802825 - crash in nsFilePicker::ShowFilePicker / BaseThreadInitThunk working with attachments [windows vista]

Status: RESOLVED INVALID

(MailNews Core :: Attachments, defect)

Description

[Wayne Mery (:wsmwk)]

This bug was filed from the Socorro interface and is 
report bp-5cfe489b-efe7-4af2-8fca-cda3c2121001 which mentions a common symptom "Trying to open directory to attach a file"

all vista

big upsurge in TB15 and TB16 - about 200x prior crash rate. I have not determined whether upsurge started exactly on TB15 release date - perhaps we got tweaked on a later date with a windows update or other software.

got missed probably because there is a longstanding firefox crash bug 601587 - but do not dup this to that bug.

39|0|||||0x746274b2 39|1|kernel32.dll|BaseThreadInitThunk|||0x11 39|2|ntdll.dll|__RtlUserThreadStart|||0x26 39|3|ntdll.dll|_RtlUserThreadStart|||0x1a 0|0|ntdll.dll|KiFastSystemCallRet|||0x0 0|1|ntdll.dll|ZwDelayExecution|||0xb 0|2|kernel32.dll|SleepEx|||0x51 0|3|kernel32.dll|Sleep|||0xe 0|4|duser.dll|MphProcessMessage(tagMSG *,HWND__ *,unsigned int,unsigned int,unsigned int,int)|||0x42 0|5|duser.dll|MphProcessMessage(tagMSG *,HWND__ *,unsigned int,unsigned int,unsigned int,int)|||0x32 0|6|user32.dll|__ClientGetMessageMPH|||0x2f 0|7|ntdll.dll|KiUserCallbackDispatcher|||0x2d 0|8|ntdll.dll|KiUserApcDispatcher|||0x47 0|9|user32.dll|PeekMessageW|||0xf2 0|10|user32.dll|DialogBox2|||0x94 0|11|user32.dll|InternalDialogBox|||0xb5 0|12|user32.dll|DialogBoxIndirectParamAorW|||0x35 0|13|user32.dll|DialogBoxIndirectParamW|||0x1a 0|14|comdlg32.dll|CFileOpenSave::Show(HWND__ *)|||0xd3 0|15|xul.dll|nsFilePicker::ShowFilePicker(nsString const &)|hg:hg.mozilla.org/releases/mozilla-release:widget/windows/nsFilePicker.cpp:a347058c607a|942|0x9 0|16|xul.dll|nsFilePicker::ShowW(short *)|hg:hg.mozilla.org/releases/mozilla-release:widget/windows/nsFilePicker.cpp:a347058c607a|1028|0xc 0|17|xul.dll|nsIHTMLContentSink::CloseMalformedContainer(nsHTMLTag)|hg:hg.mozilla.org/releases/mozilla-release:widget/windows/nsFilePicker.cpp:a347058c607a|1058|0xd 0|18|xul.dll|NS_InvokeByIndex_P|hg:hg.mozilla.org/releases/mozilla-release:xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:a347058c607a|70|0x2 0|19|xul.dll|XPCWrappedNative::CallMethod(XPCCallContext &,XPCWrappedNative::CallMode)|hg:hg.mozilla.org/releases/mozilla-release:js/xpconnect/src/XPCWrappedNative.cpp:a347058c607a|2442|0x7e8

Comment 1

[Wayne Mery (:wsmwk)]

archaeopteryx has someone reporting this in a forum

Comment 2

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

The crash numbers start to rise on 2012-09-20 (Thursday) and grows especially on 2012-09-24 (Monday) and reaches its level on 2012-09-25 (Tuesday). The Microsoft fix for http://technet.microsoft.com/en-us/security/bulletin/ms12-063 should be investigated. A hotfix for the issue had been released on 2012-09-19 and the update on late Friday or Saturday.

Comment 3

[Wayne Mery (:wsmwk)]

other sigs
[@ RtlpTpInitializeData | RtlpTpTimerCallback | BaseThreadInitThunk ]  bp-23a3ba94-22ef-4442-bebe-95fdd2121004
[@ RtlQueryRegistryValues | BaseThreadInitThunk ] bp-138d70de-ad94-4b83-bef6-26a6e2120927

all have powrprof.dll in the module list, which is cited in bug 601587 comment 7

Some others to consider (I didn't check their release dates)
kb915597
kb2744842
kb890830
kb2736233

FWIW, TB15.0.1 released on September 10 

And lastly, @ BaseThreadStart  is a smaller crash that may also have increased in the time period, but stack is different, as is the OS. For example bp-6656c443-811d-4665-beb0-dba832121008 where user reports viewing photo ("bei betrachten von Fotos")

Comment 4

[Wayne Mery (:wsmwk)]

#3 crash for TB17 and #6 crash for TB16

I was installing thunderbrowse addon, but none of the file menus was open (I was past that point). Using TB18.0a1 2012-09-19 on vista (yes, it's a month old, but I'm stuck there). bp-febd33c5-2716-4445-a4b5-353692121103

plenty of user comments https://crash-stats.mozilla.com/report/list?product=Thunderbird&query_search=signature&query_type=exact&query=BaseThreadInitThunk&reason_type=contains&date=11%2F03%2F2012%2013%3A44%3A25&range_value=4&range_unit=weeks&hang_type=any&process_type=all&do_query=1&admin=1&signature=BaseThreadInitThunk

What's the deal? Do we need to contact Microsoft?

Comment 5

[Makoto Kato [:m_kato]]

(In reply to Wayne Mery (:wsmwk) from comment #4)
> #3 crash for TB17 and #6 crash for TB16
> 
> I was installing thunderbrowse addon, but none of the file menus was open (I
> was past that point). Using TB18.0a1 2012-09-19 on vista (yes, it's a month
> old, but I'm stuck there). bp-febd33c5-2716-4445-a4b5-353692121103
> 
> plenty of user comments
> https://crash-stats.mozilla.com/report/
> list?product=Thunderbird&query_search=signature&query_type=exact&query=BaseTh
> readInitThunk&reason_type=contains&date=11%2F03%2F2012%2013%3A44%3A25&range_v
> alue=4&range_unit=weeks&hang_type=any&process_type=all&do_query=1&admin=1&sig
> nature=BaseThreadInitThunk
> 
> What's the deal? Do we need to contact Microsoft?

Maybe, a DLL that has message loop is unloaded without unregister.

Comment 6

[Makoto Kato [:m_kato]]

ah, please ignore previous comment.

This won't be OS bugs.  This crash depends on user environment (installed application).  This crash occurs during creating thread.  0x749174b2 was thread proc (maybe DLL is unloaded? or any thread creates via invalid address.

To clear root cause, we need reproduce step.

Comment 7

[Vincent (caméléon)]

Note that this other crash report seems related, but I don't know why it is not linked to this bug report... Can someone have a look?
https://crash-stats.mozilla.com/report/index/bp-6d1b418f-4ab0-4273-8e2d-491da2121109

Comment 8

[Tyler Downer [He/Him]]

I have a user with this crash in Firefox at https://support.mozilla.org/en-US/questions/943025 if we want to follow up with them. I can drive that if needed.

Comment 9

[Wayne Mery (:wsmwk)]

(In reply to Tyler Downer [:Tyler] from comment #8)
> I have a user with this crash in Firefox at
> https://support.mozilla.org/en-US/questions/943025 if we want to follow up
> with them. I can drive that if needed.

that would be helpful

Comment 10

[Tyler Downer [He/Him]]

The user had these plugins:  




    The QuickTime Plugin allows you to view a wide variety of multimedia content in Web pages. For more information, visit the QuickTime Web site.
    Shockwave Flash 11.5 r502
    Next Generation Java Plug-in 10.9.2 for Mozilla browsers
    NPRuntime Script Plug-in Library for Java(TM) Deploy
    Google Update
    iTunes Detector Plug-in
    Adobe PDF Plug-In For Firefox and Netscape "9.5.2"
    Adobe PDF Plug-In For Firefox and Netscape 10.1.4
    4.1.10329.0
    Picasa plugin
    CouponNetwork Coupon Activator
    IE Tab plugin
    GEPlugin
    Google Updater pluginhttp://pack.google.com/
    NPWLPG
    Office Live Update v1.5
    Coupons, Inc. Coupon Printer Plugin
    Coupons, Inc. Coupon Printer DLL
    Adobe Shockwave for Director Netscape plug-in, version 11.5
    Windows Presentation Foundation (WPF) plug-in for Mozilla browsers
    np-mswmp 



After updating Adobe, they were no longer experiencing this crash. I wonder if this is caused by an older Reader version?

Comment 11

[Wayne Mery (:wsmwk)]

user who reproduces on mozillazine http://forums.mozillazine.org/viewtopic.php?p=12663647#p12663647 ... bp-0a5f78bf-f8f6-4c4a-80f0-e9f0b2130213

Comment 12

[Andrew Truong [:feer56] [:andrewtruong] [:atruong]]

Reported in thread:
https://support.mozilla.org/en-US/questions/952979#answer-415949

Reports:
https://crash-stats.mozilla.com/report/index/bp-f13d802e-81d7-48fb-b101-ecdd22130310
https://crash-stats.mozilla.com/report/index/bp-e7a15878-5bf8-4bd6-9d08-61a8d2130309
https://crash-stats.mozilla.com/report/index/bp-f2671c35-3e3d-4ef7-8251-7debe2130309
https://crash-stats.mozilla.com/report/index/bp-dd5da95b-7ab1-47cb-9ad5-d3c3d2130309
https://crash-stats.mozilla.com/report/index/bp-0d40eac3-8740-4efc-ad53-836972130309

Comment 13

[Wayne Mery (:wsmwk)]

(In reply to Feer56 (Andrew T.) from comment #12)
> Reported in thread:
> https://support.mozilla.org/en-US/questions/952979#answer-415949
"firefox crashes when trying to attach a file to gmail compose"

Comment 14

[Federico]

See also bug 879373 which I saw linked from one of my (Firefox) crash reports. Other examples:
https://crash-stats.mozilla.com/report/index/5b646de5-5aa9-4668-bf0a-2f9352130712
https://crash-stats.mozilla.com/report/index/4a4699da-3716-4082-bb33-48fc52130608

Comment 15

[Wayne Mery (:wsmwk)]

(In reply to Makoto Kato (:m_kato) from comment #6)
> This won't be OS bugs.  This crash depends on user environment (installed
> application).  This crash occurs during creating thread.  0x749174b2 was
> thread proc (maybe DLL is unloaded? or any thread creates via invalid
> address.
> 
> To clear root cause, we need reproduce step.

User in bp-d495f0f9-d483-4dcf-b300-1d7672130719 writes "I was saving a mailed .pdf file. When I selected a different folder from the default, once in the folder, I changed the view to "details". When the details didn't fit into the default sized window, I grabbed the right side of the window frame and pulled it to the right to make it wider. That's when Thunderbird crashed."

Comment 16

[Wayne Mery (:wsmwk)]

notable point - this is a #7 topcrash for betas. It's somewhat unusual for release topcrash to also be a topcrash in beta/development.

Comment 17

[Makoto Kato [:m_kato]]

I think This depends on shell extension and/or anti-virus software.   Any DLL (that loaded into 0x6dxxxxxx) was unloaded, so this crash occurs.   No way to get unloaded DLL information from dump file.

This crash depends user environment (installed software and setting of that software/OS), and reproduce step isn't important.

Comment 18

[danivtec]

Been getting similiar crashes since 17.0.4 through to 17.0.7. Happens at least a couple of times a day.

Example of a crash is here https://crash-stats.mozilla.com/report/index/cd42e43f-9224-4b91-ab44-8255b2130724

I have reverted to TB 14 and not had a crash yet.

Comment 19

[danivtec]

Spoke too soon, got a crash moments ago.

https://crash-stats.mozilla.com/report/index/8d71e912-498f-42a4-85b6-b49be2130731

Comment 20

[Federico]

I've not had this problem in Firefox, Thunderbird or Chromium (CHromium just stalled, not crashed) for a couple days or perhaps more, as if an underlying OS problem had been fixed.
Now at Thunderbird 17.0.8, Linux e350 3.10.12-100.fc18.i686.PAE #1 SMP Mon Sep 16 13:16:09 UTC 2013 i686 i686 i386 GNU/Linux

Comment 21

[Wayne Mery (:wsmwk)]

Because this often happens during sending, there is essentially dataloss of what was in the compose window and hadn't been saved to drafts

Comment 22

[Wayne Mery (:wsmwk)]

I crashed 54c6442e-42dd-4ec7-90f6-6026b2131111

Some users report crashing when opening the attachment from within compose.
Some have been helped by updating adobe reader.

Ted wrote basically the same as comment 5, , "it looks like something spawned a thread but then unloaded the DLL before it got to run, or something like that."

Comment 23

[Wayne Mery (:wsmwk)]

#50 for TB31.4.0, so no longer topcrash

Comment 24

[Wayne Mery (:wsmwk)]

(In reply to Makoto Kato (:m_kato) from comment #17)
> I think This depends on shell extension and/or anti-virus software.   Any
> DLL (that loaded into 0x6dxxxxxx) was unloaded, so this crash occurs.   No
> way to get unloaded DLL information from dump file.
> 
> This crash depends user environment (installed software and setting of that
> software/OS), and reproduce step isn't important.

Antivirus connection strengthened by https://crash-analysis.mozilla.com/crash_analysis/20150405/20150405_Thunderbird_31.6.0-interesting-modules.txt

 BaseThreadInitThunk|EXCEPTION_ACCESS_VIOLATION_EXEC (23 crashes)
     74% (17/23) vs.   1% (17/3134) csf.dll        EAST Technologies/East-Tec CryptSecure 2006
     65% (15/23) vs.   1% (23/3134) PATROLPRO.DLL  BillP Studios' WinPatrol
     65% (15/23) vs.   7% (233/3134) avghookx.dll  AVG

Comment 25

[Wayne Mery (:wsmwk)]

Only a few crashes https://crash-stats.mozilla.org/signature/?signature=BaseThreadInitThunk

But closing based on previous comments