Closed Bug 557008 Opened 14 years ago Closed 6 years ago

Firefox crashes [@ RtlpFindUCREntry ] [@ RtlpUpdateUCRIndexRemove ] [@ ntdll.dll@0x3b16b ] (f-secure litmus-ff.dll charter security suite?)

Categories

(Firefox :: Extension Compatibility, defect)

3.5 Branch
x86
Windows XP
defect
Not set
normal

Tracking

()

RESOLVED WONTFIX

People

(Reporter: chofmann, Unassigned)

References

Details

(Keywords: crash, Whiteboard: [crashkill][crashkill-outreach] [crashkill-thirdparty])

Crash Data

not much to go on on the stack

http://crash-stats.mozilla.com/report/index/9491a60b-ee03-4c58-abf9-144252100403

Frame  	Module  	Signature [Expand]  	Source
0 	ntdll.dll 	RtlpFindUCREntry 	
1 	ntdll.dll 	RtlpCreateUCREntry 	

a lot of the user comments seem to be in german and french.

distribution of crashes is across many releases, but its hitting the latest release hardest.  #25 topcrash in early 3.6.3 crash data

checking --- 20100402-crashdata.csv RtlpFindUCREntry
release total-crashes
              RtlpFindUCREntry crashes
                         pct.
all     305839  245     0.000801075
3.0.15  638     1       0.0015674
3.0.18  2937    2       0.000680967
3.5.6   1114    1       0.000897666
3.5.7   2248    1       0.00044484
3.5.8   14639   11      0.000751417
3.6     21571   13      0.000602661
3.6.2   145880  122     0.000836304

Os is win 6.0 and 6.1

 156 RtlpFindUCREntry Windows NT 6.0.6002 Service Pack 2
  45 RtlpFindUCREntry Windows NT 6.0.6001 Service Pack 1
  27 RtlpFindUCREntry Windows NT 6.1.7600
  17 RtlpFindUCREntry Windows NT 6.0.6000

might be reproducible on the deezer cdn or some of these frequent crash urls.

  14 http://cdn-files.deezer.com/ads/iframe-v190.html?tag=%253Cscript%2520type%253D%27text%252Fjavascript%27%253E%253C!--%252F%252F%253C!%255BCDATA%255B%250D%250A%
2509var%2520m3_u%2520%253D%2520(location.protocol%253D%253D%27https%253A%27%253F%27https%253A%252
  14 http://cdn-files.deezer.com/ads/iframe-v188.html?tag=%253Cscript%2520type%253D%27text%252Fjavascript%27%253E%253C!--%252F%252F%253C!%255BCDATA%255B%250D%250A%
2509var%2520m3_u%2520%253D%2520(location.protocol%253D%253D%27https%253A%27%253F%27https%253A%252
  10 \N
   8 http://m2.feiwei.tv/g/lib/template/echo.html?s=%3C%21DOCTYPE%20HTML%20PUBLIC%20%22-//W3C//DTD%20HTML%204.01%20Transitional//EN%22%20%22http%3A//www.w3.org/TR/
html4/loose.dtd%22%3E%0A%3Chtml%3E%0A%3Chead%3E%0A%09%3Cmeta%20http-equiv%3D%5C%22X-UA-Compatible
   5 http://cdn-files.deezer.com/ads/iframe-v189.html?tag=%253Cscript%2520type%253D%27text%252Fjavascript%27%253E%253C!--%252F%252F%253C!%255BCDATA%255B%250D%250A%
2509var%2520m3_u%2520%253D%2520(location.protocol%253D%253D%27https%253A%27%253F%27https%253A%252
   5 http://actu.orange.fr/politique/lambert-ump-sarkozy-pas-en-situation-de-faire-gagner-nos-idees-en-2012_523249.html
   4 http://aquarium.crowdstar.com/iframe/xd_receiver.html#%7B%22id%22%3A0%2C%22sc%22%3A%22http%3A%2F%2Fapi.connect.facebook.com%2Fstatic%2Fv0.4%2Fxd_receiver.php%
22%2C%22sf%22%3A%22fb_api_server%22%2C%22sr%22%3A2%2C%22h%22%3A%22http_client%22%2C%22sid%22%3A%2

doesn't appear to be a start up crash nor is it an addon compat override problem

addons_checked compat-check
  39 unknown
 206 checked

Correlation to startup or time of session
245 total crashes for RtlpFindUCREntry on 20100402-crashdata.csv
33 start up crashes inside 30 seconds of startup

high correlation to this addon

 100% (59/59) vs.   1% (343/58176) litmus-ff@f-secure.com

looks like this might get installed in
FF - component: c:\program files\charter security suite\nrs\litmus-ff@f-secure.com\components\litmus-ff.dll

the f-secure forums didn't turn up anything on firefox or firefox crashes.
could have been site problems at the time of the query or maybe you need a login to search.

http://forum.f-secure.com/default.asp?sectionid=6

anyone have a contact?
the #66 ranked topcrash also shows litmus-ff.dll on the stack

http://crash-stats.mozilla.com/report/list?range_value=2&range_unit=weeks&signature=RtlpUpdateUCRIndexRemove&version=Firefox%3A3.6.3

Crash Reports for RtlpUpdateUCRIndexRemove

http://crash-stats.mozilla.com/report/index/6cac83f5-fcad-4b50-8165-359dc2100403

Frame  	Module  	Signature [Expand]  	Source
0 	ntdll.dll 	RtlpUpdateUCRIndexRemove 	
1 	ntdll.dll 	RtlpRemoveUCRBlock 	
2 	ntdll.dll 	RtlpFindAndCommitPages 	
3 	ntdll.dll 	RtlpExtendHeap 	
4 	ntdll.dll 	RtlpUpdateUCRIndexInsert 	
5 	ntdll.dll 	RtlpAllocateHeap 	
6 	ntdll.dll 	RtlpReAllocateHeap 	
7 	ntdll.dll 	RtlReAllocateHeap 	
8 	litmus-ff.dll 	litmus-ff.dll@0x28cbe 	
9 	litmus-ff.dll 	litmus-ff.dll@0x189c1 	
10 	litmus-ff.dll 	litmus-ff.dll@0x1be3 	
11 	litmus-ff.dll 	litmus-ff.dll@0x99e0 	
12 	litmus-ff.dll 	litmus-ff.dll@0xb955


urls, and distribution across releases are about the same as the other signature

checking --- 20100402-crashdata.csv RtlpUpdateUCRIndexRemove
release total-crashes
              RtlpUpdateUCRIndexRemove crashes
                         pct.
all     305839  120     0.000392363
3.0.15  638     3       0.0047021
3.5.8   14639   5       0.000341553
3.6     21571   13      0.000602661
3.6.2   145880  52      0.000356457


combined frequency of these two signatures would move the problem into the top 15 crashes
Keywords: crash, topcrash
Summary: Firefox crashes [@ RtlpFindUCREntry ] (f-secure charter security suite?) → Firefox crashes [@ RtlpFindUCREntry ] [@ RtlpUpdateUCRIndexRemove ] (f-secure charter security suite?)
(In reply to comment #0)
> the f-secure forums didn't turn up anything on firefox or firefox crashes.
> could have been site problems at the time of the query or maybe you need a
> login to search.
> 
> http://forum.f-secure.com/default.asp?sectionid=6
> 
> anyone have a contact?

i will do the reach out to f-secure !
spotted another signature that I'm guessing is the same.  ntdll.dll@0x3b16b  

this one is 100% windows 6.1

http://crash-stats.mozilla.com/report/index/d0067e8e-11ac-4944-b66e-3e59b2100406

Frame  	Module  	Signature [Expand]  	Source
0 	ntdll.dll 	ntdll.dll@0x3b16b 	
1 	ntdll.dll 	ntdll.dll@0x3b7b4 	
2 	ntdll.dll 	ntdll.dll@0x3b619 	
3 	ntdll.dll 	ntdll.dll@0x3b584 	
4 	ntdll.dll 	ntdll.dll@0x33b4d 	
5 	ntdll.dll 	ntdll.dll@0x42499 	
6 	ntdll.dll 	ntdll.dll@0x4239e 	
7 	litmus-ff.dll 	litmus-ff.dll@0x28342 	
8 	litmus-ff.dll 	litmus-ff.dll@0x19060 	
9 	litmus-ff.dll 	litmus-ff.dll@0x1583 	
10 	litmus-ff.dll 	litmus-ff.dll@0x9160 	
11 	litmus-ff.dll 	litmus-ff.dll@0xb305

more at

http://crash-stats.mozilla.com/report/list?product=Firefox&query_search=signature&query_type=exact&query=ntdll.dll%400x3b16b&date=&range_value=1&range_unit=weeks&process_type=all&plugin_field=&plugin_query_type=&plugin_query=&do_query=1&signature=ntdll.dll%400x3b16b
Summary: Firefox crashes [@ RtlpFindUCREntry ] [@ RtlpUpdateUCRIndexRemove ] (f-secure charter security suite?) → Firefox crashes [@ RtlpFindUCREntry ] [@ RtlpUpdateUCRIndexRemove ] [@ ntdll.dll@0x3b16b ] (f-secure litmus-ff.dll charter security suite?)
the .dll appears to get loaded from FF - component: c:\program files\f-secure\nrs\litmus-ff@f-secure.com\components\litmus-ff.dll
This seems to be happening for users of various Facebook applications, and also for anyone trying to login to heiaheia.com. Disabling F-Secure Browser Protection add-on helps the problem.
Crash Signature: [@ RtlpFindUCREntry ] [@ RtlpUpdateUCRIndexRemove ] [@ ntdll.dll@0x3b16b ]
These are still around but in very low volume on recent versions. I am going to remove the top crash keyword.
Crash Signature: [@ RtlpFindUCREntry ] [@ RtlpUpdateUCRIndexRemove ] [@ ntdll.dll@0x3b16b ] → [@ RtlpFindUCREntry ] [@ RtlpUpdateUCRIndexRemove ] [@ ntdll.dll@0x3b16b ]
Keywords: topcrash
Mass-closing old Extension Compatibility bugs that relate to legacy add-ons or NPAPI plug-ins. If you think this bug is still valid, please reopen or comment.

Sorry for the bug spam, and happy Friday!
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → WONTFIX
You need to log in before you can comment on or make changes to this bug.