Opened on 05/29/2014 at 09:14:10 PM

Last modified on 03/13/2015 at 05:12:59 PM

#579 reopened defect

AdblockPlus for IE crashing

Reported by: -Px- Assignee:
Priority: P3 Milestone:
Module: Libadblockplus Keywords: ie_devbuild_1.2, crash
Cc: mapx Blocked By:
Blocking: Platform: Internet Explorer
Ready: no Confidential: no
Tester: Verified working: no
Review URL(s):

​http://codereview.adblockplus.org/5350367445385216/

Description

Environment

Windows 7 x64 SP1
Internet Explorer 10, all updates installed
Adblock Plus for IE 1.1
Default filters list

How to reproduce

No solid steps, this happens from time to time during daily browsing

Observed behaviour

Suddenly AdblockPlusEngine.exe is crashing with ExceptionCode: c0000005 (Access violation)

Expected behaviour

No crash

Additional data

I have windbg installed as default debugger, but as there is no debug symbols for Adblock available it's output not very meaningful, but I'm providing it anyway:
0:007> k
Child-SP RetAddr Call Site
000000002362ed48 000000009fe59841 0x221b84b
000000002362ed50 000000009fe45a61 0x9fe59841
000000002362ed58 000000002362ed98 0x9fe45a61
000000002362ed60 0000000002225e4a 0x2362ed98
000000002362ed68 1baffed00baffedf 0x2225e4a
000000002362ed70 000000009fe45de9 0x1baffed0`0baffedf
000000002362ed78 000000009fe59841 0x9fe45de9
000000002362ed80 0000000002225d81 0x9fe59841
000000002362ed88 0000000800000000 0x2225d81
000000002362ed90 0000000000000000 0x00000008`00000000

FAULTING_IP:
+0
00000000`0221b84b 488b50ff mov rdx,qword ptr [rax-1]

EXCEPTION_RECORD: ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 000000000221b84b

ExceptionCode: c0000005 (Access violation)

ExceptionFlags: 00000000

NumberParameters: 2

Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff

Attempt to read from address ffffffffffffffff

CONTEXT: 0000000000000000 -- (.cxr 0x0;r)
rax=1baffed00baffedf rbx=0000000000000001 rcx=0000000000000000
rdx=000000000221b820 rsi=000000009fe45a61 rdi=000000009fe59841
rip=000000000221b84b rsp=000000002362ed48 rbp=000000002362ed58
r8=000000009fe45de9 r9=0000000000000001 r10=00000000231f3308
r11=0000000000000202 r12=0000000100000000 r13=0000000000338ef8
r14=000000009fe45391 r15=000000002362f040
iopl=0 nv up ei pl nz na pe nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010200
000000000221b84b 488b50ff mov rdx,qword ptr [rax-1] ds:1baffed00baffede=????????????????

FAULTING_THREAD: 000000000000181c

DEFAULT_BUCKET_ID: INVALID_POINTER_READ

PROCESS_NAME: AdblockPlusEngine.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: ffffffffffffffff

READ_ADDRESS: ffffffffffffffff

FOLLOWUP_IP:
unknown!noop+0
00000000`9fe59841 58 pop rax

NTGLOBALFLAG: 0

APPLICATION_VERIFIER_FLAGS: 0

APP: adblockplusengine.exe

ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre

IP_ON_HEAP: 000000009fe59841
The fault address in not in any loaded module, please check your build's rebase
log at <releasedir>\bin\build_logs\timebuild\ntrebase.log for module which may
contain the address if it were loaded.

PRIMARY_PROBLEM_CLASS: INVALID_POINTER_READ

BUGCHECK_STR: APPLICATION_FAULT_INVALID_POINTER_READ

FRAME_ONE_INVALID: 1

LAST_CONTROL_TRANSFER: from 000000009fe59841 to 000000000221b84b

STACK_TEXT:
000000002362ed48 000000009fe59841 : 000000009fe45a61 000000002362ed98 0000000002225e4a 1baffed00baffedf : 0x221b84b
000000002362ed50 000000009fe45a61 : 000000002362ed98 0000000002225e4a 1baffed00baffedf 000000009fe45de9 : 0x9fe59841
000000002362ed58 000000002362ed98 : 0000000002225e4a 1baffed00baffedf 000000009fe45de9 000000009fe59841 : 0x9fe45a61
000000002362ed60 0000000002225e4a : 1baffed00baffedf 000000009fe45de9 000000009fe59841 0000000002225d81 : 0x2362ed98
000000002362ed68 1baffed00baffedf : 000000009fe45de9 000000009fe59841 0000000002225d81 0000000800000000 : 0x2225e4a
000000002362ed70 000000009fe45de9 : 000000009fe59841 0000000002225d81 0000000800000000 0000000000000000 : 0x1baffed0`0baffedf
000000002362ed78 000000009fe59841 : 0000000002225d81 0000000800000000 0000000000000000 000000002362ee30 : 0x9fe45de9
000000002362ed80 0000000002225d81 : 0000000800000000 0000000000000000 000000002362ee30 0000000002207a19 : 0x9fe59841
000000002362ed88 0000000800000000 : 0000000000000000 000000002362ee30 0000000002207a19 0000000000000000 : 0x2225d81
000000002362ed90 0000000000000000 : 000000002362ee30 0000000002207a19 0000000000000000 0000000000000000 : 0x00000008`00000000

STACK_COMMAND: .cxr 0x0 ; kb

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: unknown!noop+2362ed48

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: unknown

IMAGE_NAME: unknown

DEBUG_FLR_IMAGE_TIMESTAMP: 0

FAILURE_BUCKET_ID: INVALID_POINTER_READ_c0000005_unknown!noop

BUCKET_ID: X64_APPLICATION_FAULT_INVALID_POINTER_READ_unknown!noop+2362ed48

Additional question

I can make process memory dump with procdump next time it will happen and send it privately (as this happen on my work machine, it may contain sensitive information), if this helps to investigate the issue.

Attachments (0)

Change History (13)

comment:1 Changed on 05/30/2014 at 07:39:52 AM by mapx

  • Cc mapx added
  • Priority changed from Unknown to P2

comment:2 Changed on 06/22/2014 at 08:39:38 PM by oleksandr

This is very likely a dupplicate of #613

comment:3 Changed on 07/01/2014 at 07:38:00 PM by oleksandr

  • Owner set to oleksandr
  • Platform set to Unknown

comment:4 Changed on 07/01/2014 at 11:00:36 PM by oleksandr

  • Review URL(s) modified (diff)
  • Status changed from new to reviewing

comment:5 Changed on 07/01/2014 at 11:02:36 PM by oleksandr

  • Keywords ie_devbuild_1.2 added

comment:6 Changed on 07/09/2014 at 12:36:01 PM by philll

  • Platform changed from Unknown to Internet Explorer

comment:7 Changed on 07/15/2014 at 11:13:52 AM by oleksandr

  • Ready set

comment:8 Changed on 07/28/2014 at 11:56:16 AM by oleksandr

  • Priority changed from P2 to P3

comment:9 follow-up: Changed on 07/31/2014 at 10:37:42 AM by fixie

This crash is not random for me: I can reproduce it consistently & immediately on major web portals like Yahoo & MSN. If you want any technical data, just ask for it.

comment:10 in reply to: ↑ 9 Changed on 07/31/2014 at 10:44:37 AM by mapx

Replying to fixie:

This crash is not random for me: I can reproduce it consistently & immediately on major web portals like Yahoo & MSN. If you want any technical data, just ask for it.

even using the last dev build ?
​https://downloads.adblockplus.org/devbuilds/adblockplusie/adblockplusie-1.2.667.exe

comment:11 Changed on 01/21/2015 at 04:12:12 PM by oleksandr

  • Component changed from Adblock-Plus-for-Internet-Explorer to Libadblockplus
  • Owner oleksandr deleted
  • Ready unset

comment:12 Changed on 02/09/2015 at 12:49:18 PM by eric@adblockplus.org

  • Keywords crash added

comment:13 Changed on 03/13/2015 at 05:12:59 PM by trev

  • Status changed from reviewing to reopened

This doesn't seem to be under review.

Add Comment

Modify Ticket

Change Properties
Action
as reopened .
as The resolution will be set. Next status will be 'closed'.
to The owner will be changed from (none).
Next status will be 'reviewing'.
Attachments ↑ Description ↑
 
Note: See TracTickets for help on using tickets.