839040 - startup crash in LdrLoadDll with McAfee Hipscore 14.1 (Host Intrusion Prevention)

Status: RESOLVED WORKSFORME

(Firefox :: General, defect)

Description

[Scoobidiver (away)]

It's #2 top browser crasher in 17.0.2esr.
It occurs with McAfee Hipscore.

Signature 	LdrLoadDll More Reports Search
UUID	4c9e2898-649e-4324-be59-3648a2130203
Date Processed	2013-02-03 04:57:38
Uptime	6
Install Age	3.2 weeks since version was first installed.
Install Time	2013-01-11 12:44:05
Product	Firefox
Version	17.0.2esr
Build ID	20130107124423
Release Channel	esr
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
Build Architecture	x86
Build Architecture Info	GenuineIntel family 6 model 23 stepping 10
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0xfffffffff745753c
Processor Notes 	sp-processor04.phx1.mozilla.com_30666:2008; WARNING: JSON file missing Add-ons
EMCheckCompatibility	False
Total Virtual Memory	4294836224
Available Virtual Memory	4159090688
System Memory Use Percentage	66
Available Page File	1460867072
Available Physical Memory	653037568

Frame 	Module 	Signature 	Source
0 	ntdll.dll 	LdrLoadDll 	
1 	KERNELBASE.dll 	BemFreeContract

HIPQA.dll 	14.1.0.437 	F63BF92B1B2A427FAD389BB7E1F5FED61 	HIPQA.pdb
HIPIS0e011b5.dll 	14.1.0.437 	DD523ED0252243C098B9EDA788F007171 	HIPIS.pdb
HIPI.dll 	14.1.0.437 	DCECDEE0962A41A9A1DCBCBAE73018B51 	HIPI.pdb

More reports at:
https://crash-stats.mozilla.com/report/list?signature=LdrLoadDll

Comment 1

[Jorge Villalobos [:jorgev] (he/him)]

I just sent a message to my McAfee contacts about this.

Comment 2

[Scoobidiver (away)]

There's a more explicit stack trace:
Frame 	Module 	Signature 	Source
0 	ntdll.dll 	RtlInitUnicodeStringEx 	
1 	ntdll.dll 	LdrLoadDll 	
2 	ntdll.dll 	RtlpGetLFHContext 	
3 	setupapi.dll 	_imp_load__GetExplicitEntriesFromAclW 	
4 	KERNELBASE.dll 	BemFreeContract 	
5 	KERNELBASE.dll 	BaseBeginReadingCache 	
6 	KERNELBASE.dll 	BemFreeContract 	
7 	ntdll.dll 	RtlpGetLFHContext 	
8 	KERNELBASE.dll 	BasepGetCachedPath 	
9 	ntdll.dll 	RtlpGetLFHContext 	
10 	KERNELBASE.dll 	BaseGetProcessDllPath 	
11 	KERNELBASE.dll 	BemFreeContract 	
12 	KERNELBASE.dll 	BasepComputeProcessExePath 	
13 	KERNELBASE.dll 	LoadLibraryExW 	
14 	nspr4.dll 	pr_LoadLibraryByPathname 	nsprpub/pr/src/linking/prlink.c:726
15 	nspr4.dll 	PR_LoadLibraryWithFlags 	nsprpub/pr/src/linking/prlink.c:427
16 	xul.dll 	nsLocalFile::Load 	xpcom/io/nsLocalFileWin.cpp:2168
17 	xul.dll 	nsNativeModuleLoader::LoadModule 	xpcom/components/nsNativeComponentLoader.cpp:141
18 	xul.dll 	nsComponentManagerImpl::ManifestBinaryComponent 	xpcom/components/nsComponentManager.cpp:534
19 	xul.dll 	ParseManifest 	xpcom/components/ManifestParser.cpp:646
20 	xul.dll 	nsComponentManagerImpl::RegisterManifest 	xpcom/components/nsComponentManager.cpp:497
21 	xul.dll 	nsComponentManagerImpl::ManifestManifest 	xpcom/components/nsComponentManager.cpp:510
22 	xul.dll 	ParseManifest 	xpcom/components/ManifestParser.cpp:646
23 	xul.dll 	nsComponentManagerImpl::RegisterManifest 	xpcom/components/nsComponentManager.cpp:497
24 	xul.dll 	nsComponentManagerImpl::RereadChromeManifests 	xpcom/components/nsComponentManager.cpp:665
25 	xul.dll 	nsComponentManagerImpl::Init 	xpcom/components/nsComponentManager.cpp:365
26 	xul.dll 	NS_InitXPCOM2_P 	xpcom/build/nsXPComInit.cpp:466
27 	xul.dll 	ScopedXPCOMStartup::Initialize 	toolkit/xre/nsAppRunner.cpp:1174
28 	xul.dll 	XREMain::XRE_main 	toolkit/xre/nsAppRunner.cpp:3884
29 	xul.dll 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3965
30 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:100
31 	firefox.exe 	__tmainCRTStartup 	crtexe.c:552
32 	kernel32.dll 	BaseThreadInitThunk 	
33 	ntdll.dll 	__RtlUserThreadStart 	
34 	ntdll.dll 	_RtlUserThreadStart 	

More reports at:
https://crash-stats.mozilla.com/report/list?signature=RtlInitUnicodeStringEx+|+LdrLoadDll

Comment 3

[Scoobidiver (away)]

It's #3 top browser crasher in 17.0.6esr which is high for a startup crash.

Comment 4

[Wayne Mery (:wsmwk)]

are these users loading firefox during windows startup?
https://community.mcafee.com/thread/57936

Also happens for Thunderbird users.
eg bp-f0f33063-9d95-4010-bd16-2fa092130703

Comment 5

[Wayne Mery (:wsmwk)]

Both crashes have only a couple crashes per version - much changed from having been a topcrash - and there is not testcase, so either the issue is gone or morphed

https://crash-stats.mozilla.com/signature/?signature=LdrLoadDll&date=%3E%3D2018-07-13T15%3A54%3A22.000Z&date=%3C2018-10-13T15%3A54%3A22.000Z&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&_columns=install_time&_sort=-build_id&_sort=version&_sort=-product&_sort=-date&page=1

https://crash-stats.mozilla.com/signature/?signature=RtlInitUnicodeStringEx%20%7C%20LdrLoadDll&date=%3E%3D2018-07-13T15%3A54%3A43.000Z&date=%3C2018-10-13T15%3A54%3A43.000Z&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&_columns=install_time&_sort=-date&page=1#reports