570722 - Sharp rise in crashes [@ SogouPy.ime ]

Status: RESOLVED FIXED

(External Software Affecting Firefox :: Other, defect)

Description

[chris hofmann]

date     total crashes at
         SogouPy.ime
20100601 10
20100602 13
20100603 7
20100604 13
20100605 14
20100606 18
20100607 608

happening across just about all versions

checking --- SogouPy.ime 20100607-crashdata.csv
found in: 3.6.3 3.6.4 3.5.9 3.6 3.0.19 3.6.2 3.5.2 3.5.7 3.7a5pre 3.5.1 3.0.3 3.0.17 3.0.14
release total-crashes
              SogouPy.ime crashes
                         pct.
all     378025  606     0.00160307
3.6.3   259578  311     0.0011981
3.6.4   31050   252     0.00811594
3.5.9   32647   16      0.000490091
3.6     11340   8       0.000705467
3.0.19  12076   6       0.000496853

Sogou.com is Search provider in China, but its hard to say if these crashes are connected to something they provide or possible malware hijacking the name.

May need some help on contacts to Sogou.com and translation to diagnose what this is.

http://www.google.com/search?q=SogouPy.ime&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a

Comment 1

[chris hofmann]

Pretty evenly distributed across all windows versions.

SogouPy.imeTotal 605
Win5.1  0.68
Win6.0  0.08
Win6.1  0.23


signature list
 200 SogouPy.ime@0xd96ba
 196 SogouPy.ime@0xd973e
  45 SogouPy.ime@0xd972e
  42 SogouPy.ime@0xd96aa
  19 SogouPy.ime@0xd9718
  17 SogouPy.ime@0xd975c
   9 SogouPy.ime@0xddba4
   7 SogouPy.ime@0xd95ca
   6 SogouPy.ime@0xddbcc
   5 SogouPy.ime@0xddbc7
   5 SogouPy.ime@0xddbc2
   4 SogouPy.ime@0xd9708
   4 SogouPy.ime@0xd96ea
   4 SogouPy.ime@0x31b76
   3 SogouPy.ime@0xddb9f
   3 SogouPy.ime@0xddb9a
   3 SogouPy.ime@0xd964e
   3 SogouPy.ime@0x17c9cc
   2 SogouPy.ime@0xddbae
   2 SogouPy.ime@0xddb94
   2 SogouPy.ime@0xddb8f
   2 SogouPy.ime@0xd976e
   2 SogouPy.ime@0x24d1
   1 hang | SogouPy.ime@0x286a0
   1 SogouPy.ime@0xddbf2
   1 SogouPy.ime@0xddbbd
   1 SogouPy.ime@0xddbbc
   1 SogouPy.ime@0xddbb2
   1 SogouPy.ime@0xddbad
   1 SogouPy.ime@0xddb96
   1 SogouPy.ime@0xddb86
   1 SogouPy.ime@0xd974c
   1 SogouPy.ime@0xd966c
   1 SogouPy.ime@0xd3d88
   1 SogouPy.ime@0x6706a
   1 SogouPy.ime@0xd974c
   1 SogouPy.ime@0xd966c
   1 SogouPy.ime@0xd3d88
   1 SogouPy.ime@0x6706a
   1 SogouPy.ime@0x27357
   1 SogouPy.ime@0x20df0
   1 SogouPy.ime@0x1b76f5
   1 SogouPy.ime@0x18297
   1 SogouPy.ime@0x17d24a
   1 SogouPy.ime@0x174153
   1 SogouPy.ime@0x157eea

looks like things started to ramp up yesterday morning but then a spike in crashes at 2000-2059 hrs. PDT last night or morning time in asia.

   4 2010060700
   4 2010060701
   7 2010060702
  19 2010060703
  30 2010060704
  21 2010060705
  26 2010060706
  40 2010060707
  20 2010060708
  13 2010060709
  11 2010060710
   8 2010060711
   3 2010060712
   5 2010060713
   2 2010060714
   3 2010060715
   5 2010060716
  20 2010060717
  59 2010060718
  79 2010060719
 220 2010060720
   4 2010060721
   3 2010060723

crash urls are primarily asian sites

  66 http://www.baidu.com
  23 http://www.google.com.hk
  23 http://www.facebook.com
  23 http://tieba.baidu.com
  23 about:blank//
  19 http://www.renren.com
  19 \N//
  15 http://photo.renren.com
  13 http://t.sina.com.cn
  12 http://zh-cn.start3.mozilla.com
  12 http://www.google.com
  11 http://zhidao.baidu.com
  11 http://baike.baidu.com
  10 http://blog.renren.com
   9 http://i.g-fox.cn
   8 http://www.kaixin001.com
   7 http://user.qzone.qq.com
   6 http://www.douban.com
   6 http://share.renren.com
   5 http://www.tudou.com
   5 http://blog.sohu.com
   4 https://mail.google.com
   4 http://www.youku.com
   4 http://www.hao123.com
   4 http://www.guanshangxia.com
   4 http://www.eeff.net
   4 http://image.baidu.com
   4 http://hao.360.cn
   4 http://bbs.cjdby.net
   3 http://www.yinyuetai.com
   3 http://www.xcar.com.cn
   3 http://www.sznet110.gov.cn
   3 http://www.google.com.my
   3 http://www.feiku.com
   3 http://search.taobao.com
   3 http://scm.dkuai.com
   3 http://personal.120ask.com
   3 http://china.alibaba.com
   3 http://book.douban.com
   3 http://blog.sina.com.cn
<long tail snipped>

Comment 2

[Lingfeng.Guan]

Hello. I'm Lingfeng Guan from China. I think I can provide some information to help you locate the bug.

Sogou Pinyin is the most popular IME in China, it uses search engine data to help correct the IME precision. And it's download link is here, http://ime.sogou.com/dl/sogou_pinyin_50f.exe

We received some user report this bug in China too, yesterday. And the user wrote about the bug on a blog. http://www.cnwyw.net/post/sou-gou-pin-yin-yun-ji-suan-firefox-chong-tu-beng-kui/

The main information about that bug is:
    Firefox version: 3.6.4
    Sogou Pinyin version: 5.0.0.3935
       subversion info of Sogou Pinyin:
           word frequency data: 20100205
           word compose data:20100205
           supplementary data: 20090106
           compile time: May 5 2010 14:40:19

    The crash happens if the checkbox option on the attachment picture 1 is open (It means to get word information from the cloud, and it's open by default), and options on picture 2 is selected (This one means to use the left shift as a shortcut to select the second position word and right shift to select the third ).

    At this time, if the user type a pinyin, and the word from the cloud appears at the second position,(The word from the cloud usually appears at that position if there is one, and that word appears with an animation. The pinyin 'youyoubai' will trigger the word from the cloud) and then user use left shift to select the word, firefox will crash immediately.

Comment 3

[Lingfeng.Guan]

Attachment: picture 1

Comment 4

[Lingfeng.Guan]

Attachment: picture 2

Comment 5

[Lingfeng.Guan]

I tried to reproduce the bug, but it didn't happen on my Windows7 English version

Comment 6

[Lingfeng.Guan]

Also not working on my WindowsXP SP2

Comment 7

[Lingfeng.Guan]

Sorry for my bad english. I mean I can not reproduce the crash on my WindowsXP Chinese version.
I've contacted the original bug reporter, still waiting for his reply.

Comment 8

[Lingfeng.Guan]

I've checked with a Engineer working in the sogou IME team. He said that their IME had a server side bug on June 7th, caused the string downloaded from the cloud cross array boundary and cause firefox crash.

The bug was fixed already. That's why I cannot reproduce the bug.

According to him, the crash happens inside the IME dll, and that caused every client contains the dll crash with it, including MS Word, MSN, etc.

Does this mean there's nothing we could do about this?

Comment 9

[chris hofmann]

Yes, it sounds like it.  The crash volume yesterday dropped down to previous levels again.

20100606 18
20100607 608
20100608 15

I think we could consider the major problem fixed.  Since we have made contact now we could see if they could investigate the lower volume crash that happens 20 or fewer times per day.

That set of signatures looks like

signature list
   4 SogouPy.ime@0x2d06
   1 SogouPy.ime@0xa1451
   1 SogouPy.ime@0x8ffb
   1 SogouPy.ime@0x5309f
   1 SogouPy.ime@0x3fd93
   1 SogouPy.ime@0x31578
   1 SogouPy.ime@0x2e705
   1 SogouPy.ime@0x2a380
   1 SogouPy.ime@0x1d3181
   1 SogouPy.ime@0x17c9cc
   1 SogouPy.ime@0x11045d
   1 SogouPy.ime@0x106c2e

Comment 10

[Lingfeng.Guan]

Sorry for my ignorance, but I don't know what these signatures mean, where can I learn more about these signatures?

Comment 11

[chris hofmann]

You can search for them on the crash-stats site

http://crash-stats.mozilla.com/query

here is a list of crash reports for that first one

http://crash-stats.mozilla.com/query/query?version=ALL%3AALL&range_value=1&range_unit=weeks&date=06%2F09%2F2010+08%3A15%3A54&query_search=signature&query_type=exact&query=SogouPy.ime%400x2d06&build_id=&process_type=any&hang_type=any&do_query=1

http://crash-stats.mozilla.com/report/list?query_search=signature&query_type=exact&query=SogouPy.ime%400x2d06&date=06%2F09%2F2010%2008%3A15%3A54&range_value=1&range_unit=weeks&hang_type=any&process_type=any&plugin_field=&plugin_query_type=&plugin_query=&do_query=1&signature=SogouPy.ime%400x2d06

(comments on the right side of that report above are sometimes helpful in understanding what is going on)

and here is a stack signature from one of the individual crash reports

http://crash-stats.mozilla.com/report/index/d815e925-4fc4-4e51-8cf6-3254a2100608

Frame  	Module  	Signature [Expand]  	Source
0 	SogouPy.ime 	SogouPy.ime@0x2d06 	
1 	SogouPy.ime 	SogouPy.ime@0x5c249 	
2 	SogouPy.ime 	SogouPy.ime@0x103fc 	
3 	imm32.dll 	InternalImmLockIMC 	
4 	SogouPy.ime 	SogouPy.ime@0x14a637 	
5 	SogouPy.ime 	SogouPy.ime@0x14a825 	
6 	SogouPy.ime 	SogouPy.ime@0x143d5a 	
7 	SogouPy.ime 	SogouPy.ime@0x1493aa 	
8 	user32.dll 	StringDuplicateW 	
9 	user32.dll 	StringDuplicateW 	
10 	firefox.exe 	firefox.exe@0x1ba7 	
11 	kernel32.dll 	GetCodePageFileInfo 	
12 	kernel32.dll 	BaseProcessStart 	
13 	firefox.exe 	firefox.exe@0x183f

Comment 12

[Aakash Desai [:aakashd]]

It's a common sore point mentioned on Input as well (these searches only show 4 results here, but I've seen more):

http://input.mozilla.com/en-US/search/?q=sogou&product=firefox
http://input.mozilla.com/en-US/search/?q=%E6%90%9C%E7%8B%97&product=firefox

Comment 13

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Looks like the crashes are not our fault.

Comment 14

[Lingfeng.Guan]

No they are not. The crash is because of sogou IME fetch input results from the "cloud", and on that day, their cloud side got something wrong and caused a invalid pointer exception on the client side. That crashed all applications on that day.