9.0b3 Win10: Crash 0x05 on msxml3.dll after idle for minutes

[flizebogen]

The newest beta already crashed two times.

This time i got the windows message that Total Commander stopped working. In the eventlog i found this info:

Name der fehlerhaften Anwendung: TOTALCMD64.EXE, Version: 9.0.0.0, Zeitstempel: 0x00000000
Name des fehlerhaften Moduls: msxml3.dll_unloaded, Version: 8.110.10586.212, Zeitstempel: 0x56fa29c9
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000036e0
ID des fehlerhaften Prozesses: 0x1cfc
Startzeit der fehlerhaften Anwendung: 0x01d1d285f8e0714d
Pfad der fehlerhaften Anwendung: C:\Program Files (x86)\Totalcmd\TOTALCMD64.EXE
Pfad des fehlerhaften Moduls: msxml3.dll
Berichtskennung: 2b8447a3-c1e2-4463-a907-1a25ca47b235
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Client is windows 10 x64. Just before the crash the tc wasn't used for a couple of minutes.

[flizebogen]

If needed i can provide the dump file that windows created.

[Emalis.Reckah]

How about you post
WHAT YOU DID that leads to the crash?

[flizebogen]

The first time i was browsing the file system when TC crashes. It closed without any notice or crash dump.

This time i wasn't even using tc when the crash occurred. So i have no clue what leads to the crash.

[flizebogen]

Again the Crash

Nirsoft WinCrashReport provides the following infos:

Allgemeine Fehlerangaben:
Betriebssystem: Windows 10 Pro (6.3.10586)
Berichtzeit: 01.07.2016 10:38:05
Prozessdateiname: C:\Program Files (x86)\Totalcmd\TOTALCMD64.EXE
Prozess-ID: 5880
Thread-ID: 7920
Prozessbeschreibung: Total Commander
Prozessversion: 9.0.0.0
Prozesslieferant: Ghisler Software GmbH
Produktname: Total Commander
Produktversion:
Absturzadresse: 00000000`F33B4B86
Absturzadresse (relativ): ntdll.dll!RtlImageNtHeaderEx+0x56
Fehlercode: C0000005
Fehlerbeschreibung: Zugriffsverletzung - kein Zugriff auf 00000000`11B40000 Speicheradresse (Lesezugriff)
Fehlerparameter (1): 00000000`00000000
Fehlerparameter (2): 00000000`11B40000
Absturzcode Byte:
66 44 39 02 75 47 44 8B 42 3C 84 C9 75 26 41 81
F8 00 00 00 10 73 4D 4E 8D 14 02 4C 89 54 24 28
4C 3B D2 72 28 41 81 3A 50 45 00 00 75 1F 89 44
24 20 EB 3E 49 8B C8 4C 3B C3 73 18 41 83 F8 E7


Strings in der Stapel:
00000000`1F3CD278 00000000`1F3CD2A0 -> c:\w쀀￿￿ws\syste
00000000`1F3CE2E8 00000000`F0EF9770 -> USER32
00000000`1F3CE350 00000000`1F3CE3A0 -> 0000000
00000000`1F3CEAD8 00000000`DF2BA360 -> [Offline Share]
00000000`1F3CED28 00000000`E1FA7460 -> @USVWATAUAVAWH￾¬$ØûÿÿH￾ì(
00000000`1F3CF150 00000000`1F3CF100 -> UA
00000000`1F3CF188 00000000`1F3CF598 -> c:\windows\system32\imageres.dll

Abrufstapel (Methode 1):
00000000`1F3CEE70 00000000`004154B8 TOTALCMD64.EXE+0x154b8

The Crash Dump contains more infos. Eventlog speaks again about msxml3.dll but the dumps leads to another direction.

[tuska]

Are you using the latest version of Windows?

Hmm, mein Betriebssystem zeigt hier: Windows 10 Pro (10.0.10586) -
verwendest Du die aktuellste Windows Version?
Mehr kann ich dazu leider nicht beitragen, bin kein Profi.

[ghisler(Author)]

TC doesn't use msxml3.dll. In my checks with Process Explorer, it doesn't get loaded either.

So its either a plugin or an Explorer extension which causes your crash - or some windows component which tries to handle a specific file type. imageres.dll seems to be a Windows component for loading certain images.

TC loads file icons in a background thread, so if there is a problem, it may occur also when TC itself isn't busy. Try turning off icons in Configuration - Options - Icons to check whether the error goes away or not.

[Mucci]

Since I have disabled the following settings (in german) TC9 crashing has stopped.
www.mucciarelli.ch/TC_icon.jpg

[flizebogen]

Thanks for your tests. I changed my settings according your screenshot.

[ghisler(Author)]

Could you check which of the 3 entries is causing this?

This turns off OLE2 calls, so you may have a damaged/misconfigured OLE2 subsystem.

[Mucci]

I have tried to enable all three entries separate and tried to reproduce a crash ........no luck with that. Even after updating to B5 and enabled all 3 options again my TC has not crashed again.

That's strange, but I'm glad that it does not happen again.

It was the same on my installation, it crashed randomly. Changed folders, copied files or right clicked a file ....TC crashed with this eventlog id. I can not say "it was when you are doing this or that"

For me it is solved. Thanks for your the help.

[MarcinW]

In the second crash dump:

Exception is at address:
ntdll.dll!RtlImageNtHeaderEx+0x56

Code at this address is:
66 44 39 02 75 47 44 8B 42 3C 84 C9 75 26 41 81
F8 00 00 00 10 73 4D 4E 8D 14 02 4C 89 54 24 28
4C 3B D2 72 28 41 81 3A 50 45 00 00 75 1F 89 44
24 20 EB 3E 49 8B C8 4C 3B C3 73 18 41 83 F8 E7

When disassembled:

Code: Select all

mov     r8d, 'ZM'
cmp     [rdx], r8w
jnz     short loc_xxx
mov     r8d, [rdx+3Ch]
test    cl, cl
jnz     short loc_yyy
...

As we can see, this code checks for an executable 'MZ' signature at [rdx]. Rdx is a second parameter passed to the RtlImageNtHeaderEx call:

Code: Select all

NTSTATUS
NTAPI
RtlImageNtHeaderEx(
    ULONG Flags,
    PVOID Base,
    ULONG64 Size,
    OUT PIMAGE_NT_HEADERS * OutHeaders
    )

Second parameter is "Base". This means that an invalid module base address (invalid module handle) has been passed to the RtlImageNtHeaderEx call. Since description informs about access violation at 00000000`11B40000, this means that module at this address has already been unloaded earlier, before RtlImageNtHeaderEx call - or most probably asynchronously, in the meantime, by another thread.

To avoid such problems, module handles - before passing to another thread - should be duplicated by making an additional call to GetModuleFileName + LoadLibrary API functions.


TOTALCMD64.EXE+0x154b8 points to a return address from a SetLastError call in 64-bit TC beta3, so it seems to be an invalid stack trace; SetLastError is unlikely to cause any exception.


Maybe a TC thread, that reads and displays icons, tried to read an icon from some unloaded module? Maybe TC passes some already owned library handle to another thread, without making an additional call to GetModuleFileName + LoadLibrary (which increments the library reference counter and prevents the library from being unloaded prematurely)?

[flizebogen]

After changing the settings like mucci suggested i got another crash. So i guess the problem has nothing to do with the icon settings.

[ghisler(Author)]

Did you try to turn off icons completely via Configuration - Options - Icons?

If this helps, the next step will be to find out which icon is causing it...

[flizebogen]

No i didn't but on recent betas the error didn't show up again.

For me the issue is fixed.