644125 - Crash on Windows 7 @ RtlpCallQueryRegistryRoutine | BaseThreadInitThunk mainly with Norton IPS 2.0 and probably plugin-container.exe quarantined

Status: RESOLVED WORKSFORME

(Core :: General, defect)

Description

[Scoobidiver (away)]

It is a residual crash signature that exists in 3.6 and 4.0.
Crashes in 4.0 are correlated to DWrite (well distributed across versions), even it is not enabled.
Comments talk about plugins.
It is #34 top crasher over the last 3 days.

Signature	RtlpCallQueryRegistryRoutine
UUID	8901377b-b649-4e60-a850-da97b2110323
Time 	2011-03-23 01:37:51.76280
Uptime	1
Last Crash	385 seconds (6.4 minutes) before submission
Install Age	163933 seconds (1.9 days) since version was first installed.
Product	Firefox
Version	4.0
Build ID	20110318052756
Branch	2.0
OS	Windows NT
OS Version	6.1.7600
CPU	x86
CPU Info	GenuineIntel family 6 model 37 stepping 5
Crash Reason	0xc000070a / 0x00000000
Crash Address	0x77d9c7bd
App Notes 	AdapterVendorID: 8086, AdapterDeviceID: 0046, AdapterDriverVersion: 8.15.10.2202
D2D? D2D+
DWrite? DWrite+
D3D10 Layers? D3D10 Layers+

Frame 	Module 	Signature [Expand] 	Source
0 	ntdll.dll 	RtlpCallQueryRegistryRoutine 	
1 	kernel32.dll 	BaseThreadInitThunk 	
2 	ntdll.dll 	__RtlUserThreadStart 	
3 	ntdll.dll 	_RtlUserThreadStart 	

More reports at:
https://crash-stats.mozilla.com/report/list?range_value=2&range_unit=weeks&signature=RtlpCallQueryRegistryRoutine

4.0 correlations by module give:
100% (603/605) vs.  36% (61971/173285) DWrite.dll
 41% (248/605) vs.  13% (23294/173285) d2d1.dll
 41% (248/605) vs.  13% (23175/173285) d3d10.dll

Comment 1

[Marcia Knous [:marcia]]

This is the currently the top crash on 3.6.16 with over 12K in crashes. I looked back and in 3.6.15 it was ranked #242.

Comment 2

[Robert Kaiser]

Interestingly, this had 0 reports total in all Firefox data for a week until it started to come up with 202 total crashes on 2011-03-20, 353 the day after, 641 yesterday and seems to really explode now.

Comment 3

[Robert Kaiser]

(In reply to comment #2)
> Interestingly, this had 0 reports total in all Firefox data for a week until it
> started to come up with 202 total crashes on 2011-03-20, 353 the day after, 641
> yesterday and seems to really explode now.

Gah, looked at the wrong report. 0 for more than a week before is correct, then 202 on 2011-03-20 as well, but the day after it was 519 total (353 on 4.0*) and yesterday it was 795 total (again, 641 is the 4.0* number).

Comment 4

[Marcia Knous [:marcia]]

{BBDA0591-3099-440a-AA10-41764D9DB4DB} has a 74% correlation in the Firefox 4.0 data. So Norton Toolbar may be involved here. I cannot get 3.6 correlation data at the moment.

Comment 5

[Marcia Knous [:marcia]]

I just corresponded with a Twitter user who hit this crash and they have that extension installed. https://crash-stats.mozilla.com/report/index/94a2b7d4-ca19-4a0e-8123-681462110323 is their report.

Comment 6

[LegNeato]

Highly suspect it's due to Norton's Norton Internet Security (http://www.symantec.com/about/news/release/article.jsp?prid=20091027_04):

"New reputation-based security: Symantec’s new technology codenamed Quorum leverages the wisdom of Norton’s tens of millions of participating customers to derive highly accurate security ratings for virtually every file available on the Internet."

I believe we trip this with a new release and are in contact (today even) to try to mitigate the effects.

Comment 7

[LegNeato]

Yeah, looks like startup crashes. I bet you could reproduce the crash if you remove certain dlls or exes (maybe one at a time, maybe multiple). It'd be nice to get that person's install directory.

Comment 8

[LegNeato]

From comments plugin-container.exe might be the one quarantined

Comment 9

[Scoobidiver (away)]

Correlations by add-on show that Norton IPS {BBDA0591-3099-440a-AA10-41764D9DB4DB} 2.0 is implicated (83% in 3.6 and 74% in 4.0)
The DWrite correlation is only for 4.0.
It happens only on Windows 7 and not necessarily at start-up.

Comment 10

[Scoobidiver (away)]

It is now #3 top crasher over the last 3 days, probably because lots of new users crash at start-up with several attempts.

Comment 11

[chris hofmann]

what's the latest from Norton.  is a fix in place?  what are instructions for users to avoid the problem?

lets link those here for users that follow the navigation path from crash reports they file.

this also looks like a good case for the e-mail auto responder.  about 10% of crash reports on this signature have e-mail addresses

Comment 12

[Chris B.]

This crash signature goes away for me if I disable Shockwave Flash 10.2.153.1.  I have filed Bug 645057 for this issue.  However, I will let you folks at Mozilla decide if my bug should be marked as a duplicate or attached to this one as a dependency.

Comment 13

[Chris B.]

I am also now getting the SAME crash signature when opening PDF files.  Not sure what the issue is here.....

Comment 14

[Chris B.]

I did not have these problems with the Firefox 4 Final Build on 3/22/11 and am now using the 3/25/11 Nightly build.

An applied patch between 3/22/11 and 3/24/11 must be the problem.

Comment 15

[chris hofmann]

Bug 644264 and 
 --> https://bugzilla.mozilla.org/attachment.cgi?id=522007
just the 4.0 norton comments

has more user comments on norton related feedback seen on input.

Comment 18

[Pavel Franc - Mozilla.cz]

I can easily reproduce this crash (RtlpCallQueryRegistryRoutine) on Windows 7 and parental control enabled. Enabling only firefox.exe without plugin-container.exe results in crash on any website with embeded flash.

My crashId: 70c34549-a738-461c-b09f-8bec82110503

Comment 21

[Robert Kaiser]

Just another data point - from today's 4.0.1 correlations:

100% (71/71) vs.  24% (31200/131340) sspicli.dll

We're seeing this signature now on Aurora as well. Can't we do anything to not have Norton give us problems there?

Comment 22

[Logan Rosen [:Logan]]

Just got this crash on Windows 7 64-bit running the latest trunk (9.0a1), but Norton is not installed on my computer.  Looking at the comments for the report, this signature seems to have been causing a lot of crashes recently, actually a #22 top crasher for the new stable 6.0 build.

https://crash-stats.mozilla.com/report/index/7752d7e5-1283-4625-b964-cf83a2110818

Comment 23

[Scoobidiver (away)]

There have been no crashes across all Firefox versions for the last four weeks.
I close it as WFM.

Comment 24

[Scoobidiver (away)]

Wrong bug.
There are still crashes:
https://crash-stats.mozilla.com/report/list?product=Firefox&query_search=signature&query_type=contains&query=RtlpCallQueryRegistryRoutine&reason_type=contains&date=12%2F10%2F2011&range_value=4&range_unit=weeks&hang_type=any&process_type=any&do_query=1&signature=RtlpCallQueryRegistryRoutine

Comment 25

[Virtual_ManPL [:Virtual] 🇵🇱 - (please needinfo? me - so I will see your comment/reply/question/etc.)]

Looks like Norton finally do its job.