crash in nsXPTCStubBase::QueryInterface involving RapportTanzan7.dll or RapportTanzan8.DLL in the stack

NEW
Unassigned

Status

External Software Affecting Firefox
Other
P3
critical
7 years ago
9 months ago

People

(Reporter: Robert Kaiser, Unassigned)

Tracking

(Blocks: 1 bug, {crash})

unspecified
crash

Firefox Tracking Flags

(firefox10-, firefox11-)

Details

(Whiteboard: [AV:Trusteer Rapport], crash signature)

Attachments

(1 attachment)

(Reporter)

Description

7 years ago
This bug was filed from the Socorro interface and is 
report bp-03f624e3-7c3e-4c5b-899e-2952e2111104 .
============================================================= 

Top frames:

0 	ntdll.dll 	KiFastSystemCallRet 	
1 	ntdll.dll 	ZwWaitForSingleObject 	
2 	kernel32.dll 	WaitForSingleObjectEx 	
3 	kernel32.dll 	WaitForSingleObject 	
4 	xul.dll 	google_breakpad::ExceptionHandler::WriteMinidumpOnHandlerThread 	toolkit/crashreporter/google-breakpad/src/client/windows/handler/exception_handler.cc:763
5 	xul.dll 	google_breakpad::ExceptionHandler::HandlePureVirtualCall 	toolkit/crashreporter/google-breakpad/src/client/windows/handler/exception_handler.cc:707
6 	mozcrt19.dll 	_purecall 	obj-firefox/memory/jemalloc/crtsrc/purevirt.c:47
7 	xul.dll 	nsXPTCStubBase::QueryInterface 	
8 	RapportTanzan7.dll 	RapportTanzan7.dll@0x3dc3 	
9 	RapportTanzan7.dll 	RapportTanzan7.dll@0x8db0 	
10 	RapportTanzan7.dll 	RapportTanzan7.dll@0xc0d1 	
11 		@0x7121ffff 	
12 	xul.dll 	XPC_WN_CallMethod 	js/src/xpconnect/src/xpcwrappednativejsops.cpp:1592


This signature had a few crash occurrences on 7 before yesterday, but spiked extremely sharply that day, it's up to #8 topcrash or 1393 processed (i.e. ~14000 reported!) crashes or 177 crashes per million ADU in yesterday's data for Firefox 7.

RapportTanzan7.dll is part of Trusteer Rapport - http://www.trusteer.com/product/trusteer-rapport - which is a security suite.

For some reason, I couldn't see correlation reports for this, but looking into some of the reports, it looks like it's version 3.5.1108.52 of this DLL that is involved in the crashes.

We'll probably need to reach out to Trusteer for this.

Comment 2

7 years ago
Another crash from a user: https://crash-stats.mozilla.com/report/index/14b975a3-531a-46e5-b880-e2d0c2111104
It looks like the crashes appear when the add-on WebMail Notifier (2.8 or 2.8.1) https://addons.mozilla.org/en-US/firefox/addon/webmail-notifier/ is installed. Maybe just a false-positive...
RapportTanzan7.DLL is involved too.

Comment 3

7 years ago
I found tis topic http://support.mozilla.com/fr/questions/887181 related to this crash. The culprit could be the program Rapport from from Trusteer Ltd that is aware of the issue. Upgrading to the new program version (Emerald Build 1108.47) of Rapport would seem to resolve the issue: http://www.trusteer.com/webform/download-rapport

I can't confirm because I'm just reporting this issue from another user but maybe it can help.

Updated

7 years ago
Duplicate of this bug: 700064

Comment 5

7 years ago
I read 2 support topics about fixing that bug. Removing software Rapport from Trusteer Ltd has fixed the issue, and FF is able to work again without crash.
Is it useful to note that Trusteer could cause crashes resulting in 
empty strings such as bp-a2061e06-079b-4078-9815-54fc12111104 
(from sumo https://support.mozilla.com/en-US/questions/892644 )

Per posters in the Sumo forum Trusteer is aware of problems eg https://support.mozilla.com/en-US/questions/892720#answer-270676
(Reporter)

Comment 7

7 years ago
This has arrived on 8 now and is the #6 topcrash there in yesterdaay's data - the library is RapportTanzan8.DLL in those stacks.
Summary: crash in nsXPTCStubBase::QueryInterface involving RapportTanzan7.dll in the stack → crash in nsXPTCStubBase::QueryInterface involving RapportTanzan7.dll or RapportTanzan8.DLL in the stack

Comment 8

7 years ago
Kev: I'm not sure that just because trusteer is telling users that "we're aware of the problem" that they are aware of how many users are being affected or know exactly what's going on.  Is there a way we can reach out?

Comment 9

7 years ago
(In reply to [:Cww] from comment #8)
> Is there a way we can reach out?

Yes, here: http://www.trusteer.com/support/submit-ticket
I am also seeing crashes in the explosive report related to https://crash-stats.mozilla.com/report/list?signature=nsBaseAppShell%3A%3AOnProcessNextEvent%28nsIThreadInternal*%2C%20int%2C%20unsigned%20int%29.

Correlations for that one show a different version of RapportTanzan:

126% (199/158) vs.  19% (8275/43766) msvcr80.dll
98% (155/158) vs.   3% (1273/43766) riched20.dll
98% (155/158) vs.   3% (1300/43766) atl80.dll
98% (155/158) vs.   3% (1327/43766) RapportUtil.dll
98% (155/158) vs.   3% (1328/43766) rooksdol.dll
98% (155/158) vs.   3% (1328/43766) rookscom.dll
98% (155/158) vs.   3% (1345/43766) rooksbas.dll
98% (155/158) vs.   7% (2946/43766) msvcp80.dll
99% (156/158) vs.  12% (5414/43766) GdiPlus.dll
83% (131/158) vs.   2% (728/43766) RapportTanzan8.DLL
(Reporter)

Updated

7 years ago
Crash Signature: [@ _purecall | nsXPTCStubBase::QueryInterface(nsID const&, void**)] → [@ _purecall | nsXPTCStubBase::QueryInterface(nsID const&, void**)] [@ nsBaseAppShell::OnProcessNextEvent(nsIThreadInternal*, int, unsigned int)]
Adding other related signatures. In the last week this signature has 19302 crashes across all versions.
Crash Signature: [@ _purecall | nsXPTCStubBase::QueryInterface(nsID const&, void**)] [@ nsBaseAppShell::OnProcessNextEvent(nsIThreadInternal*, int, unsigned int)] → [@ _purecall | nsXPTCStubBase::QueryInterface(nsID const&, void**)] [@ nsBaseAppShell::OnProcessNextEvent(nsIThreadInternal*, int, unsigned int)] [@ nsXPTCStubBase::QueryInterface(nsID const&, void**) ] [@ nsXPTCStubBase::QueryInterface ]

Comment 12

7 years ago
It seems to be fixed in Trusteer Rapport 3.5.1108.55:
* _purecall | nsXPTCStubBase::QueryInterface(nsID const&, void**):
    53% (210/394) vs.   1% (709/95929) RapportTanzan8.DLL
         52% (203/394) vs.   1% (576/95929) 3.5.1108.52
          2% (7/394) vs.   0% (16/95929) 3.5.1108.53
          0% (0/394) vs.   0% (54/95929) 3.5.1108.54
          0% (0/394) vs.   0% (63/95929) 3.5.1108.55
     46% (182/394) vs.   1% (588/95929) RapportTanzan8.dll
         43% (168/394) vs.   0% (432/95929) 3.5.1108.52
          4% (14/394) vs.   0% (21/95929) 3.5.1108.53
          0% (0/394) vs.   0% (44/95929) 3.5.1108.54
          0% (0/394) vs.   0% (91/95929) 3.5.1108.55
* nsBaseAppShell::OnProcessNextEvent(nsIThreadInternal*, int, unsigned int):
     28% (13/47) vs.   1% (709/95929) RapportTanzan8.DLL
         23% (11/47) vs.   1% (576/95929) 3.5.1108.52
          0% (0/47) vs.   0% (16/95929) 3.5.1108.53
          4% (2/47) vs.   0% (54/95929) 3.5.1108.54
          0% (0/47) vs.   0% (63/95929) 3.5.1108.55
     57% (27/47) vs.   1% (588/95929) RapportTanzan8.dll
         51% (24/47) vs.   0% (432/95929) 3.5.1108.52
          0% (0/47) vs.   0% (21/95929) 3.5.1108.53
          6% (3/47) vs.   0% (44/95929) 3.5.1108.54
          0% (0/47) vs.   0% (91/95929) 3.5.1108.55
Whiteboard: [fixed in Trusteer Rapport 3.5.1108.55]

Comment 13

7 years ago
Created attachment 573809 [details]
Trusteer RapportSetup.exe 3.5.1105.45 (2011:07:07)

I joined an old version of Trusteer Rapport for Windows OS, v3.5.1105.45 from July 2011, if someone wants to reproduce the crashes of Firefox.

Comment 14

7 years ago
Trusteer appears to be based in Israel, and voicemail has been left at the general inquiries desk asking for a product or engineering contact to call. Further, a trouble ticket has been opened (PDX-110348) asking for a product contact to get in touch with us ASAP, and informing them that the crash is a potential blocklist candidate.
Bug 691847#c21 has the version I tested in the lab. Version 1108.55 seems to not cause a crash in my testing. So if we block versions below that I assume that would be okay. The issue is we have to correlate that to the proper dll. The dlls that we saw associated with these crashes were RapportTanzan7.dll and RapportTanzan8.DLL. In the bin directory there are a quite a few versions of the dll up to 36.

Updated

7 years ago
Crash Signature: [@ _purecall | nsXPTCStubBase::QueryInterface(nsID const&, void**)] [@ nsBaseAppShell::OnProcessNextEvent(nsIThreadInternal*, int, unsigned int)] [@ nsXPTCStubBase::QueryInterface(nsID const&, void**) ] [@ nsXPTCStubBase::QueryInterface ] → [@ _purecall | nsXPTCStubBase::QueryInterface(nsID const&, void**)] [@ nsBaseAppShell::OnProcessNextEvent(nsIThreadInternal*, int, unsigned int)] [@ nsXPTCStubBase::QueryInterface(nsID const& void**) ] [@ nsXPTCStubBase::QueryInterface ] [@ RapportTan…
Component: General → Extension Compatibility
OS: Windows 7 → All
QA Contact: general → extension.compatibility
Hardware: x86 → All

Updated

7 years ago
tracking-firefox10: --- → +
tracking-firefox11: --- → +

Updated

7 years ago
tracking-firefox10: + → -
tracking-firefox11: + → -

Updated

3 years ago
Crash Signature: [@ _purecall | nsXPTCStubBase::QueryInterface(nsID const&, void**)] [@ nsBaseAppShell::OnProcessNextEvent(nsIThreadInternal*, int, unsigned int)] [@ nsXPTCStubBase::QueryInterface(nsID const&, void**) ] [@ nsXPTCStubBase::QueryInterface ] [@ RapportTa… → [@ _purecall | nsXPTCStubBase::QueryInterface(nsID const&, void**)] [@ nsBaseAppShell::OnProcessNextEvent(nsIThreadInternal*, int, unsigned int)] [@ nsXPTCStubBase::QueryInterface(nsID const&, void**) ] [@ nsXPTCStubBase::QueryInterface ] [@ RapportTa…
Blocks: 1320970

Updated

9 months ago
Priority: -- → P3
Whiteboard: [fixed in Trusteer Rapport 3.5.1108.55] → [AV:Trusteer Rapport]
Component: Extension Compatibility → Other
Product: Firefox → External Software Affecting Firefox
You need to log in before you can comment on or make changes to this bug.