622140 - Firefox crash in DataMngr

Status: RESOLVED WONTFIX

(Firefox :: Extension Compatibility, defect)

Description

[Marcia Knous [:marcia]]

Currently #14 top crash in Beta 8. http://tinyurl.com/3aelyty to the crashes which are all Windows.

Frame 	Module 	Signature [Expand] 	Source
0 		@0x0 	
1 	datamngr.dll 	datamngr.dll@0x9ec1 	
2 	datamngr.dll 	datamngr.dll@0x6b1e 	
3 	datamngr.dll 	datamngr.dll@0x6ae3 	
4 	datamngr.dll 	datamngr.dll@0x2bb1 	
5 	datamngr.dll 	datamngr.dll@0x344d2 	
6 	kernel32.dll 	MoveFileWithProgressW 	
7 	kernel32.dll 	GetCodePageFileInfo 	
8 	kernel32.dll 	MoveFileExW 	
9 	xul.dll 	nsLocalFile::CopySingleFile 	xpcom/io/nsLocalFileWin.cpp:1480
10 	xul.dll 	nsLocalFile::IsSymlink 	xpcom/io/nsLocalFileWin.cpp:2518
11 	datamngr.dll 	datamngr.dll@0xa723

Comment 1

[timeless]

http://www.freefixer.com/library/file/62043/
http://www.mywot.com/en/forum/3727-pantheraproject-net

Blocklist it.

Comment 2

[Dave Townsend [:mossop]]

This is just a random dll that needs adding to nsWindowsDllBlocklist.h right?

Comment 3

[chris hofmann]

google searches turn up lots of possible things that call themselves "datamngr"

everything from ms mobile sycn tools to diabetes monitoring software.

some virus scanners pick up installation of a dll by that name at:
C:\Program Files\Shareaza Applications\MediaBar\Datamngr\datamngr.dll (Discordia, LTD)   -- that match with the mywot report.

and datamngr.dll was added to FreeFixer's database on 5th September 2010. The most recent search for this file was done on 11th September 2010. datamngr.dll is usually located in the 'c:\progra~1\wi9130~1\datamngr\ matches with the freefixer report.

100% of the datamngr.dll crashes on jan 11 also have version info of 1.0.0.1

we could block by that version number to reduce risk of name space collision and blocking something thats not causing problems by that .dll name.

Comment 4

[Benjamin Smedberg]

After discussion with Mossop, I don't think we're going to block on this.

Comment 5

[Scoobidiver (away)]

With combined signatures, it is a virtual #9 top crasher in 4.0b9 for the last week.

More reports at:
http://crash-stats.mozilla.com/query/query?product=Firefox&version=Firefox%3A4.0b9&platform=windows&branch=2.0&range_value=1&range_unit=weeks&query_search=signature&query_type=startswith&query=@0x0%20|%20datamngr.dll&build_id=&process_type=any&hang_type=any&do_query=1

Comment 6

[timeless]

mossop: yes

Comment 7

[Scoobidiver (away)]

With combined signatures, it is a virtual #13 top crasher in 4.0b10 over the last
week.

Comment 8

[Scoobidiver (away)]

With combined signatures, it is a virtual #12 top crasher in 4.0b12 and #32 in 3.6.13.

In reply to comment 3
> 100% of the datamngr.dll crashes on jan 11 also have version info of 1.0.0.1
> we could block by that version number to reduce risk of name space collision
> and blocking something thats not causing problems by that .dll name.
Is it possible to add to the blocklisting, in addition to the version, another optional field like the file size or MD5 or any other file properties to prevent confusion with other valid dlls?
Here is the information on the culprit dll:
http://systemexplorer.net/db/datamngr.dll.html

Comment 9

[chris hofmann]

ok, imesh looks like somekind of filesharing thing. http://www.imesh.com/

can someone with a windows vm download the latest, install, and find out if it is dropping a crashy datamngr.dll version 1.0.0.1.

kev, we can probably do outreach to find a contact there now that we have a bit more to go on.

Comment 10

[Marcia Knous [:marcia]]

Yes, confirming in Win XP VM that the dll is installed in the following directory:

C:\Program Files\iMesh\Applications\MediaBar\Datamngr

There is also another dll - IEHBO.dll

(In reply to comment #9)
> ok, imesh looks like somekind of filesharing thing. http://www.imesh.com/
> 
> can someone with a windows vm download the latest, install, and find out if it
> is dropping a crashy datamngr.dll version 1.0.0.1.
> 
> kev, we can probably do outreach to find a contact there now that we have a bit
> more to go on.

Comment 11

[Marcia Knous [:marcia]]

https://crash-stats.mozilla.com/report/list?signature=@0x0%20|%20datamngr.dll@0xd2d1 is seen across all versions, but currently #17 top crash on Firefox 5 B2.

Comment 12

[Scoobidiver (away)]

(In reply to comment #11)
> but currently #17 top crash on Firefox 5 B2.
and #11 top crasher without hangs.

Comment 13

[Marcia Knous [:marcia]]

1,240 crashes show up in the last week for all the dlls listed in this bug across all versions of Firefox 5 currently out there.

Comment 14

[Robert Kaiser]

This seems to be installed with a number of tools and seems to be adware or something like it. See http://forums.spybot.info/showthread.php?t=62634 for a report on yet another tool that installs this, or also http://support.mozilla.com/de/questions/790833 and http://support.mozilla.com/de/questions/816181 - there is a "DataMngr" add-on installed for many of those people, but not all of them.

https://crash-stats.mozilla.com/report/list?signature=datamngrhlp.dll%400x4808 and https://crash-stats.mozilla.com/report/list?signature=datamngrhlpff3.dll%400x4808 are currently strongly rising instances of this (note that the latter is FF 3.6 and not just 4, so adjusting summary), the former one has 36% correlation (udner 4.0.1) with that "DataMngr" add-on under the add-on ID {1FD91A9C-410C-4090-BBCC-55D3450EF433} and the latter has 100% correlation with it (under 3.6.17).

I guess the crashes are probably the tip of the iceberg of problems with this, so I'd vote strongly for blocklisting both the {1FD91A9C-410C-4090-BBCC-55D3450EF433} add-on and the datamgr.dll.

Comment 15

[Scoobidiver (away)]

(In reply to comment #14)
> I guess the crashes are probably the tip of the iceberg of problems with
> this, so I'd vote strongly for blocklisting both the
> {1FD91A9C-410C-4090-BBCC-55D3450EF433} add-on and the datamgr.dll.
Me too.
Indeed, with combined signatures, it is a virtual #5 top crasher in 4.0.1 with 7622 crashes/week and #3 top crasher in 5.0b3 with 713 crashes/week.

Comment 16

[Johnathan Nightingale [:johnath]]

Discussed in today's beta call - we think it's a candidate for blocklisting but to do that we'd need version numbers, and it would probably have to hold over to firefox 6 at the earliest. Scoobi - should we just block all versions?

Comment 17

[Scoobidiver (away)]

(In reply to comment #16)
> Scoobi - should we just block all versions?
Module (maybe too late for Firefox 5):
* datamngr.dll (Imesh)  version: 1.0.0.1 (risk to blocklist other valid dlls, see comment 3 and comment 8)

Extensions (hijacker/adware categories):
* {1FD91A9C-410C-4090-BBCC-55D3450EF433} all versions (jZip.Toolbar, see http://forums.spybot.info/showthread.php?t=62634)
* {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} all versions (MediaBar, see http://www.spywareremove.com/removeBearShareMediabar.html)
* {28387537-e3f9-4ed7-860c-11e69af4a8a0} all versions (MediaBar)
* {99079a25-328f-4bd4-be04-00955acaa0a7} all versions (Searchqu toolbar, other name of MediaBar)

Comment 18

[Marcia Knous [:marcia]]

Per Beta triage, Marcia to file the blocklisting bug.

Comment 19

[Marcia Knous [:marcia]]

Bug 665775 filed for the Blocklist piece.

Comment 20

[Scoobidiver (away)]

I moved it to the extension compatibility category.

Comment 21

[Marcia Knous [:marcia]]

9,952 crashes across all versions in the last week in these various signatures.

Comment 22

[Marcia Knous [:marcia]]

8,250 crashes across all versions in the last week. There are still some questions in Bug 665775 as to information we would need to do the blocklist.

Comment 23

[Scoobidiver (away)]

There is a new startup crash signature from 15.0 that makes it #16 top browser crasher in the first days of 15.0b1: https://crash-stats.mozilla.com/report/list?signature=datamngr.dll%400xda84f

Here are correlations per module version:
    100% (61/61) vs.   5% (533/11823) datamngr.dll
         89% (54/61) vs.   4% (463/11823) 1.0.0.1
         11% (7/61) vs.   0% (20/11823) 3.0.0.56544

The DLL blocklist should be hardened so that the patch of bug 665775 can work.

Comment 24

[Lukas Blakk [:lsblakk] use ?needinfo]

Bug 665775 isn't going to be the fix we hoped for since it seems we can't blocklist datamngr.dll on Win7 which comprises half the crashes we're getting for this signature. Also this is at #22 now for 15.0b1 and I can't see that we'd block 15 release on this issue even though it is important to continue working on finding an alternative to blocklisting. Untracking for now, if a solution for blocking datamngr.dll for all windows users presents itself we can revisit tracking it for release.

Comment 25

[Scoobidiver (away)]

It's #40 top browser crasher w/o hangs in 17.0 and #44 in 18.0b1 so no longer a top crasher (arbitrary restricted to the top 20).

Comment 26

[u279076]

It's a bit early days but this is showing up at #12 in Firefox 25.0b1.
https://crash-stats.mozilla.com/topcrasher/products/Firefox/versions/25.0b1

Comment 27

[Wayne Mery (:wsmwk)]

Has stack has morphed to containing the following?

 10 	xul.dll	OpenFile(nsString const&, int, int, PRFileDesc**)	xpcom/io/nsLocalFileWin.cpp
11 	xul.dll	nsLocalFile::OpenNSPRFileDesc(int, int, PRFileDesc**)	xpcom/io/nsLocalFileWin.cpp
12 	xul.dll	nsFileStreamBase::DoOpen()	netwerk/base/src/nsFileStreams.cpp
13 	xul.dll	nsFileStreamBase::MaybeOpen(nsIFile*, int, int, bool)	netwerk/base/src/nsFileStreams.cpp
14 	xul.dll	nsFileInputStream::Open(nsIFile*, int, int)	netwerk/base/src/nsFileStreams.cpp 

If so, then 99% of crashes are startup. And at least 50% are so-called "duplicates"

https://crash-stats.mozilla.com/query/?product=Firefox&version=Firefox%3A35.0a1&version=Firefox%3A34.0a2&version=Firefox%3A33.0b&version=Firefox%3A32.0.1&version=Firefox%3A34.0a1&version=Firefox%3A31.0&range_value=2&range_unit=weeks&date=09%2F15%2F2014+16%3A00%3A00&query_search=signature&query_type=contains&query=datamngr.dll&reason=&release_channels=&build_id=&process_type=any&hang_type=any

Comment 28

[Jorge Villalobos [:jorgev] (he/him)]

Mass-closing old Extension Compatibility bugs that relate to legacy add-ons or NPAPI plug-ins. If you think this bug is still valid, please reopen or comment.

Sorry for the bug spam, and happy Friday!