Closed Bug 644125 Opened 13 years ago Closed 9 years ago

Crash on Windows 7 @ RtlpCallQueryRegistryRoutine | BaseThreadInitThunk mainly with Norton IPS 2.0 and probably plugin-container.exe quarantined

Categories

(Core :: General, defect)

x86
Windows 7
defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: scoobidiver, Unassigned)

References

Details

(Keywords: crash, user-doc-needed)

Crash Data

It is a residual crash signature that exists in 3.6 and 4.0.
Crashes in 4.0 are correlated to DWrite (well distributed across versions), even it is not enabled.
Comments talk about plugins.
It is #34 top crasher over the last 3 days.

Signature	RtlpCallQueryRegistryRoutine
UUID	8901377b-b649-4e60-a850-da97b2110323
Time 	2011-03-23 01:37:51.76280
Uptime	1
Last Crash	385 seconds (6.4 minutes) before submission
Install Age	163933 seconds (1.9 days) since version was first installed.
Product	Firefox
Version	4.0
Build ID	20110318052756
Branch	2.0
OS	Windows NT
OS Version	6.1.7600
CPU	x86
CPU Info	GenuineIntel family 6 model 37 stepping 5
Crash Reason	0xc000070a / 0x00000000
Crash Address	0x77d9c7bd
App Notes 	AdapterVendorID: 8086, AdapterDeviceID: 0046, AdapterDriverVersion: 8.15.10.2202
D2D? D2D+
DWrite? DWrite+
D3D10 Layers? D3D10 Layers+

Frame 	Module 	Signature [Expand] 	Source
0 	ntdll.dll 	RtlpCallQueryRegistryRoutine 	
1 	kernel32.dll 	BaseThreadInitThunk 	
2 	ntdll.dll 	__RtlUserThreadStart 	
3 	ntdll.dll 	_RtlUserThreadStart 	

More reports at:
https://crash-stats.mozilla.com/report/list?range_value=2&range_unit=weeks&signature=RtlpCallQueryRegistryRoutine

4.0 correlations by module give:
100% (603/605) vs.  36% (61971/173285) DWrite.dll
 41% (248/605) vs.  13% (23294/173285) d2d1.dll
 41% (248/605) vs.  13% (23175/173285) d3d10.dll
This is the currently the top crash on 3.6.16 with over 12K in crashes. I looked back and in 3.6.15 it was ranked #242.
Keywords: topcrash
Interestingly, this had 0 reports total in all Firefox data for a week until it started to come up with 202 total crashes on 2011-03-20, 353 the day after, 641 yesterday and seems to really explode now.
(In reply to comment #2)
> Interestingly, this had 0 reports total in all Firefox data for a week until it
> started to come up with 202 total crashes on 2011-03-20, 353 the day after, 641
> yesterday and seems to really explode now.

Gah, looked at the wrong report. 0 for more than a week before is correct, then 202 on 2011-03-20 as well, but the day after it was 519 total (353 on 4.0*) and yesterday it was 795 total (again, 641 is the 4.0* number).
{BBDA0591-3099-440a-AA10-41764D9DB4DB} has a 74% correlation in the Firefox 4.0 data. So Norton Toolbar may be involved here. I cannot get 3.6 correlation data at the moment.
I just corresponded with a Twitter user who hit this crash and they have that extension installed. https://crash-stats.mozilla.com/report/index/94a2b7d4-ca19-4a0e-8123-681462110323 is their report.
Highly suspect it's due to Norton's Norton Internet Security (http://www.symantec.com/about/news/release/article.jsp?prid=20091027_04):

"New reputation-based security: Symantec’s new technology codenamed Quorum leverages the wisdom of Norton’s tens of millions of participating customers to derive highly accurate security ratings for virtually every file available on the Internet."

I believe we trip this with a new release and are in contact (today even) to try to mitigate the effects.
Yeah, looks like startup crashes. I bet you could reproduce the crash if you remove certain dlls or exes (maybe one at a time, maybe multiple). It'd be nice to get that person's install directory.
From comments plugin-container.exe might be the one quarantined
Correlations by add-on show that Norton IPS {BBDA0591-3099-440a-AA10-41764D9DB4DB} 2.0 is implicated (83% in 3.6 and 74% in 4.0)
The DWrite correlation is only for 4.0.
It happens only on Windows 7 and not necessarily at start-up.
Component: Graphics → General
QA Contact: thebes → general
Summary: [DWrite] Firefox 4.0 crash [@ RtlpCallQueryRegistryRoutine ] → Crash on Windows 7 [@ RtlpCallQueryRegistryRoutine ] mainly with Norton IPS 2.0 and probably plugin-container.exe quarantined
It is now #3 top crasher over the last 3 days, probably because lots of new users crash at start-up with several attempts.
what's the latest from Norton.  is a fix in place?  what are instructions for users to avoid the problem?

lets link those here for users that follow the navigation path from crash reports they file.

this also looks like a good case for the e-mail auto responder.  about 10% of crash reports on this signature have e-mail addresses
Keywords: user-doc-needed
This crash signature goes away for me if I disable Shockwave Flash 10.2.153.1.  I have filed Bug 645057 for this issue.  However, I will let you folks at Mozilla decide if my bug should be marked as a duplicate or attached to this one as a dependency.
I am also now getting the SAME crash signature when opening PDF files.  Not sure what the issue is here.....
I did not have these problems with the Firefox 4 Final Build on 3/22/11 and am now using the 3/25/11 Nightly build.

An applied patch between 3/22/11 and 3/24/11 must be the problem.
Bug 644264 and 
 --> https://bugzilla.mozilla.org/attachment.cgi?id=522007
just the 4.0 norton comments

has more user comments on norton related feedback seen on input.
Keywords: topcrash
I can easily reproduce this crash (RtlpCallQueryRegistryRoutine) on Windows 7 and parental control enabled. Enabling only firefox.exe without plugin-container.exe results in crash on any website with embeded flash.

My crashId: 70c34549-a738-461c-b09f-8bec82110503
Whiteboard: tmjmnjuuuuuuuzzztgtrrrrrrree
Whiteboard: tmjmnjuuuuuuuzzztgtrrrrrrree
Crash Signature: [@ RtlpCallQueryRegistryRoutine ]
Just another data point - from today's 4.0.1 correlations:

100% (71/71) vs.  24% (31200/131340) sspicli.dll

We're seeing this signature now on Aurora as well. Can't we do anything to not have Norton give us problems there?
Just got this crash on Windows 7 64-bit running the latest trunk (9.0a1), but Norton is not installed on my computer.  Looking at the comments for the report, this signature seems to have been causing a lot of crashes recently, actually a #22 top crasher for the new stable 6.0 build.

https://crash-stats.mozilla.com/report/index/7752d7e5-1283-4625-b964-cf83a2110818
There have been no crashes across all Firefox versions for the last four weeks.
I close it as WFM.
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → WORKSFORME
Depends on: 720655
Crash Signature: [@ RtlpCallQueryRegistryRoutine ] → [@ RtlpCallQueryRegistryRoutine ] [@ RtlpCallQueryRegistryRoutine | BaseThreadInitThunk]
Summary: Crash on Windows 7 [@ RtlpCallQueryRegistryRoutine ] mainly with Norton IPS 2.0 and probably plugin-container.exe quarantined → Crash on Windows 7 @ RtlpCallQueryRegistryRoutine | BaseThreadInitThunk mainly with Norton IPS 2.0 and probably plugin-container.exe quarantined
Looks like Norton finally do its job.
Blocks: Norton
Status: REOPENED → RESOLVED
Closed: 12 years ago9 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.