w3wp.exe crash - reading dmp file

w3wp.exe crash - reading dmp file

am 16.10.2007 13:51:00 von Rob

I've got lots of w3wp.exe application crashes in my event log, I’ve generated
several dmp files from these but don't really know what I’m looking for.

Does anyone know a free resource or place I can post them to be read and
advice/guidance given?

Re: w3wp.exe crash - reading dmp file

am 16.10.2007 14:59:51 von hb

Check with DebugDiag.

Debug Diagnostic Tool v1.1
The Debug Diagnostic Tool (DebugDiag) is designed to assist in
troubleshooting issues such as hangs, slow performance, memory leaks
or fragmentation, and crashes in any Win32 user-mode process. The tool
includes additional debugging scripts focused on Internet Information
Services (IIS) applications, web data access components, COM+ and
related Microsoft technologies.
http://www.microsoft.com/downloads/details.aspx?FamilyID=28B D5941-C458-46F1-B24D-F60151D875A3&displaylang=en

---
hB

Re: w3wp.exe crash - reading dmp file

am 16.10.2007 16:05:53 von hb

Check with DebugDiag.

Debug Diagnostic Tool v1.1
The Debug Diagnostic Tool (DebugDiag) is designed to assist in
troubleshooting issues such as hangs, slow performance, memory leaks
or fragmentation, and crashes in any Win32 user-mode process. The tool
includes additional debugging scripts focused on Internet Information
Services (IIS) applications, web data access components, COM+ and
related Microsoft technologies.
http://www.microsoft.com/downloads/details.aspx?FamilyID=28B D5941-C458-46F1-B24D-F60151D875A3&displaylang=en

---
hB

Re: w3wp.exe crash - reading dmp file

am 16.10.2007 18:32:02 von Rob

excellent, thank you hB

I installed and ran the analysis on my dump file and this is the result

Error In
inetinfo__PID__1520__Date__10_12_2007__Time_06_12_42AM__781_ _Second_Chance_Exception_C0000005.dmp
the assembly instruction at ntdll!RtlpWaitOnCriticalSection+df in
C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused an access
violation exception (0xC0000005) when trying to write to memory location
0x00000014 on thread 21
Please follow up with the vendor Microsoft Corporation for
C:\WINDOWS\system32\ntdll.dll

Error In
w3wp__PID__7744__Date__10_12_2007__Time_01_05_25AM__296__Sec ond_Chance_Exception_C0000005.dmp
the assembly instruction at ntdll!RtlpCoalesceFreeBlocks+36e in
C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused an access
violation exception (0xC0000005) when trying to read from memory location
0x00000000 on thread 0

Heap corruption was detected in heap 0x00700000, however pageheap was not
enabled in this dump. Please follow the instructions in the recommendation
section for troubleshooting heap corruption issues.

Current NTGlobalFlags value: 0x0 An access violation exception thrown by a
heap memory manager function indicates heap corruption. Please follow the
steps outlined in the following Knowledge Base article:

300966 Howto debug heap corruption issues in Internet Information Services
(IIS)
Error In
dllhost__PID__7356__Date__10_12_2007__Time_01_05_41AM__796__ Second_Chance_Exception_C0000005.dmp
the assembly instruction at ntdll!RtlFindCharInUnicodeString+3d in
C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused an access
violation exception (0xC0000005) when trying to write to memory location
0x009b0ffc on thread 2
Please follow up with the vendor Microsoft Corporation for
C:\WINDOWS\system32\ntdll.dll

Error In
w3wp__PID__7140__Date__10_11_2007__Time_06_57_59PM__406__Sec ond_Chance_Exception_C0000005.dmp
the assembly instruction at ntdll!RtlEnterCriticalSection+31 in
C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused an access
violation exception (0xC0000005) when trying to read from memory location
0x00000024 on thread 16
Please follow up with the vendor Microsoft Corporation for
C:\WINDOWS\system32\ntdll.dll

Error In
w3wp__PID__7484__Date__10_11_2007__Time_09_30_00PM__984__Sec ond_Chance_Exception_C0000005.dmp
the assembly instruction at mscorwks!SVR::gc_heap::plan_phase+529 in
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll from Microsoft
Corporation has caused an access violation exception (0xC0000005) when trying
to read from memory location 0x00000000 on thread 22
Please follow up with the vendor Microsoft Corporation for
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll

i'm following the KB on the heap corruption entry, anyone offer any thoughts
or opinions?


"hB" wrote:

> Check with DebugDiag.
>
> Debug Diagnostic Tool v1.1
> The Debug Diagnostic Tool (DebugDiag) is designed to assist in
> troubleshooting issues such as hangs, slow performance, memory leaks
> or fragmentation, and crashes in any Win32 user-mode process. The tool
> includes additional debugging scripts focused on Internet Information
> Services (IIS) applications, web data access components, COM+ and
> related Microsoft technologies.
> http://www.microsoft.com/downloads/details.aspx?FamilyID=28B D5941-C458-46F1-B24D-F60151D875A3&displaylang=en
>
> ---
> hB
>
>

Re: w3wp.exe crash - reading dmp file

am 16.10.2007 18:55:35 von patfilot

You are hitting a memory corruption issue. Basically, some dll stomps on
the memory and leaves it trashed, which is at some later time touched and a
crash ensues. If you enable PageHeap on the process, it will force a crash
at the time of corruption & you can identify the culprit.


Pat

"Rob" wrote in message
news:CE071B32-9290-4089-9088-83E76187497F@microsoft.com...
> excellent, thank you hB
>
> I installed and ran the analysis on my dump file and this is the result
>
> Error In
> inetinfo__PID__1520__Date__10_12_2007__Time_06_12_42AM__781_ _Second_Chance_Exception_C0000005.dmp
> the assembly instruction at ntdll!RtlpWaitOnCriticalSection+df in
> C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused an
> access
> violation exception (0xC0000005) when trying to write to memory location
> 0x00000014 on thread 21
> Please follow up with the vendor Microsoft Corporation for
> C:\WINDOWS\system32\ntdll.dll
>
> Error In
> w3wp__PID__7744__Date__10_12_2007__Time_01_05_25AM__296__Sec ond_Chance_Exception_C0000005.dmp
> the assembly instruction at ntdll!RtlpCoalesceFreeBlocks+36e in
> C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused an
> access
> violation exception (0xC0000005) when trying to read from memory location
> 0x00000000 on thread 0
>
> Heap corruption was detected in heap 0x00700000, however pageheap was not
> enabled in this dump. Please follow the instructions in the recommendation
> section for troubleshooting heap corruption issues.
>
> Current NTGlobalFlags value: 0x0 An access violation exception thrown by a
> heap memory manager function indicates heap corruption. Please follow the
> steps outlined in the following Knowledge Base article:
>
> 300966 Howto debug heap corruption issues in Internet Information Services
> (IIS)
> Error In
> dllhost__PID__7356__Date__10_12_2007__Time_01_05_41AM__796__ Second_Chance_Exception_C0000005.dmp
> the assembly instruction at ntdll!RtlFindCharInUnicodeString+3d in
> C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused an
> access
> violation exception (0xC0000005) when trying to write to memory location
> 0x009b0ffc on thread 2
> Please follow up with the vendor Microsoft Corporation for
> C:\WINDOWS\system32\ntdll.dll
>
> Error In
> w3wp__PID__7140__Date__10_11_2007__Time_06_57_59PM__406__Sec ond_Chance_Exception_C0000005.dmp
> the assembly instruction at ntdll!RtlEnterCriticalSection+31 in
> C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused an
> access
> violation exception (0xC0000005) when trying to read from memory location
> 0x00000024 on thread 16
> Please follow up with the vendor Microsoft Corporation for
> C:\WINDOWS\system32\ntdll.dll
>
> Error In
> w3wp__PID__7484__Date__10_11_2007__Time_09_30_00PM__984__Sec ond_Chance_Exception_C0000005.dmp
> the assembly instruction at mscorwks!SVR::gc_heap::plan_phase+529 in
> C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll from Microsoft
> Corporation has caused an access violation exception (0xC0000005) when
> trying
> to read from memory location 0x00000000 on thread 22
> Please follow up with the vendor Microsoft Corporation for
> C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
>
> i'm following the KB on the heap corruption entry, anyone offer any
> thoughts
> or opinions?
>
>
> "hB" wrote:
>
>> Check with DebugDiag.
>>
>> Debug Diagnostic Tool v1.1
>> The Debug Diagnostic Tool (DebugDiag) is designed to assist in
>> troubleshooting issues such as hangs, slow performance, memory leaks
>> or fragmentation, and crashes in any Win32 user-mode process. The tool
>> includes additional debugging scripts focused on Internet Information
>> Services (IIS) applications, web data access components, COM+ and
>> related Microsoft technologies.
>> http://www.microsoft.com/downloads/details.aspx?FamilyID=28B D5941-C458-46F1-B24D-F60151D875A3&displaylang=en
>>
>> ---
>> hB
>>
>>

Re: w3wp.exe crash - reading dmp file

am 17.10.2007 11:05:02 von Rob

i set this up to run and it's generated some dump files, even though the
error hasn't occured in the event log. I analyze these is Debug Diagnostic
but it doesn't report anything. Is IISDump.exe still running?



"Pat [MSFT]" wrote:

> You are hitting a memory corruption issue. Basically, some dll stomps on
> the memory and leaves it trashed, which is at some later time touched and a
> crash ensues. If you enable PageHeap on the process, it will force a crash
> at the time of corruption & you can identify the culprit.
>
>
> Pat
>
> "Rob" wrote in message
> news:CE071B32-9290-4089-9088-83E76187497F@microsoft.com...
> > excellent, thank you hB
> >
> > I installed and ran the analysis on my dump file and this is the result
> >
> > Error In
> > inetinfo__PID__1520__Date__10_12_2007__Time_06_12_42AM__781_ _Second_Chance_Exception_C0000005.dmp
> > the assembly instruction at ntdll!RtlpWaitOnCriticalSection+df in
> > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused an
> > access
> > violation exception (0xC0000005) when trying to write to memory location
> > 0x00000014 on thread 21
> > Please follow up with the vendor Microsoft Corporation for
> > C:\WINDOWS\system32\ntdll.dll
> >
> > Error In
> > w3wp__PID__7744__Date__10_12_2007__Time_01_05_25AM__296__Sec ond_Chance_Exception_C0000005.dmp
> > the assembly instruction at ntdll!RtlpCoalesceFreeBlocks+36e in
> > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused an
> > access
> > violation exception (0xC0000005) when trying to read from memory location
> > 0x00000000 on thread 0
> >
> > Heap corruption was detected in heap 0x00700000, however pageheap was not
> > enabled in this dump. Please follow the instructions in the recommendation
> > section for troubleshooting heap corruption issues.
> >
> > Current NTGlobalFlags value: 0x0 An access violation exception thrown by a
> > heap memory manager function indicates heap corruption. Please follow the
> > steps outlined in the following Knowledge Base article:
> >
> > 300966 Howto debug heap corruption issues in Internet Information Services
> > (IIS)
> > Error In
> > dllhost__PID__7356__Date__10_12_2007__Time_01_05_41AM__796__ Second_Chance_Exception_C0000005.dmp
> > the assembly instruction at ntdll!RtlFindCharInUnicodeString+3d in
> > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused an
> > access
> > violation exception (0xC0000005) when trying to write to memory location
> > 0x009b0ffc on thread 2
> > Please follow up with the vendor Microsoft Corporation for
> > C:\WINDOWS\system32\ntdll.dll
> >
> > Error In
> > w3wp__PID__7140__Date__10_11_2007__Time_06_57_59PM__406__Sec ond_Chance_Exception_C0000005.dmp
> > the assembly instruction at ntdll!RtlEnterCriticalSection+31 in
> > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused an
> > access
> > violation exception (0xC0000005) when trying to read from memory location
> > 0x00000024 on thread 16
> > Please follow up with the vendor Microsoft Corporation for
> > C:\WINDOWS\system32\ntdll.dll
> >
> > Error In
> > w3wp__PID__7484__Date__10_11_2007__Time_09_30_00PM__984__Sec ond_Chance_Exception_C0000005.dmp
> > the assembly instruction at mscorwks!SVR::gc_heap::plan_phase+529 in
> > C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll from Microsoft
> > Corporation has caused an access violation exception (0xC0000005) when
> > trying
> > to read from memory location 0x00000000 on thread 22
> > Please follow up with the vendor Microsoft Corporation for
> > C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
> >
> > i'm following the KB on the heap corruption entry, anyone offer any
> > thoughts
> > or opinions?
> >
> >
> > "hB" wrote:
> >
> >> Check with DebugDiag.
> >>
> >> Debug Diagnostic Tool v1.1
> >> The Debug Diagnostic Tool (DebugDiag) is designed to assist in
> >> troubleshooting issues such as hangs, slow performance, memory leaks
> >> or fragmentation, and crashes in any Win32 user-mode process. The tool
> >> includes additional debugging scripts focused on Internet Information
> >> Services (IIS) applications, web data access components, COM+ and
> >> related Microsoft technologies.
> >> http://www.microsoft.com/downloads/details.aspx?FamilyID=28B D5941-C458-46F1-B24D-F60151D875A3&displaylang=en
> >>
> >> ---
> >> hB
> >>
> >>
>

Re: w3wp.exe crash - reading dmp file

am 17.10.2007 18:39:51 von patfilot

Can you post the failing thread stacks from the dump files?

Pat
"Rob" wrote in message
news:EA0CE9D6-E979-4375-A65F-C644AF36F8F2@microsoft.com...
>i set this up to run and it's generated some dump files, even though the
> error hasn't occured in the event log. I analyze these is Debug Diagnostic
> but it doesn't report anything. Is IISDump.exe still running?
>
>
>
> "Pat [MSFT]" wrote:
>
>> You are hitting a memory corruption issue. Basically, some dll stomps on
>> the memory and leaves it trashed, which is at some later time touched and
>> a
>> crash ensues. If you enable PageHeap on the process, it will force a
>> crash
>> at the time of corruption & you can identify the culprit.
>>
>>
>> Pat
>>
>> "Rob" wrote in message
>> news:CE071B32-9290-4089-9088-83E76187497F@microsoft.com...
>> > excellent, thank you hB
>> >
>> > I installed and ran the analysis on my dump file and this is the result
>> >
>> > Error In
>> > inetinfo__PID__1520__Date__10_12_2007__Time_06_12_42AM__781_ _Second_Chance_Exception_C0000005.dmp
>> > the assembly instruction at ntdll!RtlpWaitOnCriticalSection+df in
>> > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused an
>> > access
>> > violation exception (0xC0000005) when trying to write to memory
>> > location
>> > 0x00000014 on thread 21
>> > Please follow up with the vendor Microsoft Corporation for
>> > C:\WINDOWS\system32\ntdll.dll
>> >
>> > Error In
>> > w3wp__PID__7744__Date__10_12_2007__Time_01_05_25AM__296__Sec ond_Chance_Exception_C0000005.dmp
>> > the assembly instruction at ntdll!RtlpCoalesceFreeBlocks+36e in
>> > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused an
>> > access
>> > violation exception (0xC0000005) when trying to read from memory
>> > location
>> > 0x00000000 on thread 0
>> >
>> > Heap corruption was detected in heap 0x00700000, however pageheap was
>> > not
>> > enabled in this dump. Please follow the instructions in the
>> > recommendation
>> > section for troubleshooting heap corruption issues.
>> >
>> > Current NTGlobalFlags value: 0x0 An access violation exception thrown
>> > by a
>> > heap memory manager function indicates heap corruption. Please follow
>> > the
>> > steps outlined in the following Knowledge Base article:
>> >
>> > 300966 Howto debug heap corruption issues in Internet Information
>> > Services
>> > (IIS)
>> > Error In
>> > dllhost__PID__7356__Date__10_12_2007__Time_01_05_41AM__796__ Second_Chance_Exception_C0000005.dmp
>> > the assembly instruction at ntdll!RtlFindCharInUnicodeString+3d in
>> > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused an
>> > access
>> > violation exception (0xC0000005) when trying to write to memory
>> > location
>> > 0x009b0ffc on thread 2
>> > Please follow up with the vendor Microsoft Corporation for
>> > C:\WINDOWS\system32\ntdll.dll
>> >
>> > Error In
>> > w3wp__PID__7140__Date__10_11_2007__Time_06_57_59PM__406__Sec ond_Chance_Exception_C0000005.dmp
>> > the assembly instruction at ntdll!RtlEnterCriticalSection+31 in
>> > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused an
>> > access
>> > violation exception (0xC0000005) when trying to read from memory
>> > location
>> > 0x00000024 on thread 16
>> > Please follow up with the vendor Microsoft Corporation for
>> > C:\WINDOWS\system32\ntdll.dll
>> >
>> > Error In
>> > w3wp__PID__7484__Date__10_11_2007__Time_09_30_00PM__984__Sec ond_Chance_Exception_C0000005.dmp
>> > the assembly instruction at mscorwks!SVR::gc_heap::plan_phase+529 in
>> > C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll from
>> > Microsoft
>> > Corporation has caused an access violation exception (0xC0000005) when
>> > trying
>> > to read from memory location 0x00000000 on thread 22
>> > Please follow up with the vendor Microsoft Corporation for
>> > C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
>> >
>> > i'm following the KB on the heap corruption entry, anyone offer any
>> > thoughts
>> > or opinions?
>> >
>> >
>> > "hB" wrote:
>> >
>> >> Check with DebugDiag.
>> >>
>> >> Debug Diagnostic Tool v1.1
>> >> The Debug Diagnostic Tool (DebugDiag) is designed to assist in
>> >> troubleshooting issues such as hangs, slow performance, memory leaks
>> >> or fragmentation, and crashes in any Win32 user-mode process. The tool
>> >> includes additional debugging scripts focused on Internet Information
>> >> Services (IIS) applications, web data access components, COM+ and
>> >> related Microsoft technologies.
>> >> http://www.microsoft.com/downloads/details.aspx?FamilyID=28B D5941-C458-46F1-B24D-F60151D875A3&displaylang=en
>> >>
>> >> ---
>> >> hB
>> >>
>> >>
>>

Re: w3wp.exe crash - reading dmp file

am 18.10.2007 14:52:01 von Rob

Thanks for your help so far Pat

I got another crash this morning (no event log entries though?) when this
happened I ran IISDump.exe and it generated 6 dmp files, I ran these through
Debug Diagnostics and tried to post the output, which I can't as it's to
long. This confirms I’m missing something so...

I've got 6 dmp file with the following name

Hang--8120_w3wp_SharePoint_-_ssp.abbeylegal.com.dmp
Hang--7636_w3wp_DefaultAppPool.dmp
Hang--6636_w3wp_SharePoint_Central_Administration_v3.dmp
Hang--7240_inetinfo.dmp
Hang--7328_svchost.dmp
Hang--5208_dllhost_System_Application.dmp

how do I find the failing thread stacks from the dump files?


"Pat [MSFT]" wrote:

> Can you post the failing thread stacks from the dump files?
>
> Pat
> "Rob" wrote in message
> news:EA0CE9D6-E979-4375-A65F-C644AF36F8F2@microsoft.com...
> >i set this up to run and it's generated some dump files, even though the
> > error hasn't occured in the event log. I analyze these is Debug Diagnostic
> > but it doesn't report anything. Is IISDump.exe still running?
> >
> >
> >
> > "Pat [MSFT]" wrote:
> >
> >> You are hitting a memory corruption issue. Basically, some dll stomps on
> >> the memory and leaves it trashed, which is at some later time touched and
> >> a
> >> crash ensues. If you enable PageHeap on the process, it will force a
> >> crash
> >> at the time of corruption & you can identify the culprit.
> >>
> >>
> >> Pat
> >>
> >> "Rob" wrote in message
> >> news:CE071B32-9290-4089-9088-83E76187497F@microsoft.com...
> >> > excellent, thank you hB
> >> >
> >> > I installed and ran the analysis on my dump file and this is the result
> >> >
> >> > Error In
> >> > inetinfo__PID__1520__Date__10_12_2007__Time_06_12_42AM__781_ _Second_Chance_Exception_C0000005.dmp
> >> > the assembly instruction at ntdll!RtlpWaitOnCriticalSection+df in
> >> > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused an
> >> > access
> >> > violation exception (0xC0000005) when trying to write to memory
> >> > location
> >> > 0x00000014 on thread 21
> >> > Please follow up with the vendor Microsoft Corporation for
> >> > C:\WINDOWS\system32\ntdll.dll
> >> >
> >> > Error In
> >> > w3wp__PID__7744__Date__10_12_2007__Time_01_05_25AM__296__Sec ond_Chance_Exception_C0000005.dmp
> >> > the assembly instruction at ntdll!RtlpCoalesceFreeBlocks+36e in
> >> > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused an
> >> > access
> >> > violation exception (0xC0000005) when trying to read from memory
> >> > location
> >> > 0x00000000 on thread 0
> >> >
> >> > Heap corruption was detected in heap 0x00700000, however pageheap was
> >> > not
> >> > enabled in this dump. Please follow the instructions in the
> >> > recommendation
> >> > section for troubleshooting heap corruption issues.
> >> >
> >> > Current NTGlobalFlags value: 0x0 An access violation exception thrown
> >> > by a
> >> > heap memory manager function indicates heap corruption. Please follow
> >> > the
> >> > steps outlined in the following Knowledge Base article:
> >> >
> >> > 300966 Howto debug heap corruption issues in Internet Information
> >> > Services
> >> > (IIS)
> >> > Error In
> >> > dllhost__PID__7356__Date__10_12_2007__Time_01_05_41AM__796__ Second_Chance_Exception_C0000005.dmp
> >> > the assembly instruction at ntdll!RtlFindCharInUnicodeString+3d in
> >> > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused an
> >> > access
> >> > violation exception (0xC0000005) when trying to write to memory
> >> > location
> >> > 0x009b0ffc on thread 2
> >> > Please follow up with the vendor Microsoft Corporation for
> >> > C:\WINDOWS\system32\ntdll.dll
> >> >
> >> > Error In
> >> > w3wp__PID__7140__Date__10_11_2007__Time_06_57_59PM__406__Sec ond_Chance_Exception_C0000005.dmp
> >> > the assembly instruction at ntdll!RtlEnterCriticalSection+31 in
> >> > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused an
> >> > access
> >> > violation exception (0xC0000005) when trying to read from memory
> >> > location
> >> > 0x00000024 on thread 16
> >> > Please follow up with the vendor Microsoft Corporation for
> >> > C:\WINDOWS\system32\ntdll.dll
> >> >
> >> > Error In
> >> > w3wp__PID__7484__Date__10_11_2007__Time_09_30_00PM__984__Sec ond_Chance_Exception_C0000005.dmp
> >> > the assembly instruction at mscorwks!SVR::gc_heap::plan_phase+529 in
> >> > C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll from
> >> > Microsoft
> >> > Corporation has caused an access violation exception (0xC0000005) when
> >> > trying
> >> > to read from memory location 0x00000000 on thread 22
> >> > Please follow up with the vendor Microsoft Corporation for
> >> > C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
> >> >
> >> > i'm following the KB on the heap corruption entry, anyone offer any
> >> > thoughts
> >> > or opinions?
> >> >
> >> >
> >> > "hB" wrote:
> >> >
> >> >> Check with DebugDiag.
> >> >>
> >> >> Debug Diagnostic Tool v1.1
> >> >> The Debug Diagnostic Tool (DebugDiag) is designed to assist in
> >> >> troubleshooting issues such as hangs, slow performance, memory leaks
> >> >> or fragmentation, and crashes in any Win32 user-mode process. The tool
> >> >> includes additional debugging scripts focused on Internet Information
> >> >> Services (IIS) applications, web data access components, COM+ and
> >> >> related Microsoft technologies.
> >> >> http://www.microsoft.com/downloads/details.aspx?FamilyID=28B D5941-C458-46F1-B24D-F60151D875A3&displaylang=en
> >> >>
> >> >> ---
> >> >> hB
> >> >>
> >> >>
> >>
>

Re: w3wp.exe crash - reading dmp file

am 18.10.2007 19:33:40 von patfilot

The easiest way to look at them is to use WinDBG and open them one at a
time. If you type !analyze -v at the prompt, it will dump out the
stack for you.


Pat

"Rob" wrote in message
news:AE77D3D6-AB32-4456-B7B5-DE9CFA477F0A@microsoft.com...
> Thanks for your help so far Pat
>
> I got another crash this morning (no event log entries though?) when this
> happened I ran IISDump.exe and it generated 6 dmp files, I ran these
> through
> Debug Diagnostics and tried to post the output, which I can't as it's to
> long. This confirms I’m missing something so...
>
> I've got 6 dmp file with the following name
>
> Hang--8120_w3wp_SharePoint_-_ssp.abbeylegal.com.dmp
> Hang--7636_w3wp_DefaultAppPool.dmp
> Hang--6636_w3wp_SharePoint_Central_Administration_v3.dmp
> Hang--7240_inetinfo.dmp
> Hang--7328_svchost.dmp
> Hang--5208_dllhost_System_Application.dmp
>
> how do I find the failing thread stacks from the dump files?
>
>
> "Pat [MSFT]" wrote:
>
>> Can you post the failing thread stacks from the dump files?
>>
>> Pat
>> "Rob" wrote in message
>> news:EA0CE9D6-E979-4375-A65F-C644AF36F8F2@microsoft.com...
>> >i set this up to run and it's generated some dump files, even though the
>> > error hasn't occured in the event log. I analyze these is Debug
>> > Diagnostic
>> > but it doesn't report anything. Is IISDump.exe still running?
>> >
>> >
>> >
>> > "Pat [MSFT]" wrote:
>> >
>> >> You are hitting a memory corruption issue. Basically, some dll stomps
>> >> on
>> >> the memory and leaves it trashed, which is at some later time touched
>> >> and
>> >> a
>> >> crash ensues. If you enable PageHeap on the process, it will force a
>> >> crash
>> >> at the time of corruption & you can identify the culprit.
>> >>
>> >>
>> >> Pat
>> >>
>> >> "Rob" wrote in message
>> >> news:CE071B32-9290-4089-9088-83E76187497F@microsoft.com...
>> >> > excellent, thank you hB
>> >> >
>> >> > I installed and ran the analysis on my dump file and this is the
>> >> > result
>> >> >
>> >> > Error In
>> >> > inetinfo__PID__1520__Date__10_12_2007__Time_06_12_42AM__781_ _Second_Chance_Exception_C0000005.dmp
>> >> > the assembly instruction at ntdll!RtlpWaitOnCriticalSection+df in
>> >> > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused
>> >> > an
>> >> > access
>> >> > violation exception (0xC0000005) when trying to write to memory
>> >> > location
>> >> > 0x00000014 on thread 21
>> >> > Please follow up with the vendor Microsoft Corporation for
>> >> > C:\WINDOWS\system32\ntdll.dll
>> >> >
>> >> > Error In
>> >> > w3wp__PID__7744__Date__10_12_2007__Time_01_05_25AM__296__Sec ond_Chance_Exception_C0000005.dmp
>> >> > the assembly instruction at ntdll!RtlpCoalesceFreeBlocks+36e in
>> >> > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused
>> >> > an
>> >> > access
>> >> > violation exception (0xC0000005) when trying to read from memory
>> >> > location
>> >> > 0x00000000 on thread 0
>> >> >
>> >> > Heap corruption was detected in heap 0x00700000, however pageheap
>> >> > was
>> >> > not
>> >> > enabled in this dump. Please follow the instructions in the
>> >> > recommendation
>> >> > section for troubleshooting heap corruption issues.
>> >> >
>> >> > Current NTGlobalFlags value: 0x0 An access violation exception
>> >> > thrown
>> >> > by a
>> >> > heap memory manager function indicates heap corruption. Please
>> >> > follow
>> >> > the
>> >> > steps outlined in the following Knowledge Base article:
>> >> >
>> >> > 300966 Howto debug heap corruption issues in Internet Information
>> >> > Services
>> >> > (IIS)
>> >> > Error In
>> >> > dllhost__PID__7356__Date__10_12_2007__Time_01_05_41AM__796__ Second_Chance_Exception_C0000005.dmp
>> >> > the assembly instruction at ntdll!RtlFindCharInUnicodeString+3d in
>> >> > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused
>> >> > an
>> >> > access
>> >> > violation exception (0xC0000005) when trying to write to memory
>> >> > location
>> >> > 0x009b0ffc on thread 2
>> >> > Please follow up with the vendor Microsoft Corporation for
>> >> > C:\WINDOWS\system32\ntdll.dll
>> >> >
>> >> > Error In
>> >> > w3wp__PID__7140__Date__10_11_2007__Time_06_57_59PM__406__Sec ond_Chance_Exception_C0000005.dmp
>> >> > the assembly instruction at ntdll!RtlEnterCriticalSection+31 in
>> >> > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused
>> >> > an
>> >> > access
>> >> > violation exception (0xC0000005) when trying to read from memory
>> >> > location
>> >> > 0x00000024 on thread 16
>> >> > Please follow up with the vendor Microsoft Corporation for
>> >> > C:\WINDOWS\system32\ntdll.dll
>> >> >
>> >> > Error In
>> >> > w3wp__PID__7484__Date__10_11_2007__Time_09_30_00PM__984__Sec ond_Chance_Exception_C0000005.dmp
>> >> > the assembly instruction at mscorwks!SVR::gc_heap::plan_phase+529 in
>> >> > C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll from
>> >> > Microsoft
>> >> > Corporation has caused an access violation exception (0xC0000005)
>> >> > when
>> >> > trying
>> >> > to read from memory location 0x00000000 on thread 22
>> >> > Please follow up with the vendor Microsoft Corporation for
>> >> > C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
>> >> >
>> >> > i'm following the KB on the heap corruption entry, anyone offer any
>> >> > thoughts
>> >> > or opinions?
>> >> >
>> >> >
>> >> > "hB" wrote:
>> >> >
>> >> >> Check with DebugDiag.
>> >> >>
>> >> >> Debug Diagnostic Tool v1.1
>> >> >> The Debug Diagnostic Tool (DebugDiag) is designed to assist in
>> >> >> troubleshooting issues such as hangs, slow performance, memory
>> >> >> leaks
>> >> >> or fragmentation, and crashes in any Win32 user-mode process. The
>> >> >> tool
>> >> >> includes additional debugging scripts focused on Internet
>> >> >> Information
>> >> >> Services (IIS) applications, web data access components, COM+ and
>> >> >> related Microsoft technologies.
>> >> >> http://www.microsoft.com/downloads/details.aspx?FamilyID=28B D5941-C458-46F1-B24D-F60151D875A3&displaylang=en
>> >> >>
>> >> >> ---
>> >> >> hB
>> >> >>
>> >> >>
>> >>
>>

Re: w3wp.exe crash - reading dmp file

am 19.10.2007 11:16:48 von Rob

Ok, I installed WinDbg, set the Symbol Search path to

set
_NT_SYMBOL_PATH=srv*DownstreamStore*http://msdl.microsoft.co m/download/symbols

and loaded the dmp file, I choose the second_chance_exception file from the
initial debug diagnostic monitoring as that’s the one that said an access
violation exception was thrown.

I ran the statement and here’s the output, however it did say that my
debugger is not using the correct symbols so does this make the output
invalid?

Here is the output…


FAULTING_IP:
ntdll!wcslen+1d6
7c82a754 8b09 mov ecx,dword ptr [ecx]

EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 7c82a754 (ntdll!wcslen+0x000001d6)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000000
Attempt to read from address 00000000

DEFAULT_BUCKET_ID: WRONG_SYMBOLS

PROCESS_NAME: w3wp.exe

MODULE_NAME: iisutil

FAULTING_MODULE: 7c800000 ntdll

DEBUG_FLR_IMAGE_TIMESTAMP: 45d70a58

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced
memory at "0x%08lx". The memory could not be "%s".

READ_ADDRESS: 00000000

BUGCHECK_STR: ACCESS_VIOLATION

MANAGED_STACK: !dumpstack -EE
OS Thread Id: 0x1e38 (0)
Current frame:
ChildEBP RetAddr Caller,Callee

LAST_CONTROL_TRANSFER: from 7c82a82b to 7c82a754

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be
wrong.
0006fb14 7c82a82b 012b0048 00000000 0006fbdc ntdll!wcslen+0x1d6
0006fbfc 6470f012 00700000 00000000 01537080 ntdll!wcslen+0x2ad
0006fc18 647115a2 01537080 0006fc4c 6471882e
iisutil!CDataCache::_SetSequence+0x22
0006fc24 6471882e 01537080 00647430 00647418
iisutil!CLKRLinearHashTable::_FreeSegment+0x20
0006fc4c 64718961 00000000 00000001 00647418
iisutil!CLKRLinearHashTable::_Clear+0xd8
0006fc68 647189c2 00000001 0006fc90 647189e5
iisutil!CLKRLinearHashTable::~CLKRLinearHashTable+0x19
0006fc74 647189e5 00647418 00000000 0026bb28
iisutil!CLKRHashTable::_FreeSubTable+0x13
0006fc90 5a403439 00000001 00264ed8 5a4038f8
iisutil!CLKRHashTable::~CLKRHashTable+0x18
0006fcb4 5a3bc347 00000000 01001418 010013e4
w3cache!OBJECT_CACHE::OBJECT_CACHE+0x3ab
0006ff0c 0100187c 00000005 00263a70 00000000 w3core!UlW3Start+0x280
0006ff44 01001a27 00000005 00263a70 00264378 w3wp+0x187c
0006ffc0 77e6f23b 00000000 00000000 7ffdd000 w3wp+0x1a27
0006fff0 00000000 010018f8 00000000 78746341
kernel32!ProcessIdToSessionId+0x209


STACK_COMMAND: ~0s; .ecxr ; kb

FAULTING_THREAD: 00001e38

FOLLOWUP_IP:
iisutil!CDataCache::_SetSequence+22
6470f012 8d4638 lea eax,[esi+38h]

SYMBOL_STACK_INDEX: 2

SYMBOL_NAME: iisutil!CDataCache::_SetSequence+22

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: iisutil.dll

BUCKET_ID: WRONG_SYMBOLS

FAILURE_BUCKET_ID: iisutil.dll!base_address_c0000005_WRONG_SYMBOLS

Followup: MachineOwner



"Pat [MSFT]" wrote:

> The easiest way to look at them is to use WinDBG and open them one at a
> time. If you type !analyze -v at the prompt, it will dump out the
> stack for you.
>
>
> Pat
>
> "Rob" wrote in message
> news:AE77D3D6-AB32-4456-B7B5-DE9CFA477F0A@microsoft.com...
> > Thanks for your help so far Pat
> >
> > I got another crash this morning (no event log entries though?) when this
> > happened I ran IISDump.exe and it generated 6 dmp files, I ran these
> > through
> > Debug Diagnostics and tried to post the output, which I can't as it's to
> > long. This confirms I’m missing something so...
> >
> > I've got 6 dmp file with the following name
> >
> > Hang--8120_w3wp_SharePoint_-_ssp.abbeylegal.com.dmp
> > Hang--7636_w3wp_DefaultAppPool.dmp
> > Hang--6636_w3wp_SharePoint_Central_Administration_v3.dmp
> > Hang--7240_inetinfo.dmp
> > Hang--7328_svchost.dmp
> > Hang--5208_dllhost_System_Application.dmp
> >
> > how do I find the failing thread stacks from the dump files?
> >
> >
> > "Pat [MSFT]" wrote:
> >
> >> Can you post the failing thread stacks from the dump files?
> >>
> >> Pat
> >> "Rob" wrote in message
> >> news:EA0CE9D6-E979-4375-A65F-C644AF36F8F2@microsoft.com...
> >> >i set this up to run and it's generated some dump files, even though the
> >> > error hasn't occured in the event log. I analyze these is Debug
> >> > Diagnostic
> >> > but it doesn't report anything. Is IISDump.exe still running?
> >> >
> >> >
> >> >
> >> > "Pat [MSFT]" wrote:
> >> >
> >> >> You are hitting a memory corruption issue. Basically, some dll stomps
> >> >> on
> >> >> the memory and leaves it trashed, which is at some later time touched
> >> >> and
> >> >> a
> >> >> crash ensues. If you enable PageHeap on the process, it will force a
> >> >> crash
> >> >> at the time of corruption & you can identify the culprit.
> >> >>
> >> >>
> >> >> Pat
> >> >>
> >> >> "Rob" wrote in message
> >> >> news:CE071B32-9290-4089-9088-83E76187497F@microsoft.com...
> >> >> > excellent, thank you hB
> >> >> >
> >> >> > I installed and ran the analysis on my dump file and this is the
> >> >> > result
> >> >> >
> >> >> > Error In
> >> >> > inetinfo__PID__1520__Date__10_12_2007__Time_06_12_42AM__781_ _Second_Chance_Exception_C0000005.dmp
> >> >> > the assembly instruction at ntdll!RtlpWaitOnCriticalSection+df in
> >> >> > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused
> >> >> > an
> >> >> > access
> >> >> > violation exception (0xC0000005) when trying to write to memory
> >> >> > location
> >> >> > 0x00000014 on thread 21
> >> >> > Please follow up with the vendor Microsoft Corporation for
> >> >> > C:\WINDOWS\system32\ntdll.dll
> >> >> >
> >> >> > Error In
> >> >> > w3wp__PID__7744__Date__10_12_2007__Time_01_05_25AM__296__Sec ond_Chance_Exception_C0000005.dmp
> >> >> > the assembly instruction at ntdll!RtlpCoalesceFreeBlocks+36e in
> >> >> > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused
> >> >> > an
> >> >> > access
> >> >> > violation exception (0xC0000005) when trying to read from memory
> >> >> > location
> >> >> > 0x00000000 on thread 0
> >> >> >
> >> >> > Heap corruption was detected in heap 0x00700000, however pageheap
> >> >> > was
> >> >> > not
> >> >> > enabled in this dump. Please follow the instructions in the
> >> >> > recommendation
> >> >> > section for troubleshooting heap corruption issues.
> >> >> >
> >> >> > Current NTGlobalFlags value: 0x0 An access violation exception
> >> >> > thrown
> >> >> > by a
> >> >> > heap memory manager function indicates heap corruption. Please
> >> >> > follow
> >> >> > the
> >> >> > steps outlined in the following Knowledge Base article:
> >> >> >
> >> >> > 300966 Howto debug heap corruption issues in Internet Information
> >> >> > Services
> >> >> > (IIS)
> >> >> > Error In
> >> >> > dllhost__PID__7356__Date__10_12_2007__Time_01_05_41AM__796__ Second_Chance_Exception_C0000005.dmp
> >> >> > the assembly instruction at ntdll!RtlFindCharInUnicodeString+3d in
> >> >> > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused
> >> >> > an
> >> >> > access
> >> >> > violation exception (0xC0000005) when trying to write to memory
> >> >> > location
> >> >> > 0x009b0ffc on thread 2
> >> >> > Please follow up with the vendor Microsoft Corporation for
> >> >> > C:\WINDOWS\system32\ntdll.dll
> >> >> >
> >> >> > Error In
> >> >> > w3wp__PID__7140__Date__10_11_2007__Time_06_57_59PM__406__Sec ond_Chance_Exception_C0000005.dmp
> >> >> > the assembly instruction at ntdll!RtlEnterCriticalSection+31 in
> >> >> > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused
> >> >> > an
> >> >> > access
> >> >> > violation exception (0xC0000005) when trying to read from memory
> >> >> > location
> >> >> > 0x00000024 on thread 16
> >> >> > Please follow up with the vendor Microsoft Corporation for
> >> >> > C:\WINDOWS\system32\ntdll.dll
> >> >> >
> >> >> > Error In
> >> >> > w3wp__PID__7484__Date__10_11_2007__Time_09_30_00PM__984__Sec ond_Chance_Exception_C0000005.dmp
> >> >> > the assembly instruction at mscorwks!SVR::gc_heap::plan_phase+529 in
> >> >> > C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll from
> >> >> > Microsoft
> >> >> > Corporation has caused an access violation exception (0xC0000005)
> >> >> > when
> >> >> > trying
> >> >> > to read from memory location 0x00000000 on thread 22
> >> >> > Please follow up with the vendor Microsoft Corporation for
> >> >> > C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
> >> >> >
> >> >> > i'm following the KB on the heap corruption entry, anyone offer any
> >> >> > thoughts
> >> >> > or opinions?
> >> >> >
> >> >> >
> >> >> > "hB" wrote:
> >> >> >
> >> >> >> Check with DebugDiag.
> >> >> >>
> >> >> >> Debug Diagnostic Tool v1.1
> >> >> >> The Debug Diagnostic Tool (DebugDiag) is designed to assist in
> >> >> >> troubleshooting issues such as hangs, slow performance, memory
> >> >> >> leaks
> >> >> >> or fragmentation, and crashes in any Win32 user-mode process. The
> >> >> >> tool
> >> >> >> includes additional debugging scripts focused on Internet
> >> >> >> Information
> >> >> >> Services (IIS) applications, web data access components, COM+ and
> >> >> >> related Microsoft technologies.
> >> >> >> http://www.microsoft.com/downloads/details.aspx?FamilyID=28B D5941-C458-46F1-B24D-F60151D875A3&displaylang=en
> >> >> >>
> >> >> >> ---
> >> >> >> hB
> >> >> >>
> >> >> >>
> >> >>
> >>
>

Re: w3wp.exe crash - reading dmp file

am 19.10.2007 18:42:38 von patfilot

So this is a crash possibly caused by IISUTIL.dll, which would be an IIS
bug. However, when using PageHeap for debugging you should look at first
chance exceptions. If the corruption occurred during a Try/Catch block then
you would be seeing the effect of the corruption & not the corruption itself
if only the 2nd chance dumps are reviewed.


Pat

"Rob" wrote in message
news:990E6E71-0599-46CA-A5A0-747CD644BDB9@microsoft.com...
> Ok, I installed WinDbg, set the Symbol Search path to
>
> set
> _NT_SYMBOL_PATH=srv*DownstreamStore*http://msdl.microsoft.co m/download/symbols
>
> and loaded the dmp file, I choose the second_chance_exception file from
> the
> initial debug diagnostic monitoring as that’s the one that said an access
> violation exception was thrown.
>
> I ran the statement and here’s the output, however it did say that my
> debugger is not using the correct symbols so does this make the output
> invalid?
>
> Here is the output…
>
>
> FAULTING_IP:
> ntdll!wcslen+1d6
> 7c82a754 8b09 mov ecx,dword ptr [ecx]
>
> EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
> ExceptionAddress: 7c82a754 (ntdll!wcslen+0x000001d6)
> ExceptionCode: c0000005 (Access violation)
> ExceptionFlags: 00000000
> NumberParameters: 2
> Parameter[0]: 00000000
> Parameter[1]: 00000000
> Attempt to read from address 00000000
>
> DEFAULT_BUCKET_ID: WRONG_SYMBOLS
>
> PROCESS_NAME: w3wp.exe
>
> MODULE_NAME: iisutil
>
> FAULTING_MODULE: 7c800000 ntdll
>
> DEBUG_FLR_IMAGE_TIMESTAMP: 45d70a58
>
> ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
> referenced
> memory at "0x%08lx". The memory could not be "%s".
>
> READ_ADDRESS: 00000000
>
> BUGCHECK_STR: ACCESS_VIOLATION
>
> MANAGED_STACK: !dumpstack -EE
> OS Thread Id: 0x1e38 (0)
> Current frame:
> ChildEBP RetAddr Caller,Callee
>
> LAST_CONTROL_TRANSFER: from 7c82a82b to 7c82a754
>
> STACK_TEXT:
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> 0006fb14 7c82a82b 012b0048 00000000 0006fbdc ntdll!wcslen+0x1d6
> 0006fbfc 6470f012 00700000 00000000 01537080 ntdll!wcslen+0x2ad
> 0006fc18 647115a2 01537080 0006fc4c 6471882e
> iisutil!CDataCache::_SetSequence+0x22
> 0006fc24 6471882e 01537080 00647430 00647418
> iisutil!CLKRLinearHashTable::_FreeSegment+0x20
> 0006fc4c 64718961 00000000 00000001 00647418
> iisutil!CLKRLinearHashTable::_Clear+0xd8
> 0006fc68 647189c2 00000001 0006fc90 647189e5
> iisutil!CLKRLinearHashTable::~CLKRLinearHashTable+0x19
> 0006fc74 647189e5 00647418 00000000 0026bb28
> iisutil!CLKRHashTable::_FreeSubTable+0x13
> 0006fc90 5a403439 00000001 00264ed8 5a4038f8
> iisutil!CLKRHashTable::~CLKRHashTable+0x18
> 0006fcb4 5a3bc347 00000000 01001418 010013e4
> w3cache!OBJECT_CACHE::OBJECT_CACHE+0x3ab
> 0006ff0c 0100187c 00000005 00263a70 00000000 w3core!UlW3Start+0x280
> 0006ff44 01001a27 00000005 00263a70 00264378 w3wp+0x187c
> 0006ffc0 77e6f23b 00000000 00000000 7ffdd000 w3wp+0x1a27
> 0006fff0 00000000 010018f8 00000000 78746341
> kernel32!ProcessIdToSessionId+0x209
>
>
> STACK_COMMAND: ~0s; .ecxr ; kb
>
> FAULTING_THREAD: 00001e38
>
> FOLLOWUP_IP:
> iisutil!CDataCache::_SetSequence+22
> 6470f012 8d4638 lea eax,[esi+38h]
>
> SYMBOL_STACK_INDEX: 2
>
> SYMBOL_NAME: iisutil!CDataCache::_SetSequence+22
>
> FOLLOWUP_NAME: MachineOwner
>
> IMAGE_NAME: iisutil.dll
>
> BUCKET_ID: WRONG_SYMBOLS
>
> FAILURE_BUCKET_ID: iisutil.dll!base_address_c0000005_WRONG_SYMBOLS
>
> Followup: MachineOwner
>
>
>
> "Pat [MSFT]" wrote:
>
>> The easiest way to look at them is to use WinDBG and open them one at a
>> time. If you type !analyze -v at the prompt, it will dump out
>> the
>> stack for you.
>>
>>
>> Pat
>>
>> "Rob" wrote in message
>> news:AE77D3D6-AB32-4456-B7B5-DE9CFA477F0A@microsoft.com...
>> > Thanks for your help so far Pat
>> >
>> > I got another crash this morning (no event log entries though?) when
>> > this
>> > happened I ran IISDump.exe and it generated 6 dmp files, I ran these
>> > through
>> > Debug Diagnostics and tried to post the output, which I can't as it's
>> > to
>> > long. This confirms I’m missing something so...
>> >
>> > I've got 6 dmp file with the following name
>> >
>> > Hang--8120_w3wp_SharePoint_-_ssp.abbeylegal.com.dmp
>> > Hang--7636_w3wp_DefaultAppPool.dmp
>> > Hang--6636_w3wp_SharePoint_Central_Administration_v3.dmp
>> > Hang--7240_inetinfo.dmp
>> > Hang--7328_svchost.dmp
>> > Hang--5208_dllhost_System_Application.dmp
>> >
>> > how do I find the failing thread stacks from the dump files?
>> >
>> >
>> > "Pat [MSFT]" wrote:
>> >
>> >> Can you post the failing thread stacks from the dump files?
>> >>
>> >> Pat
>> >> "Rob" wrote in message
>> >> news:EA0CE9D6-E979-4375-A65F-C644AF36F8F2@microsoft.com...
>> >> >i set this up to run and it's generated some dump files, even though
>> >> >the
>> >> > error hasn't occured in the event log. I analyze these is Debug
>> >> > Diagnostic
>> >> > but it doesn't report anything. Is IISDump.exe still running?
>> >> >
>> >> >
>> >> >
>> >> > "Pat [MSFT]" wrote:
>> >> >
>> >> >> You are hitting a memory corruption issue. Basically, some dll
>> >> >> stomps
>> >> >> on
>> >> >> the memory and leaves it trashed, which is at some later time
>> >> >> touched
>> >> >> and
>> >> >> a
>> >> >> crash ensues. If you enable PageHeap on the process, it will force
>> >> >> a
>> >> >> crash
>> >> >> at the time of corruption & you can identify the culprit.
>> >> >>
>> >> >>
>> >> >> Pat
>> >> >>
>> >> >> "Rob" wrote in message
>> >> >> news:CE071B32-9290-4089-9088-83E76187497F@microsoft.com...
>> >> >> > excellent, thank you hB
>> >> >> >
>> >> >> > I installed and ran the analysis on my dump file and this is the
>> >> >> > result
>> >> >> >
>> >> >> > Error In
>> >> >> > inetinfo__PID__1520__Date__10_12_2007__Time_06_12_42AM__781_ _Second_Chance_Exception_C0000005.dmp
>> >> >> > the assembly instruction at ntdll!RtlpWaitOnCriticalSection+df in
>> >> >> > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has
>> >> >> > caused
>> >> >> > an
>> >> >> > access
>> >> >> > violation exception (0xC0000005) when trying to write to memory
>> >> >> > location
>> >> >> > 0x00000014 on thread 21
>> >> >> > Please follow up with the vendor Microsoft Corporation for
>> >> >> > C:\WINDOWS\system32\ntdll.dll
>> >> >> >
>> >> >> > Error In
>> >> >> > w3wp__PID__7744__Date__10_12_2007__Time_01_05_25AM__296__Sec ond_Chance_Exception_C0000005.dmp
>> >> >> > the assembly instruction at ntdll!RtlpCoalesceFreeBlocks+36e in
>> >> >> > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has
>> >> >> > caused
>> >> >> > an
>> >> >> > access
>> >> >> > violation exception (0xC0000005) when trying to read from memory
>> >> >> > location
>> >> >> > 0x00000000 on thread 0
>> >> >> >
>> >> >> > Heap corruption was detected in heap 0x00700000, however pageheap
>> >> >> > was
>> >> >> > not
>> >> >> > enabled in this dump. Please follow the instructions in the
>> >> >> > recommendation
>> >> >> > section for troubleshooting heap corruption issues.
>> >> >> >
>> >> >> > Current NTGlobalFlags value: 0x0 An access violation exception
>> >> >> > thrown
>> >> >> > by a
>> >> >> > heap memory manager function indicates heap corruption. Please
>> >> >> > follow
>> >> >> > the
>> >> >> > steps outlined in the following Knowledge Base article:
>> >> >> >
>> >> >> > 300966 Howto debug heap corruption issues in Internet Information
>> >> >> > Services
>> >> >> > (IIS)
>> >> >> > Error In
>> >> >> > dllhost__PID__7356__Date__10_12_2007__Time_01_05_41AM__796__ Second_Chance_Exception_C0000005.dmp
>> >> >> > the assembly instruction at ntdll!RtlFindCharInUnicodeString+3d
>> >> >> > in
>> >> >> > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has
>> >> >> > caused
>> >> >> > an
>> >> >> > access
>> >> >> > violation exception (0xC0000005) when trying to write to memory
>> >> >> > location
>> >> >> > 0x009b0ffc on thread 2
>> >> >> > Please follow up with the vendor Microsoft Corporation for
>> >> >> > C:\WINDOWS\system32\ntdll.dll
>> >> >> >
>> >> >> > Error In
>> >> >> > w3wp__PID__7140__Date__10_11_2007__Time_06_57_59PM__406__Sec ond_Chance_Exception_C0000005.dmp
>> >> >> > the assembly instruction at ntdll!RtlEnterCriticalSection+31 in
>> >> >> > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has
>> >> >> > caused
>> >> >> > an
>> >> >> > access
>> >> >> > violation exception (0xC0000005) when trying to read from memory
>> >> >> > location
>> >> >> > 0x00000024 on thread 16
>> >> >> > Please follow up with the vendor Microsoft Corporation for
>> >> >> > C:\WINDOWS\system32\ntdll.dll
>> >> >> >
>> >> >> > Error In
>> >> >> > w3wp__PID__7484__Date__10_11_2007__Time_09_30_00PM__984__Sec ond_Chance_Exception_C0000005.dmp
>> >> >> > the assembly instruction at mscorwks!SVR::gc_heap::plan_phase+529
>> >> >> > in
>> >> >> > C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll from
>> >> >> > Microsoft
>> >> >> > Corporation has caused an access violation exception (0xC0000005)
>> >> >> > when
>> >> >> > trying
>> >> >> > to read from memory location 0x00000000 on thread 22
>> >> >> > Please follow up with the vendor Microsoft Corporation for
>> >> >> > C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
>> >> >> >
>> >> >> > i'm following the KB on the heap corruption entry, anyone offer
>> >> >> > any
>> >> >> > thoughts
>> >> >> > or opinions?
>> >> >> >
>> >> >> >
>> >> >> > "hB" wrote:
>> >> >> >
>> >> >> >> Check with DebugDiag.
>> >> >> >>
>> >> >> >> Debug Diagnostic Tool v1.1
>> >> >> >> The Debug Diagnostic Tool (DebugDiag) is designed to assist in
>> >> >> >> troubleshooting issues such as hangs, slow performance, memory
>> >> >> >> leaks
>> >> >> >> or fragmentation, and crashes in any Win32 user-mode process.
>> >> >> >> The
>> >> >> >> tool
>> >> >> >> includes additional debugging scripts focused on Internet
>> >> >> >> Information
>> >> >> >> Services (IIS) applications, web data access components, COM+
>> >> >> >> and
>> >> >> >> related Microsoft technologies.
>> >> >> >> http://www.microsoft.com/downloads/details.aspx?FamilyID=28B D5941-C458-46F1-B24D-F60151D875A3&displaylang=en
>> >> >> >>
>> >> >> >> ---
>> >> >> >> hB
>> >> >> >>
>> >> >> >>
>> >> >>
>> >>
>>

Re: w3wp.exe crash - reading dmp file

am 23.10.2007 10:24:01 von Rob

ok, I think it's unlikely to be an IIS issue. I’ve looked and can’t see a
first chance exception file, is there a way to capture this with Debug
Diagnostics? I’ve have ExitProcess, ProcessList and Hang files.

My website has some SMTP functionality (in a Try/Catch block) and also some
redirection logic depending on server variables. I think I should look at
this code in more detail, it passed testing procedures ok but it’s the only
custom logic in the site.

I’ve also noticed that the IISCrashHangAgent is still running on the
w3wp.exe process, even though I have disabled page heap, do you know how to
‘unhook’ this?

Lastly here’s another second chance exception file, slightly different this
one so I thought I’d include it.


FAULTING_IP:
w3cache!OBJECT_CACHE::CacheFlushByTTL+9
5a402177 8b06 mov eax,dword ptr [esi]

EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 5a402177 (w3cache!OBJECT_CACHE::CacheFlushByTTL+0x00000009)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000000
Attempt to read from address 00000000

DEFAULT_BUCKET_ID: NULL_POINTER_READ

PROCESS_NAME: w3wp.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced
memory at "0x%08lx". The memory could not be "%s".

READ_ADDRESS: 00000000

NTGLOBALFLAG: 0

APPLICATION_VERIFIER_FLAGS: 0

MANAGED_STACK: !dumpstack -EE
OS Thread Id: 0xa60 (64)
Current frame:
ChildEBP RetAddr Caller,Callee

LAST_CONTROL_TRANSFER: from 5a401fb9 to 5a402177

STACK_TEXT:
2d1cfdc4 5a401fb9 00000000 2d1cfe64 2d1cfe04
w3cache!OBJECT_CACHE::CacheFlushByTTL+0x9
2d1cfdd4 6470fee3 00000000 2d1cfe38 0000000e
w3cache!CTypedHashTable *,CLKRHashTable>::_Pred+0x10
2d1cfe04 6470fe23 5a401fa9 2d1cfe38 2d1cfe24
iisutil!CLKRLinearHashTable::_DeleteIf+0x7d
2d1cfe28 5a401f75 5a401fa9 2d1cfe38 5a40216e
iisutil!CLKRHashTable::DeleteIf+0x4c
2d1cfe44 5a40203f 5a40216e 2d1cfe64 5a401fc2
w3cache!CTypedHashTable *,CLKRHashTable>::DeleteIf+0x2b
2d1cfe58 5a401fdb 2d1cfe64 2d1cfe64 2d1cfe64
w3cache!OBJECT_CACHE::FlushByTTL+0x1d
2d1cfe6c 7c83ac3c 00269ea8 00000001 000ab2f8
w3cache!OBJECT_CACHE::ScavengerCallback+0x19
2d1cfec8 7c83e4a8 5a401fc2 00269ea8 00000001 ntdll!RtlpWaitOrTimerCallout+0x74
2d1cfeec 7c83a827 000ab2f8 7c889080 24a3bde8
ntdll!RtlpAsyncTimerCallbackCompletion+0x2d
2d1cff44 7c83aa0b 7c83e47b 000ab2f8 00000000 ntdll!RtlpWorkerCallout+0x71
2d1cff64 7c83aa82 00000000 000ab2f8 24a3bde8
ntdll!RtlpExecuteWorkerRequest+0x4f
2d1cff78 7c839f60 7c83a9ca 00000000 000ab2f8 ntdll!RtlpApcCallout+0x11
2d1cffb8 77e64829 00000000 00000000 00000000 ntdll!RtlpWorkerThread+0x61
2d1cffec 00000000 7c839efb 00000000 00000000 kernel32!BaseThreadStart+0x34


FAULTING_THREAD: 00000a60

PRIMARY_PROBLEM_CLASS: NULL_POINTER_READ

BUGCHECK_STR: APPLICATION_FAULT_NULL_POINTER_READ

FOLLOWUP_IP:
w3cache!OBJECT_CACHE::CacheFlushByTTL+9
5a402177 8b06 mov eax,dword ptr [esi]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: w3cache!OBJECT_CACHE::CacheFlushByTTL+9

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: w3cache

IMAGE_NAME: w3cache.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 45d70ac2

STACK_COMMAND: ~64s; .ecxr ; kb

FAILURE_BUCKET_ID:
w3cache.dll!OBJECT_CACHE::CacheFlushByTTL_c0000005_NULL_POIN TER_READ

BUCKET_ID:
APPLICATION_FAULT_NULL_POINTER_READ_w3cache!OBJECT_CACHE::Ca cheFlushByTTL+9

Followup: MachineOwner

"Pat [MSFT]" wrote:

> So this is a crash possibly caused by IISUTIL.dll, which would be an IIS
> bug. However, when using PageHeap for debugging you should look at first
> chance exceptions. If the corruption occurred during a Try/Catch block then
> you would be seeing the effect of the corruption & not the corruption itself
> if only the 2nd chance dumps are reviewed.
>
>
> Pat
>
> "Rob" wrote in message
> news:990E6E71-0599-46CA-A5A0-747CD644BDB9@microsoft.com...
> > Ok, I installed WinDbg, set the Symbol Search path to
> >
> > set
> > _NT_SYMBOL_PATH=srv*DownstreamStore*http://msdl.microsoft.co m/download/symbols
> >
> > and loaded the dmp file, I choose the second_chance_exception file from
> > the
> > initial debug diagnostic monitoring as that’s the one that said an access
> > violation exception was thrown.
> >
> > I ran the statement and here’s the output, however it did say that my
> > debugger is not using the correct symbols so does this make the output
> > invalid?
> >
> > Here is the output…
> >
> >
> > FAULTING_IP:
> > ntdll!wcslen+1d6
> > 7c82a754 8b09 mov ecx,dword ptr [ecx]
> >
> > EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
> > ExceptionAddress: 7c82a754 (ntdll!wcslen+0x000001d6)
> > ExceptionCode: c0000005 (Access violation)
> > ExceptionFlags: 00000000
> > NumberParameters: 2
> > Parameter[0]: 00000000
> > Parameter[1]: 00000000
> > Attempt to read from address 00000000
> >
> > DEFAULT_BUCKET_ID: WRONG_SYMBOLS
> >
> > PROCESS_NAME: w3wp.exe
> >
> > MODULE_NAME: iisutil
> >
> > FAULTING_MODULE: 7c800000 ntdll
> >
> > DEBUG_FLR_IMAGE_TIMESTAMP: 45d70a58
> >
> > ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
> > referenced
> > memory at "0x%08lx". The memory could not be "%s".
> >
> > READ_ADDRESS: 00000000
> >
> > BUGCHECK_STR: ACCESS_VIOLATION
> >
> > MANAGED_STACK: !dumpstack -EE
> > OS Thread Id: 0x1e38 (0)
> > Current frame:
> > ChildEBP RetAddr Caller,Callee
> >
> > LAST_CONTROL_TRANSFER: from 7c82a82b to 7c82a754
> >
> > STACK_TEXT:
> > WARNING: Stack unwind information not available. Following frames may be
> > wrong.
> > 0006fb14 7c82a82b 012b0048 00000000 0006fbdc ntdll!wcslen+0x1d6
> > 0006fbfc 6470f012 00700000 00000000 01537080 ntdll!wcslen+0x2ad
> > 0006fc18 647115a2 01537080 0006fc4c 6471882e
> > iisutil!CDataCache::_SetSequence+0x22
> > 0006fc24 6471882e 01537080 00647430 00647418
> > iisutil!CLKRLinearHashTable::_FreeSegment+0x20
> > 0006fc4c 64718961 00000000 00000001 00647418
> > iisutil!CLKRLinearHashTable::_Clear+0xd8
> > 0006fc68 647189c2 00000001 0006fc90 647189e5
> > iisutil!CLKRLinearHashTable::~CLKRLinearHashTable+0x19
> > 0006fc74 647189e5 00647418 00000000 0026bb28
> > iisutil!CLKRHashTable::_FreeSubTable+0x13
> > 0006fc90 5a403439 00000001 00264ed8 5a4038f8
> > iisutil!CLKRHashTable::~CLKRHashTable+0x18
> > 0006fcb4 5a3bc347 00000000 01001418 010013e4
> > w3cache!OBJECT_CACHE::OBJECT_CACHE+0x3ab
> > 0006ff0c 0100187c 00000005 00263a70 00000000 w3core!UlW3Start+0x280
> > 0006ff44 01001a27 00000005 00263a70 00264378 w3wp+0x187c
> > 0006ffc0 77e6f23b 00000000 00000000 7ffdd000 w3wp+0x1a27
> > 0006fff0 00000000 010018f8 00000000 78746341
> > kernel32!ProcessIdToSessionId+0x209
> >
> >
> > STACK_COMMAND: ~0s; .ecxr ; kb
> >
> > FAULTING_THREAD: 00001e38
> >
> > FOLLOWUP_IP:
> > iisutil!CDataCache::_SetSequence+22
> > 6470f012 8d4638 lea eax,[esi+38h]
> >
> > SYMBOL_STACK_INDEX: 2
> >
> > SYMBOL_NAME: iisutil!CDataCache::_SetSequence+22
> >
> > FOLLOWUP_NAME: MachineOwner
> >
> > IMAGE_NAME: iisutil.dll
> >
> > BUCKET_ID: WRONG_SYMBOLS
> >
> > FAILURE_BUCKET_ID: iisutil.dll!base_address_c0000005_WRONG_SYMBOLS
> >
> > Followup: MachineOwner
> >
> >
> >
> > "Pat [MSFT]" wrote:
> >
> >> The easiest way to look at them is to use WinDBG and open them one at a
> >> time. If you type !analyze -v at the prompt, it will dump out
> >> the
> >> stack for you.
> >>
> >>
> >> Pat
> >>
> >> "Rob" wrote in message
> >> news:AE77D3D6-AB32-4456-B7B5-DE9CFA477F0A@microsoft.com...
> >> > Thanks for your help so far Pat
> >> >
> >> > I got another crash this morning (no event log entries though?) when
> >> > this
> >> > happened I ran IISDump.exe and it generated 6 dmp files, I ran these
> >> > through
> >> > Debug Diagnostics and tried to post the output, which I can't as it's
> >> > to
> >> > long. This confirms I’m missing something so...
> >> >
> >> > I've got 6 dmp file with the following name
> >> >
> >> > Hang--8120_w3wp_SharePoint_-_ssp.abbeylegal.com.dmp
> >> > Hang--7636_w3wp_DefaultAppPool.dmp
> >> > Hang--6636_w3wp_SharePoint_Central_Administration_v3.dmp
> >> > Hang--7240_inetinfo.dmp
> >> > Hang--7328_svchost.dmp
> >> > Hang--5208_dllhost_System_Application.dmp
> >> >
> >> > how do I find the failing thread stacks from the dump files?
> >> >
> >> >
> >> > "Pat [MSFT]" wrote:
> >> >
> >> >> Can you post the failing thread stacks from the dump files?
> >> >>
> >> >> Pat
> >> >> "Rob" wrote in message
> >> >> news:EA0CE9D6-E979-4375-A65F-C644AF36F8F2@microsoft.com...
> >> >> >i set this up to run and it's generated some dump files, even though
> >> >> >the
> >> >> > error hasn't occured in the event log. I analyze these is Debug
> >> >> > Diagnostic
> >> >> > but it doesn't report anything. Is IISDump.exe still running?
> >> >> >
> >> >> >
> >> >> >
> >> >> > "Pat [MSFT]" wrote:
> >> >> >
> >> >> >> You are hitting a memory corruption issue. Basically, some dll
> >> >> >> stomps
> >> >> >> on
> >> >> >> the memory and leaves it trashed, which is at some later time
> >> >> >> touched
> >> >> >> and
> >> >> >> a
> >> >> >> crash ensues. If you enable PageHeap on the process, it will force
> >> >> >> a
> >> >> >> crash
> >> >> >> at the time of corruption & you can identify the culprit.
> >> >> >>
> >> >> >>
> >> >> >> Pat
> >> >> >>
> >> >> >> "Rob" wrote in message
> >> >> >> news:CE071B32-9290-4089-9088-83E76187497F@microsoft.com...
> >> >> >> > excellent, thank you hB
> >> >> >> >
> >> >> >> > I installed and ran the analysis on my dump file and this is the
> >> >> >> > result
> >> >> >> >
> >> >> >> > Error In
> >> >> >> > inetinfo__PID__1520__Date__10_12_2007__Time_06_12_42AM__781_ _Second_Chance_Exception_C0000005.dmp
> >> >> >> > the assembly instruction at ntdll!RtlpWaitOnCriticalSection+df in
> >> >> >> > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has
> >> >> >> > caused
> >> >> >> > an
> >> >> >> > access
> >> >> >> > violation exception (0xC0000005) when trying to write to memory
> >> >> >> > location
> >> >> >> > 0x00000014 on thread 21
> >> >> >> > Please follow up with the vendor Microsoft Corporation for
> >> >> >> > C:\WINDOWS\system32\ntdll.dll
> >> >> >> >
> >> >> >> > Error In
> >> >> >> > w3wp__PID__7744__Date__10_12_2007__Time_01_05_25AM__296__Sec ond_Chance_Exception_C0000005.dmp
> >> >> >> > the assembly instruction at ntdll!RtlpCoalesceFreeBlocks+36e in
> >> >> >> > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has
> >> >> >> > caused
> >> >> >> > an
> >> >> >> > access
> >> >> >> > violation exception (0xC0000005) when trying to read from memory
> >> >> >> > location
> >> >> >> > 0x00000000 on thread 0
> >> >> >> >
> >> >> >> > Heap corruption was detected in heap 0x00700000, however pageheap
> >> >> >> > was
> >> >> >> > not
> >> >> >> > enabled in this dump. Please follow the instructions in the
> >> >> >> > recommendation
> >> >> >> > section for troubleshooting heap corruption issues.
> >> >> >> >
> >> >> >> > Current NTGlobalFlags value: 0x0 An access violation exception
> >> >> >> > thrown
> >> >> >> > by a
> >> >> >> > heap memory manager function indicates heap corruption. Please
> >> >> >> > follow
> >> >> >> > the
> >> >> >> > steps outlined in the following Knowledge Base article:
> >> >> >> >
> >> >> >> > 300966 Howto debug heap corruption issues in Internet Information
> >> >> >> > Services
> >> >> >> > (IIS)
> >> >> >> > Error In
> >> >> >> > dllhost__PID__7356__Date__10_12_2007__Time_01_05_41AM__796__ Second_Chance_Exception_C0000005.dmp
> >> >> >> > the assembly instruction at ntdll!RtlFindCharInUnicodeString+3d
> >> >> >> > in
> >> >> >> > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has
> >> >> >> > caused
> >> >> >> > an
> >> >> >> > access
> >> >> >> > violation exception (0xC0000005) when trying to write to memory
> >> >> >> > location
> >> >> >> > 0x009b0ffc on thread 2
> >> >> >> > Please follow up with the vendor Microsoft Corporation for
> >> >> >> > C:\WINDOWS\system32\ntdll.dll
> >> >> >> >
> >> >> >> > Error In
> >> >> >> > w3wp__PID__7140__Date__10_11_2007__Time_06_57_59PM__406__Sec ond_Chance_Exception_C0000005.dmp
> >> >> >> > the assembly instruction at ntdll!RtlEnterCriticalSection+31 in
> >> >> >> > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has
> >> >> >> > caused
> >> >> >> > an
> >> >> >> > access
> >> >> >> > violation exception (0xC0000005) when trying to read from memory
> >> >> >> > location
> >> >> >> > 0x00000024 on thread 16
> >> >> >> > Please follow up with the vendor Microsoft Corporation for
> >> >> >> > C:\WINDOWS\system32\ntdll.dll
> >> >> >> >
> >> >> >> > Error In
> >> >> >> > w3wp__PID__7484__Date__10_11_2007__Time_09_30_00PM__984__Sec ond_Chance_Exception_C0000005.dmp
> >> >> >> > the assembly instruction at mscorwks!SVR::gc_heap::plan_phase+529
> >> >> >> > in
> >> >> >> > C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll from
> >> >> >> > Microsoft
> >> >> >> > Corporation has caused an access violation exception (0xC0000005)
> >> >> >> > when
> >> >> >> > trying
> >> >> >> > to read from memory location 0x00000000 on thread 22
> >> >> >> > Please follow up with the vendor Microsoft Corporation for
> >> >> >> > C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
> >> >> >> >
> >> >> >> > i'm following the KB on the heap corruption entry, anyone offer
> >> >> >> > any
> >> >> >> > thoughts
> >> >> >> > or opinions?
> >> >> >> >
> >> >> >> >
> >> >> >> > "hB" wrote:
> >> >> >> >
> >> >> >> >> Check with DebugDiag.
> >> >> >> >>
> >> >> >> >> Debug Diagnostic Tool v1.1
> >> >> >> >> The Debug Diagnostic Tool (DebugDiag) is designed to assist in
> >> >> >> >> troubleshooting issues such as hangs, slow performance, memory
> >> >> >> >> leaks
> >> >> >> >> or fragmentation, and crashes in any Win32 user-mode process.
> >> >> >> >> The
> >> >> >> >> tool
> >> >> >> >> includes additional debugging scripts focused on Internet
> >> >> >> >> Information
> >> >> >> >> Services (IIS) applications, web data access components, COM+
> >> >> >> >> and
> >> >> >> >> related Microsoft technologies.
> >> >> >> >> http://www.microsoft.com/downloads/details.aspx?FamilyID=28B D5941-C458-46F1-B24D-F60151D875A3&displaylang=en
> >> >> >> >>
> >> >> >> >> ---
> >> >> >> >> hB
> >> >> >> >>
> >> >> >> >>
> >> >> >>