IExplore crash points to mscorwks in mini-dump opened with WinDBG

1

Help please - I've been asked to debug a mini-dump crash dump in which IEXPORE.EXE appears to be the primary image that failed, and MSCORWKS is pointed to as the faulting module. At least that's what it looks like when I open up the crash using WinDBG. I'm able to load the SOS extension, but attempts to do things like !clrstack and !threads fail:

0:005> !clrstack -p
OS Thread Id: 0x764 (5)
Unable to walk the managed stack. The current thread is likely not a 
managed thread. You can run !threads to get a list of managed threads in
the process
0:005> !threads
Failed to request ThreadStore

my sympath's are set up as follows (there are no lines, I added the line breaks for readability). My local cache is 1st, the product symbol servers are next, followed by the MS symbol server:

cache*d:\localSymCache;
srv*\\bn-netapp01\Dev1\Dragon\symbols;
srv*\\bn-dns-builds\S\symbols\Dragon\secondaryE;
srv*\\bn-dnsbuilds\S\symbols\Dragon\secondaryO;
srv*http://msdl.microsoft.com/download/symbols

When I do an analyze -v command, I get the following, but I'm not sure what it means.

0:005> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

Unable to load image C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\dae02331a443fb52216ca83292cb2f21\mscorlib.ni.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for mscorlib.ni.dll
*** WARNING: Unable to verify timestamp for ieui.dll
*** WARNING: Unable to verify timestamp for ScriptSn.20130301183149.dll
*** ERROR: Module load completed but symbols could not be loaded for ScriptSn.20130301183149.dll
*** WARNING: Unable to verify timestamp for mfc100u.dll

FAULTING_IP: 
kernel32!RaiseException+53
7c812fd3 5e              pop     esi

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 7c812fd3 (kernel32!RaiseException+0x00000053)
ExceptionCode: e0434f4d (CLR exception)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 80004005

CONTEXT:  00000000 -- (.cxr 0x0;r)
eax=02500000 ebx=1450efa8 ecx=00000007 edx=7c90e514 esi=1450ef80 edi=1450efd8
eip=7c90e514 esp=01b5e560 ebp=01b5e570 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntdll!KiFastSystemCallRet:
7c90e514 c3              ret

DEFAULT_BUCKET_ID:  WRONG_SYMBOLS

PROCESS_NAME:  iexplore.exe

ERROR_CODE: (NTSTATUS) 0xe0434f4d - <Unable to get error code text>

EXCEPTION_CODE: (NTSTATUS) 0xe0434f4d - <Unable to get error code text>

EXCEPTION_PARAMETER1:  80004005

ADDITIONAL_DEBUG_TEXT:  ;!threads returned "Failed to request ThreadStore".

APP:  iexplore.exe

ANALYSIS_VERSION: 6.3.9600.17029 (debuggers(dbg).140219-1702) x86fre

MANAGED_STACK: !dumpstack -EE
OS Thread Id: 0x764 (5)
TEB information is not available so a stack size of 0xFFFF is assumed
Current frame: 
ChildEBP RetAddr  Caller,Callee

PRIMARY_PROBLEM_CLASS:  WRONG_SYMBOLS

BUGCHECK_STR:  APPLICATION_FAULT_WRONG_SYMBOLS_CLR_EXCEPTION

LAST_CONTROL_TRANSFER:  from 79efcaf4 to 7c812fd3

STACK_TEXT:  
01b5fb08 79efcaf4 e0434f4d 00000001 00000001 kernel32!RaiseException+0x53
01b5fb68 7a0bdb35 1d5f5b0c 00000000 00000000 mscorwks!RaiseTheExceptionInternalOnly+0x2a8
01b5fb80 7a0bdba7 1d5f5b0c 00000000 01b5fd08 mscorwks!RaiseTheException+0x4e
01b5fba8 7a0bdbd8 00000000 03a64c70 ac27a4d9 mscorwks!RaiseTheException+0xc0
01b5fbd4 7a0bdbe6 1d5f5b0c 00000000 01b5fd14 mscorwks!RealCOMPlusThrow+0x30
01b5fbe4 7a12e2a3 1d5f5b0c f3d6a570 79fbc368 mscorwks!RealCOMPlusThrow+0xd
01b5fd14 7a130435 00000000 01b5fd4c 01b5fdbc mscorwks!Thread::RaiseCrossContextException+0x41f
01b5fdc8 7a0ef635 00000002 7a0ef59d 01b5fdec mscorwks!Thread::DoADCallBack+0x2a2
01b5fe20 03f327c1 ffffffff 03a64c70 01b5fe50 mscorwks!UM2MDoADCallBack+0x7c
WARNING: Frame IP not in any known module. Following frames may be wrong.
01b5fe48 7e418734 01b2091a 00000202 00000000 0x3f327c1
01b5fe74 7e418816 0809f522 01b2091a 00000202 user32!InternalCallWinProc+0x28
01b5fedc 7e4189cd 00000000 0809f522 01b2091a user32!UserCallWinProcCheckWow+0x150
01b5ff3c 7e418a10 01b5ff64 00000000 01b5ffb4 user32!DispatchMessageWorker+0x306
01b5ff4c 3e25e77b 01b5ff64 0012e490 0012e5b8 user32!DispatchMessageW+0xf
01b5ffb4 7c80b729 001ab758 0012e490 0012e5b8 ieframe!CTabWindow::_TabWindowThreadProc+0x189
01b5ffec 00000000 3e25e544 001a0c70 00000000 kernel32!BaseThreadStart+0x37


STACK_COMMAND:  ~5s; .ecxr ; kb

FOLLOWUP_IP: 
mscorwks!Thread::DoADCallBack+2a2
7a130435 8b4d0c          mov     ecx,dword ptr [ebp+0Ch]

SYMBOL_STACK_INDEX:  7

SYMBOL_NAME:  mscorwks!Thread::DoADCallBack+2a2

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: mscorwks

IMAGE_NAME:  mscorwks.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  5266e523

FAILURE_BUCKET_ID:  WRONG_SYMBOLS_e0434f4d_mscorwks.dll!Thread::DoADCallBack

BUCKET_ID:  APPLICATION_FAULT_WRONG_SYMBOLS_CLR_EXCEPTION_mscorwks!Thread::DoADCallBack+2a2

WATSON_IBUCKET:  179080875

WATSON_IBUCKETTABLE:  17

ANALYSIS_SOURCE:  UM

FAILURE_ID_HASH_STRING:  um:wrong_symbols_e0434f4d_mscorwks.dll!thread::doadcallback

FAILURE_ID_HASH:  {6d7d59d3-fc43-baf6-fb00-7f304070aba8}

Followup: MachineOwner
---------
.net
windbg
crash-dumps
asked on Stack Overflow May 27, 2014 by user3679359 • edited May 27, 2014 by Thomas Weller

0 Answers

Nobody has answered this question yet.


User contributions licensed under CC BY-SA 3.0