910759 - Intermittent TEST-UNEXPECTED-FAIL : xperf: File 'c:\windows\system32\duser.dll' was accessed and we were not expecting it. DiskReadCount: 2, DiskWriteCount: 0, DiskReadBytes: 8192, DiskWriteBytes: 0

Status: RESOLVED WORKSFORME

(Core :: General, defect)

Description

[Ryan VanderMeulen [:RyanVM]]

https://tbpl.mozilla.org/php/getParsedLog.php?id=27175443&tree=Mozilla-Inbound

Windows 7 32-bit mozilla-inbound talos xperf on 2013-08-29 08:08:07 PDT for push 67b98c1c0b7b
slave: t-w732-ix-073

08:14:37     INFO -  Merged Etl: test.etl
08:15:27     INFO -  c:/Program Files/Microsoft Windows Performance Toolkit/xperf: warning: applying restriction of access for trace processing
08:15:50     INFO -  reading etl filename: test.etl
08:15:50     INFO -  etlparser: in readfile: test.etl.csv
08:15:50     INFO -  TEST-UNEXPECTED-FAIL : xperf: File 'c:\windows\system32\duser.dll' was accessed and we were not expecting it.  DiskReadCount: 2, DiskWriteCount: 0, DiskReadBytes: 8192, DiskWriteBytes: 0
08:15:54     INFO -  INFO : __startBeforeLaunchTimestamp1377789169902__endBeforeLaunchTimestamp

Comment 1

[(No longer employed by Mozilla) Aaron Klotz]

I generated some dependency information for duser.dll. My understanding is that this DLL implements internal Microsoft APIs and is only a dependency of other Windows DLLs. Because this failure is intermittent, it would have to be either delay loaded or dynamically linked via LoadLibrary.

Here's the dependency information that I uncovered. Each of these DLLs imports duser.dll in some capacity:

certenrollui.dll
dxptaskringtone.dll
display.dll
dxptasksync.dll
explorerframe.dll
oobefldr.dll
authui.dll <-- delay loaded
autoplay.dll
dui70.dll <-- delay loaded
mstscax.dll
shell32.dll <-- delay loaded
themecpl.dll
wdc.dll
xwtpdui.dll

The one that stands out to me is shell32.dll. That one has a high probability of being the culprit in our case. Having said that, without seeing the call stack associated with the load of duser.dll, we don't know which code path triggered the lazy loading.

Comment 2

[Joel Maher ( :jmaher ) (UTC -8)]

this is 2+ months old, I don't think we have seen this again (according to bugzilla and my memory of irc chatter).  Shall we leave it open for another month and then close it?

Comment 3

[Ed Morley [:emorley]]

Intermittent failure not seen for >3 months; filter on mass-intermittent-wfm-20140812.