863309 - [WinXP] crash in RtlpWaitForCriticalSection | RtlEnterCriticalSection | CDrives_CreateInstance with Baidu Antivirus and BrowserProtect for Thai users

Status: RESOLVED WONTFIX

(Toolkit :: Startup and Profile System, defect)

Description

[Tracy Walker [:tracy]]

This bug was filed from the Socorro interface and is 
report bp-db23cd7c-39e6-49ac-8983-aec832130418 .
============================================================= 
This start up crash rising fast on 20 and 21. It's 100% on Windows XP

0 	ntdll.dll 	RtlpWaitForCriticalSection 	
1 	ntdll.dll 	RtlEnterCriticalSection 	
2 	shell32.dll 	CDrives_CreateInstance 	
3 	shell32.dll 	CCF_CreateInstance 	
4 	shell32.dll 	_CreateFromDllGetClassObject 	
5 	shell32.dll 	_CreateFromShell 	
6 	shell32.dll 	_SHCoCreateInstance 	
7 	shell32.dll 	SHExtCoCreateInstance2 	
8 	shell32.dll 	SHExtCoCreateInstance 	
9 	shell32.dll 	[thunk]:CPL::CCplCategory::Release`adjustor{8}' 	
10 	shell32.dll 	CDesktop_CreateInstance 	
11 	shell32.dll 	CRegFolder::BindToObject 	
12 	shell32.dll 	SHBindToObjectEx 	
13 	shell32.dll 	SHBindToObject 	
14 	shell32.dll 	CDesktopFolder::_GetFolderForParsing 	
15 	shell32.dll 	CDesktopFolder::ParseDisplayName 	
16 	shell32.dll 	CRegFolder::ParseDisplayName 	
17 	shell32.dll 	SHParseDisplayName 	
18 	shell32.dll 	ILCreateFromPathEx 	
19 	shell32.dll 	GetFolderInt 	
20 	shell32.dll 	ILFindChild 	
21 	shell32.dll 	SHGetFolderLocation 	
22 	shell32.dll 	SHGetSpecialFolderLocation 	
23 	xul.dll 	GetShellFolderPath 	toolkit/xre/nsXREDirProvider.cpp:911
24 	xul.dll 	nsXREDirProvider::GetUserDataDirectoryHome 	toolkit/xre/nsXREDirProvider.cpp:1137
25 	xul.dll 	nsXREDirProvider::GetUserDataDirectory 	toolkit/xre/nsXREDirProvider.cpp:1261
26 	xul.dll 	nsXREDirProvider::GetUserAppDataDirectory 	toolkit/xre/nsXREDirProvider.h:60
27 	xul.dll 	XREMain::XRE_mainInit 	toolkit/xre/nsAppRunner.cpp:3035
28 	xul.dll 	XREMain::XRE_main 	toolkit/xre/nsAppRunner.cpp:3870
29 	xul.dll 	XRE_main 	toolkit/xre/nsAppRunner.cpp:4084
30 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:105
31 	firefox.exe 	__tmainCRTStartup 	crtexe.c:552
32 	kernel32.dll 	BaseProcessStart

Comment 1

[Robert Kaiser]

This started to rise on 2013-04-16 and jumped on 2013-04-17 to #61 on 20.* and #29 on 21.* in overall data.

Comment 2

[Tracy Walker [:tracy]]

A majority of the submitted comments are in Thai, but not exclusively.  No URLs or correlations.

Comment 3

[Scoobidiver (away)]

Almost every comments are in Thai.

Correlations are broken but almost every crash reports I've checked contain Bit89's BrowserProtect.dll known as malware (see http://www.shouldiremoveit.com/BrowserProtect-10799-program.aspx)

Comment 4

[Scoobidiver (away)]

It started spiking on March 12.

Here are correlations per module version (the latest available):
* April 8:
    100% (20/20) vs.   0% (32/47386) bavUm.dll (Baidu Antivirus)
          5% (1/20) vs.   0% (3/47386) 3.0.1.21514
         95% (19/20) vs.   0% (27/47386) 3.2.1.25080
    100% (20/20) vs.   8% (3916/47386) BrowserProtect.dll (BrowserProtect)
        100% (20/20) vs.   5% (2137/47386) 2.6.1125.80
          0% (0/20) vs.   0% (26/47386) 2.6.1184.107
* April 7:
    100% (52/52) vs.   0% (62/50642) bavUm.dll
        100% (52/52) vs.   0% (60/50642) 3.2.1.25080
     98% (51/52) vs.   9% (4428/50642) BrowserProtect.dll
         96% (50/52) vs.   5% (2391/50642) 2.6.1125.80
          0% (0/52) vs.   0% (16/50642) 2.6.1184.107
* April 6:
    100% (68/68) vs.   0% (80/67206) bavUm.dll
          6% (4/68) vs.   0% (5/67206) 3.0.1.21514
         94% (64/68) vs.   0% (72/67206) 3.2.1.25080
     79% (54/68) vs.   9% (5832/67206) BrowserProtect.dll
         78% (53/68) vs.   5% (3097/67206) 2.6.1125.80
          0% (0/68) vs.   0% (32/67206) 2.6.1184.107

Baidu Antivirus has a Thai version (see http://sd.baidu.com/en/).
It seems there's version 3.2.1.27003 Beta for Baidu Antivirus that may have fixed these crashes.

Comment 5

[Scoobidiver (away)]

It's #96 browser crasher in 20.0.1 and #19 in 21.0b5.

See http://sd.baidu.com/en/log.php for the release notes.

More reports at: https://crash-stats.mozilla.com/report/list?signature=RtlpWaitForCriticalSection+|+RtlEnterCriticalSection+|+CDrives_CreateInstance

Comment 6

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.