Firefox 4.0b6 crash on Windows Vista/7 [@ BaseThreadInitThunk ]

NEW
Unassigned

Status

()

defect
--
critical
9 years ago
2 years ago

People

(Reporter: scoobidiver, Unassigned)

Tracking

(Blocks 1 bug, {crash})

Trunk
x86
Windows 7
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox10-, firefox47 affected, firefox48 affected, firefox49 affected, firefox-esr45 affected, firefox50 affected, firefox51 affected, firefox52 wontfix, firefox53 affected)

Details

(crash signature)

(Reporter)

Description

9 years ago
Build : Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0b6) Gecko/20100101 Firefox/4.0b6

It is a residual crash signature that exist in 3.0, 3.5, 3.6 and trunk builds.
It happens only on Windows Vista/7.
It is #76 top crasher in 4.0b6 for the last 2 weeks.

98% of the crashes occur when these 2 following dll are loaded :
* pnrpnsp.dll : PNRP Name Space Provider.
* NapiNSP.dll : E-mail Naming Shim Provider

Comments about FF 3.6.10 says it is recent issue :
"Why does this keep happening???? Service was really good for 6 months, now I can't even get through my e-mail"
"hey this is really not good man.....my firefox crashes everytime since last 2 weeks........pls fix it..."

Signature	BaseThreadInitThunk
UUID	c74f2e2f-027a-4aac-80ac-062462101002
Time 	2010-10-02 01:03:23.840996
Uptime	123
Install Age	96077 seconds (1.1 days) since version was first installed.
Product	Firefox
Version	4.0b7pre
Build ID	20100930041305
Branch	2.0
OS	Windows NT
OS Version	6.0.6002 Service Pack 2
CPU	x86
CPU Info	GenuineIntel family 6 model 15 stepping 13
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x3cf1000
App Notes 	AdapterVendorID: 1002, AdapterDeviceID: 95c4

Frame 	Module 	Signature [Expand] 	Source
0 		@0x5164a 	
1 		@0x52948 	
2 		@0x5473a 	
3 		@0x54830 	
4 		@0x54db7 	
5 	kernel32.dll 	BaseThreadInitThunk 	
6 	ntdll.dll 	__RtlUserThreadStart 	
7 	ntdll.dll 	_RtlUserThreadStart 	

More reports at:
http://crash-stats.mozilla.com/report/list?range_value=1&range_unit=days&signature=BaseThreadInitThunk

Comment 2

8 years ago
392 of those reports were yesterday, where this really exploded, and today this seems to be going on.
(Reporter)

Comment 3

8 years ago
It is #57 top crasher in 4.0 over the last day.

According to crash stats, some crashes happen at startup.
According to some comments, some crashes happen when exiting Firefox.

Comment 4

8 years ago
This saw a significant rise on 4.0* yesterday and is #79 there now. Correlations on 4.0.1 say the following:

94% (219/232) vs.  34% (49345/143288) Wldap32.dll
100% (232/232) vs.  41% (58948/143288) nsi.dll
100% (232/232) vs.  41% (58974/143288) dwmapi.dll
95% (221/232) vs.  38% (54509/143288) propsys.dll
96% (223/232) vs.  39% (56433/143288) powrprof.dll
91% (210/232) vs.  36% (50979/143288) winnsi.dll
91% (210/232) vs.  36% (50995/143288) IPHLPAPI.DLL
51% (119/232) vs.   1% (1066/143288) win32sta.dll

This also happens on 5.0 and is #39 there now, so we really should look into that, if possible.
Crash Signature: [@ BaseThreadInitThunk ]

Comment 5

8 years ago
I tried everything only to find out that Vista updated without me knowing. I restored to an earlier restore point and I AM BACK BABY.

Try it.
(Reporter)

Updated

8 years ago
Crash Signature: [@ BaseThreadInitThunk ] → [@ BaseThreadInitThunk ] [@ @0x0 | BaseThreadInitThunk ]

Comment 6

7 years ago
This exploded on all versions recently, and is #12 on 9.* and #3 on 10.* in yesterday's data, which doesn't look too good. Bug 524944 has exploded in the last days on all versions as well.
Keywords: topcrash
(Reporter)

Updated

7 years ago
Whiteboard: startupcrash
(Reporter)

Comment 7

7 years ago
The spike is correlated to JScript and Power Profile Helper DLL:
  BaseThreadInitThunk|EXCEPTION_ACCESS_VIOLATION_WRITE (571 crashes)
     52% (299/571) vs.   1% (1935/129459) jscript.dll
    100% (571/571) vs.  43% (55348/129459) powrprof.dll

  BaseThreadInitThunk|EXCEPTION_ACCESS_VIOLATION_READ (383 crashes)
     49% (187/383) vs.   1% (1935/129459) jscript.dll
    100% (383/383) vs.  43% (55348/129459) powrprof.dll

One Spanish comment says: "browser close when I open orbit grab +" (Google Translate)
The latest release of OrbitDownloadHelper was in June 2011: http://www.orbitdownloader.com/changelog.htm

Comment 8

7 years ago
In comment #4, powrprof.dll already was high, so this might generally be connected with some energy saving behavior or such.

The correlation to jscript.dll is new, correlates with the bug 524944 spike and might potentially point to some malware or such, as I'm unsure which legitimate software loaded into Firefox would use JScript - but then, crazier things have happened in the Software business.

Comment 9

7 years ago
KaiRo, all versions implies it's external. Is there outreach we should be doing? I don't know much about the OrbitDownloader.

Comment 10

7 years ago
(In reply to Sheila Mooney from comment #9)
> KaiRo, all versions implies it's external. Is there outreach we should be
> doing? I don't know much about the OrbitDownloader.

It feels a lot like the spike is malware but we don't have a real clue yet.
Same as bug 52944, spike in all versions, so no need to track for 11.
(Reporter)

Comment 12

7 years ago
s/bug 52944/bug 524944/

Comment 13

7 years ago
This is pretty far down on both 10.0 and 9.0.1. It's outside the top 100. I am going to remove the topcrash keyword.
Keywords: topcrash

Comment 14

7 years ago
On yesterday's 10.0.2 data, this is back high, #15 in https://crash-stats.mozilla.com/topcrasher/byversion/Firefox/10.0.2/1/browser currently.
Keywords: topcrash
(In reply to Robert Kaiser (:kairo@mozilla.com) from comment #10)
> (In reply to Sheila Mooney from comment #9)
> > KaiRo, all versions implies it's external. Is there outreach we should be
> > doing? I don't know much about the OrbitDownloader.
> 
> It feels a lot like the spike is malware but we don't have a real clue yet.

Wouldn't malware show up in our DLL correlation reports?

Comment 16

7 years ago
(In reply to Alex Keybl [:akeybl] from comment #15)
> Wouldn't malware show up in our DLL correlation reports?

Usually, it would be loaded into our process and therefore show up, yes. We don't see that here. Still, the coming and going of this in waves over several current versions in parallel is what we are typically seeing with malware-related issues, so it *feels* like malware but we don't actually have evidence to prove that.
(Reporter)

Updated

7 years ago
Depends on: 732003
(Reporter)

Updated

7 years ago
Depends on: 665775

Comment 17

7 years ago
Sitting at #38 on Fx12.
No longer blocks: malware-attacks
No longer depends on: 665775, 732003
(Reporter)

Updated

7 years ago
Depends on: 665775, 732003

Comment 18

7 years ago
Sitting at #36 on Firefox 16.0.1

Comment 19

6 years ago
#20 in 17.0.1, #22 in early 18.0 data, #17 in 18.0b7, still qualifies as topcrash.
(Reporter)

Comment 20

6 years ago
It's a period where it's not a top crasher: #29 in 19.0, #38 in 20.0b1, #81 in 21.0a2.

In addition, it's no longer a startup crash.
Keywords: topcrash
OS: Windows Vista → Windows 7
Whiteboard: startupcrash
(Reporter)

Comment 21

6 years ago
It's correlated to MS Windows Search (see http://systemexplorer.net/file-database/file/msshsq-dll/5844765):
  BaseThreadInitThunk|EXCEPTION_ACCESS_VIOLATION_EXEC (288 crashes)
     72% (206/288) vs.   0% (692/139851) msshsq.dll

Comment 22

4 years ago
I've hit this bug twice. Usually mixing (opening or closing) normal Firefox 64bits windows with e10s Firefox 64bits windows.

Updated

4 years ago
See Also: → 802825
Crash volume for signature '@0x0 | BaseThreadInitThunk':
 - nightly (version 50): 0 crash from 2016-06-06.
 - aurora  (version 49): 1 crash from 2016-06-07.
 - beta    (version 48): 39 crashes from 2016-06-06.
 - release (version 47): 478 crashes from 2016-05-31.
 - esr     (version 45): 4337 crashes from 2016-04-07.

Crash volume on the last weeks:
             Week N-1   Week N-2   Week N-3   Week N-4   Week N-5   Week N-6   Week N-7
 - nightly          0          0          0          0          0          0          0
 - aurora           0          0          0          0          0          1          0
 - beta             4         10          0          2          8         11          0
 - release         51        104         52         50         80         73          8
 - esr            436       1689        177        196        180        707        109

Affected platform: Windows
Crash volume for signature '@0x0 | BaseThreadInitThunk':
 - nightly(version 50):1 crash from 2016-06-06.
 - aurora (version 49):1 crash from 2016-06-07.
 - beta   (version 48):39 crashes from 2016-06-06.
 - release(version 47):516 crashes from 2016-05-31.
 - esr    (version 45):4873 crashes from 2016-04-07.

Crash volume on the last weeks:
            W. N-1  W. N-2  W. N-3  W. N-4  W. N-5  W. N-6  W. N-7
 - nightly       1       0       0       0       0       0       0
 - aurora        0       0       0       0       0       0       1
 - beta          4       4      10       0       2       8      11
 - release      94      51     104      52      50      80      73
 - esr         820     436    1689     177     196     180     707

Affected platform: Windows
Crash volume for signature 'BaseThreadInitThunk':
 - nightly (version 51): 3 crashes from 2016-08-01.
 - aurora  (version 50): 8 crashes from 2016-08-01.
 - beta    (version 49): 111 crashes from 2016-08-02.
 - release (version 48): 206 crashes from 2016-07-25.
 - esr     (version 45): 1824 crashes from 2016-05-02.

Crash volume on the last weeks (Week N is from 08-22 to 08-28):
            W. N-1  W. N-2  W. N-3
 - nightly       1       1       1
 - aurora        1       3       0
 - beta         22      35      22
 - release      78      55      38
 - esr         217     186     150

Affected platform: Windows

Crash rank on the last 7 days:
           Browser     Content Plugin
 - nightly
 - aurora  #363                #170
 - beta    #425                #505
 - release #349                #387
 - esr     #39                 #217
Crash volume for signature 'BaseThreadInitThunk':
 - nightly (version 52): 11 crashes from 2016-09-19.
 - aurora  (version 51): 4 crashes from 2016-09-19.
 - beta    (version 50): 44 crashes from 2016-09-20.
 - release (version 49): 187 crashes from 2016-09-05.
 - esr     (version 45): 3109 crashes from 2016-06-01.

Crash volume on the last weeks (Week N is from 10-03 to 10-09):
            W. N-1  W. N-2
 - nightly      10       1
 - aurora        4       0
 - beta         32      12
 - release     156      31
 - esr         118     196

Affected platform: Windows

Crash rank on the last 7 days:
           Browser   Content   Plugin
 - nightly           #91
 - aurora            #213      #162
 - beta    #773      #269      #186
 - release #356      #826      #285
 - esr     #103
Crash volume for signature 'BaseThreadInitThunk':
 - nightly (version 53): 30 crashes from 2016-11-14.
 - aurora  (version 52): 431 crashes from 2016-11-14.
 - beta    (version 51): 7366 crashes from 2016-11-14.
 - release (version 50): 18103 crashes from 2016-11-01.
 - esr     (version 45): 5276 crashes from 2016-07-15.

Crash volume on the last weeks (Week N is from 01-09 to 01-15):
            W. N-1  W. N-2  W. N-3  W. N-4  W. N-5  W. N-6  W. N-7
 - nightly       6       5       6       0       0       0       1
 - aurora       62     178      67       7      12      12      20
 - beta       1921    1627     976     498     872     555     141
 - release    3840    3327    1826    2527    2892    1362     235
 - esr         293     142     252     351      93      81      47

Affected platform: Windows

Crash rank on the last 7 days:
           Browser   Content   Plugin
 - nightly #183      #775
 - aurora  #29       #47
 - beta    #11       #16       #397
 - release #16       #70       #288
 - esr     #65                 #592
Too late for firefox 52, mass-wontfix.
You need to log in before you can comment on or make changes to this bug.