   1588    2       0.00125945
3.6b3   640             0
3.6b2   728             0
3.6b1   2188            0

hecking --- 20100106-crashdata.csv npww.dll
release total-crashes
              npww.dll crashes
                         pct.
all     224716  100     0.000445006
3.0.15  2128            0
3.0.16  22618           0
3.5.5   6066            0
3.5.6   73471   6       8.16649e-05
3.6b5   23275   84      0.00360902
3.6b4   1536    5       0.00325521
3.6b3   608             0
3.6b2   795             0
3.6b1   2191            0

os breakdown
33      0.33    Windows NT5.1.2600 Service Pack 2
29      0.29    Windows NT5.1.2600 Service Pack 3
21      0.21    Windows NT6.1.7600
11      0.11    Windows NT6.0.6002 Service Pack 2
5       0.05    Windows NT6.0.6001 Service Pack 1
1       0.01    Windows NT5.1.2600 Szervizcsomag 3

not sure why the high concentration of crash urls on alibaba.com site.  In a quick glance I didn't see any indication of special firefox or npww.dll or plugin content.

 16 http://www.alibaba.com/trade
   8 http://us.my.alibaba.com/mcweb
   6 http://us.my.alibaba.com/mcadmin
   5 https://login.alibaba.com/?Done=http%3A
   5 https://login.alibaba.com/
   3 http://www.panel-e.com/EN-index.htm
   3 http://us.my.alibaba.com/userbehavior
   3 http://us.my.alibaba.com/
   2 http://www.facebook.com/home.php
   2 http://www.aliexpress.com/product-gs
   2 http://www.alibaba.com/product-gs
   2 http://www.alibaba.com/catalogs
   2 http://member1.taobao.com/message
   2 \N///
OS: Mac OS X → Windows XP
also a smaller number of crashes at other addresses

  2 npww.dll@0xdec8
  2 npww.dll@0x16c4
Summary: spike in crashes in npww.dll in early Jan 2010 [@ npww.dll@0x1634 ] → [WangWang Protocol Handler] spike in crashes in npww.dll in early Jan 2010 [@ npww.dll@0x1634 ]
Duplicate of this bug: 552361
Please read Bug 552361 description for a way to reproduce the crash
up over 400 crashes per day.  looks like something regeressed with 3.6

checking --- 20100310-crashdata.csv npww.dll@0x1634
release total-crashes
              npww.dll@0x1634 crashes
                         pct.
all     271954  416     0.00152967
3.0.15  922             0
3.0.16  288             0
3.0.17  886             0
3.0.18  15242   1       6.56082e-05
3.5.5   2648            0
3.5.6   1454            0
3.5.7   4369            0
3.5.8   88914   2       2.24936e-05
3.6     126611  411     0.00324616
3.6b5   933     2       0.00214362
3.7a1   276             0
3.7a1pre        327             0
Component: Blocklisting → Plug-ins
Product: addons.mozilla.org → Core
QA Contact: blocklisting → plugins
moving the test case over here...

Firefox crashes when closing the page with the code:

---------- CODE START -------------
<embed type="application/ww-plugin">
---------- CODE END ---------------

Reproducible: Always

Steps to Reproduce:
1.create a html file with this line of code
2.open the html file with firefox
3.close the tab of a page or close the firefox
Actual Results:  
crash

Expected Results:  
close without a crash

problem with a cleanup of embedded obj?
Keywords: crash, regression
Just make sure the plugin from a page alibaba.com is installed
continued growth in the number of reports per day on this going over 1600 crashes on 3/15

20100312-crashdata 872 npww.dll@0x1634
20100313-crashdata 661 npww.dll@0x1634
20100314-crashdata 640 npww.dll@0x1634
20100315-crashdata 1654 npww.dll@0x1634
20100316-crashdata 1415 npww.dll@0x1634
20100317-crashdata 1438 npww.dll@0x1634
20100318-crashdata 1270 npww.dll@0x1634
20100319-crashdata 1031 npww.dll@0x1634
20100320-crashdata 782 npww.dll@0x1634
20100321-crashdata 979 npww.dll@0x1634

we need to figure out what the options should be for trying to avoid the crash or block the .dll

#8 in early 3.6.2 top crash data.
Keywords: testcase
Whiteboard: [crashkill][explosive]
Component: Plug-ins → Other
Product: Core → Plugins
QA Contact: plugins → other
Crash Signature: [@ npww.dll@0x1634 ]
Closing old bugs in the Plugins component. We aren't going to track issues in 3rd-party plugins in the Mozilla bug tracker. In addition, support for NPAPI plugins will be removed at the end of this year; for more details see the post at https://blog.mozilla.org/futurereleases/2015/10/08/npapi-plugins-in-firefox/

If there is a serious bug in Firefox, it needs to be filed in the "Core" product, "Plug-Ins" component.
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → INCOMPLETE
You need to log in before you can comment on or make changes to this bug.