Help debugging dump file from application crash

Avital Chissick said:

Hi all,

I'm developing a large application using Visual Studio 2008 using VB.NET,

with .NET Frameworks 2.0 .

The application also make extensive usage of the DevExpress controls suit.

Every now and then we get an application crash. Always with the same details

Windows reports Cabinet.Dll as the source of the crash.

This happens on Windows 7 only (in windows XP the application runs OK).

The crash occurs at different locations in the applications and we can't reproduce it.
At times it will repeat itself very often at a short period of time, and after that it won't happen for a while.

I used the adplus debugger to monitor a crash and get a dump by using the following command:

adplus -crash -pn app.exe -o c:\temp

I opened the dump file using WinDbg and used the following commands:
.loadby sos.dll mscorwks
!analyze -v

the results are pasted below.

I would appreciate any help with finding the source of the problem.

Thank you !

Code:

 
*****************************
 
 
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
 
*** WARNING: Unable to verify checksum for System.Windows.Forms.ni.dll
*** ERROR: Module load completed but symbols could not be loaded for XXXwizard.exe
*** WARNING: Unable to verify checksum for mscorlib.ni.dll
*** ERROR: Symbol file could not be found. Defaulted to export symbols for nvoglv32.dll - 
GetPageUrlData failed, server returned HTTP status 404
URL requested: http://watson.microsoft.com/StageOne...htm?Retriage=1
 
FAULTING_IP: 
cabinet!SetDecompressionType+e
6d3615a4 663bbeb2000000 cmp di,word ptr [esi+0B2h]
 
EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 6d3615a4 (cabinet!SetDecompressionType+0x0000000e)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 000000b1
Attempt to read from address 000000b1
 
PROCESS_NAME: XXXwizard.exe
 
ERROR_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
 
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
 
EXCEPTION_PARAMETER1: 00000000
 
EXCEPTION_PARAMETER2: 000000b1
 
READ_ADDRESS: 000000b1 
 
FOLLOWUP_IP: 
cabinet!SetDecompressionType+e
6d3615a4 663bbeb2000000 cmp di,word ptr [esi+0B2h]
 
MOD_LIST: <ANALYSIS/>
 
NTGLOBALFLAG: 0
 
APPLICATION_VERIFIER_FLAGS: 0
 
MANAGED_STACK: !dumpstack -EE
OS Thread Id: 0x1790 (10)
Current frame: 
ChildEBP RetAddr Caller,Callee
 
FAULTING_THREAD: 00001790
 
BUGCHECK_STR: APPLICATION_FAULT_NULL_CLASS_PTR_DEREFERENCE_INVALID_POINTER_READ_WRONG_SYMBOLS_FILL_PATTERN_ffffffff
 
PRIMARY_PROBLEM_CLASS: NULL_CLASS_PTR_DEREFERENCE_FILL_PATTERN_ffffffff
 
DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE_FILL_PATTERN_ffffffff
 
LAST_CONTROL_TRANSFER: from 6d3615d8 to 6d3615a4
 
STACK_TEXT: 
0d53fdf4 6d3615d8 0000000f ffffffff 0551b848 cabinet!SetDecompressionType+0xe
0d53fe08 7506bfa7 ffffffff 750f0334 00020000 cabinet!FDIDestroy+0x19
0d53fe1c 7506bf59 00000000 0551b840 0a4e6f10 setupapi!DiamondTerminate+0x4e
0d53fe30 75087222 00000000 00000001 0d53fe54 setupapi!DiamondTlsInit+0x48
0d53fe40 750419a9 00000000 00000000 00000000 setupapi!ThreadTlsInitialize+0x39
0d53fe54 75041875 75040000 00000003 00000000 setupapi!DllMain+0x28
0d53feb4 7740af58 75040000 00000003 00000000 setupapi!_CRT_INIT+0x26d
0d53fed4 773e0677 750417e7 75040000 00000003 ntdll!LdrpCallInitRoutine+0x14
0d53ff78 773e06b3 00000000 00000000 0d53ff94 ntdll!LdrShutdownThread+0xe6
0d53ff88 7548119b 00000000 0d53ffd4 7740b429 ntdll!RtlExitUserThread+0x2a
0d53ff94 7740b429 073dd980 7c54ad49 00000000 kernel32!BaseThreadInitThunk+0x15
0d53ffd4 7740b3fc 6f691d43 073dd980 00000000 ntdll!__RtlUserThreadStart+0x70
0d53ffec 00000000 6f691d43 073dd980 00000000 ntdll!_RtlUserThreadStart+0x1b
 
 
SYMBOL_STACK_INDEX: 0
 
SYMBOL_NAME: cabinet!SetDecompressionType+e
 
FOLLOWUP_NAME: MachineOwner
 
MODULE_NAME: cabinet
 
IMAGE_NAME: cabinet.dll
 
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bd987
 
STACK_COMMAND: ~10s; .ecxr ; kb
 
FAILURE_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE_FILL_PATTERN_ffffffff_c0000005_cabinet.dll!SetDecompressionType
 
BUCKET_ID: APPLICATION_FAULT_NULL_CLASS_PTR_DEREFERENCE_INVALID_POINTER_READ_WRONG_SYMBOLS_FILL_PATTERN_ffffffff_cabinet!SetDecompressionType+e
 
WATSON_STAGEONE_URL:  **LINK REMOVED**
 
Followup: MachineOwner
---------

We need the actual dmp file to do further analysis. please upload it

\


To enable us to assist you with your computer's BSOD symptoms, upload the contents of your "\Windows\Minidump" folder.

The procedure:

* Copy the contents of \Windows\Minidump to another (temporary) location somewhere on your machine.
* Zip up the copy.
* Attach the ZIP archive to your post using the "paperclip" (file attachments) button.



To ensure minidumps are enabled:

Go to Start, in the Search Box type: sysdm.cpl, press Enter.
Under the Advanced tab, click on the Startup and Recovery Settings... button.
Ensure that Automatically restart is unchecked.
Under the Write Debugging Information header select Small memory dump (256 kB) in the dropdown box (the 256kb varies).
Ensure that the Small Dump Directory is listed as %systemroot%\Minidump.
OK your way out.
Reboot if changes have been made.

Ok, right now I can't reproduce the crash to recreate another dump file.
I enabled minidumps using what you said.

The folder containing the dumps created by adplus has 3 dump files:
FULLDUMP_FirstChance_epr_Process_Shut_Down - 550MB
FULLDUMP_SecondChance_av_AccessViolation - 551MB
MINIDUMP_FirstChance_av_AccessViolation - 12MB

I assume it's the last one you are refering to.
I'm attaching it as a zip.

Thank you.