Bug 52198 – Opening twitter home page (own tweets) crashes without dump in r75478

• Component: WebKit Misc.
• Status: RESOLVED WONTFIX

[Jyrki Wahlstedt]

I've now built WebKit successfully a few times:) However, the current build (and some previous ones, too), crash while opening Twitter home page. This happens so that no crash dump is generated, a total kill. The banner at the top is drawn, but the tweet list is not. The basic home page is ok, but after signing, off one goes (I checked with clearing all cookies, and signing in after that).

Otherwise no problems.

[Jyrki Wahlstedt]

another site with the same effect: http://www.hsrc.fi

[Adam Roben (:aroben)]

Can you try to capture a dump using ProcDump [1]? Run this command, then reproduce the crash:

procdump -e safari.exe crash.dmp

1. http://technet.microsoft.com/en-us/sysinternals/dd996900

[Jyrki Wahlstedt]

Created attachment 78657 [details]
crash dump from r75478 (own build) at twitter not normally caught

Ok, now I have the crash dump generated (first I expected some kind of demo effect, but happily didn't occur:) and attach that here.

[Jyrki Wahlstedt]

Created attachment 78665 [details]
crash dump from r75586 of the same (just to confirm)

[Adam Roben (:aroben)]

Thank you for the dump files. Could you reproduce with a nightly build and capture a dump file? Since I don't have debug symbols for your local build, I can't get a backtrace from the dumps you've uploaded so far.

[Jyrki Wahlstedt]

(In reply to comment #5)
> Thank you for the dump files. Could you reproduce with a nightly build and capture a dump file? Since I don't have debug symbols for your local build, I can't get a backtrace from the dumps you've uploaded so far.

I suppose this phenomenon is caused by some change done after the latest nightly for Windows, because I didn't see this with r74232, so . I try to get a debug build with the current revision (r75586), but building takes longer than my today... Then, sorry to ask, haven't been involved in Windows development for a long time, are there instructions somewhere, how to produce the backtrace (shouldn't be too difficult?!? Oh well, I'm running now with WinDbg active, could that help?

[Adam Roben (:aroben)]

(In reply to comment #6)
> (In reply to comment #5)
> > Thank you for the dump files. Could you reproduce with a nightly build and capture a dump file? Since I don't have debug symbols for your local build, I can't get a backtrace from the dumps you've uploaded so far.
> 
> I suppose this phenomenon is caused by some change done after the latest nightly for Windows, because I didn't see this with r74232, so . I try to get a debug build with the current revision (r75586), but building takes longer than my today...

A Debug build isn't required. All that's required are the .pdb files from your local build.

> Then, sorry to ask, haven't been involved in Windows development for a long time, are there instructions somewhere, how to produce the backtrace (shouldn't be too difficult?!? Oh well, I'm running now with WinDbg active, could that help?

Yes, if you catch the crash in WinDbg you can get a backtrace yourself. If you dont have _NT_SYMBOL_PATH set, you should first run these commands:

.symfix
.reload

Then do this:

!analyze -v

Then attach the output to this bug.

[Jyrki Wahlstedt]

Created attachment 78683 [details]
crash dump from r74232 (supposedly opening twitter)

Sorry, was hasty, here crash dump from r74232

[Adam Roben (:aroben)]

Comment on attachment 78683 [details]
crash dump from r74232 (supposedly opening twitter)

Looks like we're failing to load QTMovieWin.dll:

ChildEBP RetAddr  
0013f570 038c9062 kernel32!RaiseException+0x53
0013f5d8 038c8c7b WebKit!__delayLoadHelper2+0x13b [f:\dd\vctools\delayimp\delayhlp.cpp @ 331]
0013f6cc 016a0132 WebKit!_tailMerge_QTMovieWin_dll+0xd
0013f788 0330df34 JavaScriptCore!WTF::fastMalloc+0x22 [c:\cygwin\home\buildbot\slave\windows-release-archive\build\opensource\javascriptcore\wtf\fastmalloc.cpp @ 3712]
0013f7d4 033c6b88 WebKit!WebCore::ScriptController::evaluateInWorld+0x154 [c:\cygwin\home\buildbot\slave\windows-release-archive\build\opensource\webcore\bindings\js\scriptcontroller.cpp @ 149]
0013f820 033c602f WebKit!WebCore::ScriptElement::shouldExecuteAsJavaScript+0x1b8 [c:\cygwin\home\buildbot\slave\windows-release-archive\build\opensource\webcore\dom\scriptelement.cpp @ 275]
0013f8b0 036adeab WebKit!WebCore::ScriptSourceCode::ScriptSourceCode+0x3f [c:\cygwin\home\buildbot\slave\windows-release-archive\build\opensource\webcore\bindings\js\scriptsourcecode.h @ 55]
0013f8b8 037cbcff WebKit!WebCore::Timer<WebCore::MediaPlayer>::fired+0xb [c:\cygwin\home\buildbot\slave\windows-release-archive\build\opensource\webcore\platform\timer.h @ 98]
0013f8fc 032a8622 WebKit!WebCore::ThreadTimers::sharedTimerFiredInternal+0xef [c:\cygwin\home\buildbot\slave\windows-release-archive\build\opensource\webcore\platform\threadtimers.cpp @ 115]
0013f908 032a7d36 WebKit!WTF::ThreadSpecific<WebCore::ThreadGlobalData>::operator WebCore::ThreadGlobalData *+0x12 [c:\cygwin\home\buildbot\slave\windows-release-archive\build\build-release\include\private\javascriptcore\threadspecific.h @ 304]
0013f914 037cbc0e WebKit!WebCore::threadGlobalData+0x46 [c:\cygwin\home\buildbot\slave\windows-release-archive\build\build-release\include\webcore\threadglobaldata.h @ 107]
0013f91c 0383d29e WebKit!WebCore::ThreadTimers::sharedTimerFired+0xe [c:\cygwin\home\buildbot\slave\windows-release-archive\build\opensource\webcore\platform\threadtimers.cpp @ 91]
0013f920 7e418734 WebKit!WebCore::TimerWindowWndProc+0x4e [c:\cygwin\home\buildbot\slave\windows-release-archive\build\opensource\webcore\platform\win\sharedtimerwin.cpp @ 104]
0013f94c 7e418816 user32!InternalCallWinProc+0x28
0013f9b4 7e4189cd user32!UserCallWinProcCheckWow+0x150
0013fa14 7e418a10 user32!DispatchMessageWorker+0x306

[Adam Roben (:aroben)]

(In reply to comment #9)
> (From update of attachment 78683 [details])
> Looks like we're failing to load QTMovieWin.dll:

The r74232 nightly includes QTMovieWin.dll, so I don't know why it would fail to load.

[Adam Roben (:aroben)]

Jyrki, if you're able to catch the crash in WinDbg you might be able to get a better backtrace than I was able to get from the dump.

[Adam Roben (:aroben)]

(In reply to comment #9)
> (From update of attachment 78683 [details])
> 0013f570 038c9062 kernel32!RaiseException+0x53
> 0013f5d8 038c8c7b WebKit!__delayLoadHelper2+0x13b [f:\dd\vctools\delayimp\delayhlp.cpp @ 331]
> 0013f6cc 016a0132 WebKit!_tailMerge_QTMovieWin_dll+0xd
> 0013f788 0330df34 JavaScriptCore!WTF::fastMalloc+0x22 [c:\cygwin\home\buildbot\slave\windows-release-archive\build\opensource\javascriptcore\wtf\fastmalloc.cpp @ 3712]

It doesn't relaly make sense to me that we'd be trying to load QTMovieWin.dll inside a call to fastMalloc.

[Jyrki Wahlstedt]

Hmm,
using the instructions (WinDbg->.symfix->.reload->analyze) I get this (the behaviour is now different,as there is an unknown exception, and the process does not proceed, only after detaching debuggee it vanishes into thin air) (this is from r75682):
0:000> !analyze -v
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\work\WebKit\WebKitBuild\Release\bin\WebKit.dll - 
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

*** ERROR: Module load completed but symbols could not be loaded for C:\Program Files\Safari\Safari.exe
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files\Common Files\Apple\Apple Application Support\libdispatch.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files\Common Files\Apple\Apple Application Support\pthreadVC2.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files\Common Files\Apple\Apple Application Support\CoreFoundation.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files\Common Files\Apple\Apple Application Support\CFNetwork.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files\Safari\Safari.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files\Mozilla Firefox\plugins\nppdf32.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files\Adobe\Reader 9.0\Reader\ACE.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files\Adobe\Reader 9.0\Reader\AGM.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\macromed\Flash\NPSWF32.dll - 
GetPageUrlData failed, server returned HTTP status 404
URL requested: http://watson.microsoft.com/StageOne/Safari_exe/5_33_19_4/kernel32_dll/5_1_2600_5781/00012afb.htm?Retriage=1

FAULTING_IP: 
kernel32!RaiseException+53
7c812afb 5e              pop     esi

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 7c812afb (kernel32!RaiseException+0x00000053)
   ExceptionCode: c06d007e
  ExceptionFlags: 00000000
NumberParameters: 1
   Parameter[0]: 0013f554

FAULTING_THREAD:  00001670

DEFAULT_BUCKET_ID:  APPLICATION_FAULT

PROCESS_NAME:  Safari.exe

ERROR_CODE: (NTSTATUS) 0xc06d007e - <Unable to get error code text>

EXCEPTION_CODE: (NTSTATUS) 0xc06d007e - <Unable to get error code text>

EXCEPTION_PARAMETER1:  0013f554

MOD_LIST: <ANALYSIS/>

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

PRIMARY_PROBLEM_CLASS:  APPLICATION_FAULT

BUGCHECK_STR:  APPLICATION_FAULT_APPLICATION_FAULT

LAST_CONTROL_TRANSFER:  from 027a1b6c to 7c812afb

STACK_TEXT:  
0013f530 027a1b6c c06d007e 00000000 00000001 kernel32!RaiseException+0x53
WARNING: Stack unwind information not available. Following frames may be wrong.
0013f598 0279b807 00000054 0013f554 00000002 WebKit!WebLocalizedLPCTSTR+0x13d8c
0013f6a4 016ba982 1f0a0000 7fe52584 05cc03a8 WebKit!WebLocalizedLPCTSTR+0xda27
0013f6d4 016baeaa 0013f710 7fe52584 05cc0038 JavaScriptCore!JSC::JITCode::execute+0x22 [c:\work\webkit\source\javascriptcore\jit\jitcode.h @ 77]
0013f714 0162e472 0013f740 7f53bc60 7e96b058 JavaScriptCore!JSC::Interpreter::execute+0x1da [c:\work\webkit\source\javascriptcore\interpreter\interpreter.cpp @ 778]
0013f744 02260c5f 0013f788 7e96b058 7e96b020 JavaScriptCore!JSC::evaluate+0x102 [c:\work\webkit\source\javascriptcore\runtime\completion.cpp @ 64]
0013f788 022960ce 028d172c 00000000 02260d94 WebKit!WTF::ThreadCondition::timedWait+0x3fbf9
0013f834 022b862b 749bd000 7ff0be88 753adf98 WebKit!WKContextMenuItemGetTypeID+0xa41e
0013f894 025334e9 00000000 00000000 0013f91c WebKit!WKContextMenuItemGetTypeID+0x2c97b
00000000 00000000 00000000 00000000 00000000 WebKit!setUseOpenSourceWebKit+0x182a09


FOLLOWUP_IP: 
WebKit!WebLocalizedLPCTSTR+13d8c
027a1b6c 8b45d8          mov     eax,dword ptr [ebp-28h]

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  webkit!WebLocalizedLPCTSTR+13d8c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: WebKit

IMAGE_NAME:  WebKit.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  4d2ebc2f

STACK_COMMAND:  dt ntdll!LdrpLastDllInitializer BaseDllName ; dt ntdll!LdrpFailureData ; ~0s ; kb

FAILURE_BUCKET_ID:  APPLICATION_FAULT_c06d007e_WebKit.dll!WebLocalizedLPCTSTR

BUCKET_ID:  APPLICATION_FAULT_APPLICATION_FAULT_webkit!WebLocalizedLPCTSTR+13d8c

WATSON_STAGEONE_URL:  http://watson.microsoft.com/StageOne/Safari_exe/5_33_19_4/4cd2131b/kernel32_dll/5_1_2600_5781/49c4f482/c06d007e/00012afb.htm?Retriage=1

Followup: MachineOwner
---------

[Adam Roben (:aroben)]

(In reply to comment #13)
> *** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\work\WebKit\WebKitBuild\Release\bin\WebKit.dll - 

This isn't good. Maybe you need to add C:\work\WebKit\WebKitBuild\Release\bin to your symbol path? Though I thought that WinDbg would search there automatically.

Anyway, you can add that directory to the symbol path using:

.sympath+ C:\work\WebKit\WebKitBuild\Release\bin
.reload

And then run !analyze -v again.

[Jyrki Wahlstedt]

Well, the analyze phase looks better, but what's a bit troubling is that the results don't seem to be identical (now in r75772):
====
0:000> g
(14b8.2740): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000000 ebx=1f9687c0 ecx=75abfe80 edx=00000002 esi=756da800 edi=747f6b40
eip=00000000 esp=0013f5b0 ebp=0013f6a4 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00210202
00000000 ??              ???
0:000> g
(14b8.2740): Access violation - code c0000005 (!!! second chance !!!)
eax=00000000 ebx=1f9687c0 ecx=75abfe80 edx=00000002 esi=756da800 edi=747f6b40
eip=00000000 esp=0013f5b0 ebp=0013f6a4 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00200202
00000000 ??              ???
0:000> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************


FAULTING_IP: 
+6a96
00000000 ??              ???

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 00000000
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000008
   Parameter[1]: 00000000
Attempt to execute non-executable address 00000000

FAULTING_THREAD:  00002740

PROCESS_NAME:  Safari.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

EXCEPTION_PARAMETER1:  00000008

EXCEPTION_PARAMETER2:  00000000

WRITE_ADDRESS:  00000000 

FOLLOWUP_IP: 
WebKit!WKAuthenticationChallengeGetTypeID+6a96
026ec966 84c0            test    al,al

FAILED_INSTRUCTION_ADDRESS: 
+1562faf00bfdf58
00000000 ??              ???

MOD_LIST: <ANALYSIS/>

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

BUGCHECK_STR:  APPLICATION_FAULT_SOFTWARE_NX_FAULT_NULL

PRIMARY_PROBLEM_CLASS:  SOFTWARE_NX_FAULT_NULL

DEFAULT_BUCKET_ID:  SOFTWARE_NX_FAULT_NULL

LAST_CONTROL_TRANSFER:  from 026ec966 to 00000000

STACK_TEXT:  
WARNING: Frame IP not in any known module. Following frames may be wrong.
0013f5ac 026ec966 0259b17d 0259b0b0 0259b505 0x0
0013f6a4 016ba982 15970000 7fe30dd4 05cd03a8 WebKit!WKAuthenticationChallengeGetTypeID+0x6a96
0013f6d4 016baeaa 0013f710 7fe30dd4 05cd0038 JavaScriptCore!JSC::JITCode::execute+0x22 [c:\work\webkit\source\javascriptcore\jit\jitcode.h @ 77]
0013f714 0162e472 0013f740 759b1948 74bc2658 JavaScriptCore!JSC::Interpreter::execute+0x1da [c:\work\webkit\source\javascriptcore\interpreter\interpreter.cpp @ 778]
0013f744 0226108f 0013f788 74bc2658 74bc2620 JavaScriptCore!JSC::evaluate+0x102 [c:\work\webkit\source\javascriptcore\runtime\completion.cpp @ 64]
0013f788 0229642e 028d875c 00000000 022611c4 WebKit!WTF::ThreadCondition::timedWait+0x3fa79
0013f834 022b8a5b 7489c000 7ff04e88 74edd208 WebKit!WKErrorGetTypeID+0xae4e
0013f894 02536569 00000000 00000000 0013f91c WebKit!WKErrorGetTypeID+0x2d47b
00000000 00000000 00000000 00000000 00000000 WebKit!LocalServerDidDie+0x1f40a9


SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  webkit!WKAuthenticationChallengeGetTypeID+6a96

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: WebKit

IMAGE_NAME:  WebKit.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  4d302c08

STACK_COMMAND:  dt ntdll!LdrpLastDllInitializer BaseDllName ; dt ntdll!LdrpFailureData ; ~0s ; kb

FAILURE_BUCKET_ID:  SOFTWARE_NX_FAULT_NULL_c0000005_WebKit.dll!WKAuthenticationChallengeGetTypeID

BUCKET_ID:  APPLICATION_FAULT_SOFTWARE_NX_FAULT_NULL_NULL_IP_webkit!WKAuthenticationChallengeGetTypeID+6a96

WATSON_IBUCKET:  -2104907571

WATSON_IBUCKETTABLE:  1

WATSON_STAGEONE_URL:  http://watson.microsoft.com/StageOne/Safari_exe/5_33_19_4/4cd2131b/unknown/0_0_0_0/bbbbbbb4/c0000005/00000000.htm?Retriage=1

Followup: MachineOwner
---------

[Adam Roben (:aroben)]

(In reply to comment #15)
> Well, the analyze phase looks better, but what's a bit troubling is that the results don't seem to be identical (now in r75772):
<snip>
> STACK_TEXT:  
> WARNING: Frame IP not in any known module. Following frames may be wrong.
> 0013f5ac 026ec966 0259b17d 0259b0b0 0259b505 0x0
> 0013f6a4 016ba982 15970000 7fe30dd4 05cd03a8 WebKit!WKAuthenticationChallengeGetTypeID+0x6a96
> 0013f6d4 016baeaa 0013f710 7fe30dd4 05cd0038 JavaScriptCore!JSC::JITCode::execute+0x22 [c:\work\webkit\source\javascriptcore\jit\jitcode.h @ 77]

This is clearly bogus. I think you may have to try to reproduce in a Debug build. FYI, you can download a ready-made Debug build from <http://build.webkit.org/archives/win-i386-debug/>.

[Jyrki Wahlstedt]

(In reply to comment #16)
> (In reply to comment #15)
> > Well, the analyze phase looks better, but what's a bit troubling is that the results don't seem to be identical (now in r75772):
> <snip>
> > STACK_TEXT:  
> > WARNING: Frame IP not in any known module. Following frames may be wrong.
> > 0013f5ac 026ec966 0259b17d 0259b0b0 0259b505 0x0
> > 0013f6a4 016ba982 15970000 7fe30dd4 05cd03a8 WebKit!WKAuthenticationChallengeGetTypeID+0x6a96
> > 0013f6d4 016baeaa 0013f710 7fe30dd4 05cd0038 JavaScriptCore!JSC::JITCode::execute+0x22 [c:\work\webkit\source\javascriptcore\jit\jitcode.h @ 77]
> 
> This is clearly bogus. I think you may have to try to reproduce in a Debug build. FYI, you can download a ready-made Debug build from <http://build.webkit.org/archives/win-i386-debug/>.

Ok, then, I'll do that again. BTW, I tried to download these Debug builds, just couldn't, don't have access rights:(

[Adam Roben (:aroben)]

(In reply to comment #17)
> (In reply to comment #16)
> FYI, you can download a ready-made Debug build from <http://build.webkit.org/archives/win-i386-debug/>.
> 
> Ok, then, I'll do that again. BTW, I tried to download these Debug builds, just couldn't, don't have access rights:(

Interesting, neither can I!

Mark or Bill, do you know why we mere mortals can't download builds from <http://build.webkit.org/archives/>?

[Jyrki Wahlstedt]

All builds failed today:(

[William Siegrist]

Lucas and I are looking into the archive file permission problem.

[William Siegrist]

The archive files are accessible again.

[Jyrki Wahlstedt]

Thanks for fixing the access issue!
I downloaded a debug build (75999.zip), but unfortunately that was hugely unresponsive, so I took a release build from the archive (http://build.webkit.org/archives/win-i386-release/76001.zip), unpacked and ran that with the following results:
- going to Twitter produced a crash, but once again a bit different
- now the system showed a message box about data execution prevention, hence the system had to close the program
- WebKit didn't vanish like before, instead I have dr. Watson dump, too, from this event

[Jyrki Wahlstedt]

Created attachment 79246 [details]
Crash dump from r76001 (Dr. Watson dump)

[Jyrki Wahlstedt]

Created attachment 79248 [details]
Crash dump from r76001 (procdump)

[Adam Roben (:aroben)]

Comment on attachment 79248 [details]
Crash dump from r76001 (procdump)

*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

*** ERROR: Symbol file could not be found.  Defaulted to export symbols for libdispatch.dll - 
*** WARNING: Unable to verify timestamp for AcroRd32.dll
*** ERROR: Module load completed but symbols could not be loaded for AcroRd32.dll
Unable to load image C:\Program Files\Adobe\Reader 9.0\Reader\ACE.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ACE.dll
*** ERROR: Module load completed but symbols could not be loaded for ACE.dll
Unable to load image C:\Program Files\Adobe\Reader 9.0\Reader\AGM.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for AGM.dll
*** ERROR: Module load completed but symbols could not be loaded for AGM.dll
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for NPSWF32.dll - 

FAULTING_IP: 
+2502faf0178df58
00000000 ??              ???

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 00000000
   ExceptionCode: 80000003 (Break instruction exception)
  ExceptionFlags: 00000000
NumberParameters: 0

FAULTING_THREAD:  00000b4c

DEFAULT_BUCKET_ID:  STATUS_BREAKPOINT

PROCESS_NAME:  Safari.exe

ERROR_CODE: (NTSTATUS) 0x80000003 - {EXCEPTION}  Breakpoint  A breakpoint has been reached.

EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - One or more arguments are invalid

MOD_LIST: <ANALYSIS/>

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

PRIMARY_PROBLEM_CLASS:  STATUS_BREAKPOINT

BUGCHECK_STR:  APPLICATION_FAULT_STATUS_BREAKPOINT

LAST_CONTROL_TRANSFER:  from 027b8fcc to 7c812afb

STACK_TEXT:  
0013f52c 027b8fcc c06d007e 00000000 00000001 kernel32!RaiseException+0x53
0013f594 027b2c7b 00000054 0013f550 00000002 WebKit!__delayLoadHelper2+0x13b [f:\dd\vctools\delayimp\delayhlp.cpp @ 331]
0013f6a0 016ba822 382b0000 7fe92c4c 040103a8 WebKit!_tailMerge_QTMovieWin_dll+0xd
0013f6d0 016bad4a 0013f70c 7fe92c4c 04010038 JavaScriptCore!JSC::JITCode::execute+0x22 [c:\cygwin\home\buildbot\slave\win-release\build\source\javascriptcore\jit\jitcode.h @ 77]
0013f710 0162e5d2 0013f73c 74bd1108 6eed0ad8 JavaScriptCore!JSC::Interpreter::execute+0x1da [c:\cygwin\home\buildbot\slave\win-release\build\source\javascriptcore\interpreter\interpreter.cpp @ 778]
0013f740 02261a5f 0013f784 6eed0ad8 6eed0aa0 JavaScriptCore!JSC::evaluate+0x102 [c:\cygwin\home\buildbot\slave\win-release\build\source\javascriptcore\runtime\completion.cpp @ 64]
0013f790 02261b94 0013f7d0 71322460 00000000 WebKit!WebCore::ScriptController::evaluateInWorld+0x17f [c:\cygwin\home\buildbot\slave\win-release\build\source\webcore\bindings\js\scriptcontroller.cpp @ 148]
0013f7ac 022b9441 0013f7d0 0013f7f0 00000001 WebKit!WebCore::ScriptController::evaluate+0x44 [c:\cygwin\home\buildbot\slave\win-release\build\source\webcore\bindings\js\scriptcontroller.cpp @ 171]
0013f7dc 022b94ca 70722af0 748505f0 7bd5a314 WebKit!WebCore::ScriptElement::evaluateScript+0x81 [c:\cygwin\home\buildbot\slave\win-release\build\source\webcore\dom\scriptelement.cpp @ 197]
0013f834 022b9aab 73b251c0 7fedb6f0 71a139e8 WebKit!WebCore::ScriptElement::execute+0x4a [c:\cygwin\home\buildbot\slave\win-release\build\source\webcore\dom\scriptelement.cpp @ 233]
0013f8a4 021de774 00000035 0013f91c 0272d41b WebKit!WebCore::AsyncScriptRunner::timerFired+0xeb [c:\cygwin\home\buildbot\slave\win-release\build\source\webcore\dom\asyncscriptrunner.cpp @ 88]
0013f8b0 0272d41b 71a139e8 026c525f 0013f988 WebKit!WTF::ThreadSpecific<WebCore::ThreadGlobalData>::operator WebCore::ThreadGlobalData *+0x14 [c:\cygwin\home\buildbot\slave\win-release\build\webkitbuild\release\include\private\javascriptcore\threadspecific.h @ 304]
0013f8b8 026c525f 0013f988 027326d0 0013f8d0 WebKit!WebCore::Timer<WebCore::WKCACFLayerRenderer>::fired+0xb [c:\cygwin\home\buildbot\slave\win-release\build\source\webcore\platform\timer.h @ 98]
0013f8fc 7e43e1ad 7e43e18a 00000000 0013f94c WebKit!WebCore::ThreadTimers::sharedTimerFiredInternal+0xbf [c:\cygwin\home\buildbot\slave\win-release\build\source\webcore\platform\threadtimers.cpp @ 115]
0013f900 7e43e18a 00000000 0013f94c 021de774 user32!NtUserCallNextHookEx+0xc
0013f90c 021de774 00000035 0013f988 0013f94c user32!CallNextHookEx+0x6f
0013f94c 7e418816 027326d0 0021010e 0000c1f0 WebKit!WTF::ThreadSpecific<WebCore::ThreadGlobalData>::operator WebCore::ThreadGlobalData *+0x14 [c:\cygwin\home\buildbot\slave\win-release\build\webkitbuild\release\include\private\javascriptcore\threadspecific.h @ 304]
0013f9b4 7e4189cd 00000000 027326d0 0021010e user32!UserCallWinProcCheckWow+0x150
0013fa14 7e418a10 0013fc8c 00000000 0013fc8c user32!DispatchMessageWorker+0x306
0013fa24 00babf62 0013fc8c 00000000 7fe90480 user32!DispatchMessageW+0xf
0013fc58 00b4beb0 00000000 7fe9c2a0 7c80e400 Safari_b30000!RunMessagePump+0x152
0013fcac 00bacb56 0000000a 7c80ae40 00b30000 Safari_b30000!run+0x130
0013fcdc 00bad218 00b30000 000208f8 0000000a Safari_b30000!safariMain+0x5a6
0013fcf0 00401457 00400000 00000000 000208f8 Safari_b30000!safariDLLMain+0x38
0013ff2c 0040161b 00400000 00000000 000208f8 Safari!wWinMain+0x217
0013ffc0 7c817077 7c91a2a3 ffffffff 7ffd6000 Safari!__tmainCRTStartup+0x150 [f:\dd\vctools\crt_bld\self_x86\crt\src\crtexe.c @ 589]
0013fff0 00000000 00401787 00000000 00000000 kernel32!BaseProcessStart+0x23


FOLLOWUP_IP: 
WebKit!_tailMerge_QTMovieWin_dll+d
027b2c7b 5a              pop     edx

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  webkit!_tailMerge_QTMovieWin_dll+d

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: WebKit

IMAGE_NAME:  WebKit.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  4d353e36

STACK_COMMAND:  dt ntdll!LdrpLastDllInitializer BaseDllName ; dt ntdll!LdrpFailureData ; ~0s; .ecxr ; kb

FAILURE_BUCKET_ID:  STATUS_BREAKPOINT_80000003_WebKit.dll!_tailMerge_QTMovieWin_dll

BUCKET_ID:  APPLICATION_FAULT_STATUS_BREAKPOINT_webkit!_tailMerge_QTMovieWin_dll+d

WATSON_IBUCKET:  -2104907571

WATSON_IBUCKETTABLE:  1

WATSON_STAGEONE_URL:  http://watson.microsoft.com/StageOne/Safari_exe/5_33_19_4/4cd2131b/unknown/0_0_0_0/bbbbbbb4/80000003/00000000.htm?Retriage=1

Followup: MachineOwner
---------

[Adam Roben (:aroben)]

Comment on attachment 79246 [details]
Crash dump from r76001 (Dr. Watson dump)

*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

*** ERROR: Symbol file could not be found.  Defaulted to export symbols for libdispatch.dll - 
Unable to load image C:\Program Files\Adobe\Reader 9.0\Reader\ACE.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ACE.dll
*** ERROR: Module load completed but symbols could not be loaded for ACE.dll
Unable to load image C:\Program Files\Adobe\Reader 9.0\Reader\AGM.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for AGM.dll
*** ERROR: Module load completed but symbols could not be loaded for AGM.dll
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for NPSWF32.dll - 

FAULTING_IP: 
+6
00000000 ??              ???

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 00000000
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000008
   Parameter[1]: 00000000
Attempt to execute non-executable address 00000000

PROCESS_NAME:  Safari.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

EXCEPTION_PARAMETER1:  00000008

EXCEPTION_PARAMETER2:  00000000

WRITE_ADDRESS:  00000000 

FOLLOWUP_IP: 
WebKit!WebCore::MediaPlayerPrivateQuickTimeVisualContext::registerMediaEngine+6 [c:\cygwin\home\buildbot\slave\win-release\build\source\webcore\platform\graphics\win\mediaplayerprivatequicktimevisualcontext.cpp @ 153]
026ecdc6 84c0            test    al,al

FAILED_INSTRUCTION_ADDRESS: 
+2502faf015fdf58
00000000 ??              ???

MOD_LIST: <ANALYSIS/>

FAULTING_THREAD:  00000b4c

BUGCHECK_STR:  APPLICATION_FAULT_SOFTWARE_NX_FAULT_NULL

PRIMARY_PROBLEM_CLASS:  SOFTWARE_NX_FAULT_NULL

DEFAULT_BUCKET_ID:  SOFTWARE_NX_FAULT_NULL

LAST_CONTROL_TRANSFER:  from 026ecdc6 to 00000000

STACK_TEXT:  
WARNING: Frame IP not in any known module. Following frames may be wrong.
0013f5a8 026ecdc6 0259ac8d 0259abc0 0259b015 0x0
0013f5ac 0259ac8d 0259abc0 0259b015 023fcfc5 WebKit!WebCore::MediaPlayerPrivateQuickTimeVisualContext::registerMediaEngine+0x6 [c:\cygwin\home\buildbot\slave\win-release\build\source\webcore\platform\graphics\win\mediaplayerprivatequicktimevisualcontext.cpp @ 153]
0013f5b4 0259b015 023fcfc5 70722800 0013f61c WebKit!WebCore::installedMediaEngines+0x5d [c:\cygwin\home\buildbot\slave\win-release\build\source\webcore\platform\graphics\mediaplayer.cpp @ 180]
0013f5b8 023fcfc5 70722800 0013f61c 0013f5f8 WebKit!WebCore::MediaPlayer::isAvailable+0x5 [c:\cygwin\home\buildbot\slave\win-release\build\source\webcore\platform\graphics\mediaplayer.cpp @ 630]
0013f5c8 024a95cb 0013f5f8 0013f61c 70722800 WebKit!WebCore::videoConstructor+0x15 [c:\cygwin\home\buildbot\slave\win-release\build\webkitbuild\release\obj\webcore\derivedsources\htmlelementfactory.cpp @ 499]
0013f5e8 0260a042 0013f618 0013f61c 7fe977c0 WebKit!WebCore::HTMLElementFactory::createHTMLElement+0x5b [c:\cygwin\home\buildbot\slave\win-release\build\webkitbuild\release\obj\webcore\derivedsources\htmlelementfactory.cpp @ 646]
0013f60c 0242f171 0013f638 0013f630 7feca858 WebKit!WebCore::HTMLDocument::createElement+0x62 [c:\cygwin\home\buildbot\slave\win-release\build\source\webcore\html\htmldocument.cpp @ 298]
0013f6a0 016ba822 382b0000 7fe92c4c 040103a8 WebKit!WebCore::jsDocumentPrototypeFunctionCreateElement+0x101 [c:\cygwin\home\buildbot\slave\win-release\build\webkitbuild\release\obj\webcore\derivedsources\jsdocument.cpp @ 1677]
0013f6d0 016bad4a 0013f70c 7fe92c4c 04010038 JavaScriptCore!JSC::JITCode::execute+0x22 [c:\cygwin\home\buildbot\slave\win-release\build\source\javascriptcore\jit\jitcode.h @ 77]
0013f710 0162e5d2 0013f73c 74bd1108 6eed0ad8 JavaScriptCore!JSC::Interpreter::execute+0x1da [c:\cygwin\home\buildbot\slave\win-release\build\source\javascriptcore\interpreter\interpreter.cpp @ 778]
0013f740 02261a5f 0013f784 6eed0ad8 6eed0aa0 JavaScriptCore!JSC::evaluate+0x102 [c:\cygwin\home\buildbot\slave\win-release\build\source\javascriptcore\runtime\completion.cpp @ 64]
0013f790 02261b94 0013f7d0 71322460 00000000 WebKit!WebCore::ScriptController::evaluateInWorld+0x17f [c:\cygwin\home\buildbot\slave\win-release\build\source\webcore\bindings\js\scriptcontroller.cpp @ 148]
0013f7ac 022b9441 0013f7d0 0013f7f0 00000001 WebKit!WebCore::ScriptController::evaluate+0x44 [c:\cygwin\home\buildbot\slave\win-release\build\source\webcore\bindings\js\scriptcontroller.cpp @ 171]
0013f7dc 022b94ca 70722af0 748505f0 7bd5a314 WebKit!WebCore::ScriptElement::evaluateScript+0x81 [c:\cygwin\home\buildbot\slave\win-release\build\source\webcore\dom\scriptelement.cpp @ 197]
0013f834 022b9aab 73b251c0 7fedb6f0 71a139e8 WebKit!WebCore::ScriptElement::execute+0x4a [c:\cygwin\home\buildbot\slave\win-release\build\source\webcore\dom\scriptelement.cpp @ 233]
0013f8a4 021de774 00000035 0013f91c 0272d41b WebKit!WebCore::AsyncScriptRunner::timerFired+0xeb [c:\cygwin\home\buildbot\slave\win-release\build\source\webcore\dom\asyncscriptrunner.cpp @ 88]
0013f8b0 0272d41b 71a139e8 026c525f 0013f988 WebKit!WTF::ThreadSpecific<WebCore::ThreadGlobalData>::operator WebCore::ThreadGlobalData *+0x14 [c:\cygwin\home\buildbot\slave\win-release\build\webkitbuild\release\include\private\javascriptcore\threadspecific.h @ 304]
0013f8b8 026c525f 0013f988 027326d0 0013f8d0 WebKit!WebCore::Timer<WebCore::WKCACFLayerRenderer>::fired+0xb [c:\cygwin\home\buildbot\slave\win-release\build\source\webcore\platform\timer.h @ 98]
0013f8fc 7e43e1ad 7e43e18a 00000000 0013f94c WebKit!WebCore::ThreadTimers::sharedTimerFiredInternal+0xbf [c:\cygwin\home\buildbot\slave\win-release\build\source\webcore\platform\threadtimers.cpp @ 115]
0013f900 7e43e18a 00000000 0013f94c 021de774 user32!NtUserCallNextHookEx+0xc
7e43e1ad d7ff406a c0a3c085 0f7e4714 fe024685 user32!CallNextHookEx+0x6f
7e43e1c1 00fffffb fefcbde9 0fdb85ff 00fa6785 0xd7ff406a
7e43e1c5 fefcbde9 0fdb85ff 00fa6785 8beaeb00 Safari_b30000!__onexitbegin <PERF> (Safari_b30000+0x4cfffb)
7e43e1c9 0fdb85ff 00fa6785 8beaeb00 10ade9c1 0xfefcbde9
7e43e1cd 00fa6785 8beaeb00 10ade9c1 c033ffff 0xfdb85ff
7e43e1d1 8beaeb00 10ade9c1 c033ffff ff10b0e9 Safari_b30000!ReaderArticleFinderSource_blob+0x8bad
7e43e1d5 10ade9c1 c033ffff ff10b0e9 909090ff 0x8beaeb00
7e43e1d9 c033ffff ff10b0e9 909090ff c0339090 0x10ade9c1
7e43e1dd ff10b0e9 909090ff c0339090 0004c240 0xc033ffff
7e43e1e1 909090ff c0339090 0004c240 90909090 0xff10b0e9
7e43e1e5 c0339090 0004c240 90909090 55ff8b90 0x909090ff
7e43e1e9 0004c240 90909090 55ff8b90 006aec8b 0xc0339090
7e43e1ed 90909090 55ff8b90 006aec8b 75ff006a 0x4c240
7e43e1f1 55ff8b90 006aec8b 75ff006a 0fa1e808 0x90909090
7e43e1f5 006aec8b 75ff006a 0fa1e808 c25dffff 0x55ff8b90
7e43e1f9 75ff006a 0fa1e808 c25dffff 30a80004 0x6aec8b
7e43e1fd 0fa1e808 c25dffff 30a80004 9215840f 0x75ff006a
7e43e201 c25dffff 30a80004 9215840f 006a0000 0xfa1e808
7e43e205 30a80004 9215840f 006a0000 f3bf016a 0xc25dffff
7e43e209 9215840f 006a0000 f3bf016a 57000000 0x30a80004
7e43e20d 006a0000 f3bf016a 57000000 b077e853 0x9215840f
7e43e211 f3bf016a 57000000 b077e853 016afffe 0x6a0000
7e43e215 57000000 b077e853 016afffe 123815ff 0xf3bf016a
7e43e219 b077e853 016afffe 123815ff 006a7e41 0x57000000
7e43e21d 016afffe 123815ff 006a7e41 5357006a 0xb077e853
7e43e301 4111b415 ffff687e 35ff00ff 7e4712d8 JavaScriptCore!JSC::JIT::privateCompileGetByIdChain+0x74e [c:\cygwin\home\buildbot\slave\win-release\build\source\javascriptcore\jit\jitpropertyaccess32_64.cpp @ 1114]
7e43e329 00000000 fdff06e9 f44d39ff 6120850f 0x4111b415


STACK_COMMAND:  ~0s; .ecxr ; kb

FAULTING_SOURCE_CODE:  
No source found for 'c:\cygwin\home\buildbot\slave\win-release\build\source\webcore\platform\graphics\win\mediaplayerprivatequicktimevisualcontext.cpp'


SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  webkit!WebCore::MediaPlayerPrivateQuickTimeVisualContext::registerMediaEngine+6

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: WebKit

IMAGE_NAME:  WebKit.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  4d353e36

FAILURE_BUCKET_ID:  SOFTWARE_NX_FAULT_NULL_c0000005_WebKit.dll!WebCore::MediaPlayerPrivateQuickTimeVisualContext::registerMediaEngine

BUCKET_ID:  APPLICATION_FAULT_SOFTWARE_NX_FAULT_NULL_NULL_IP_webkit!WebCore::MediaPlayerPrivateQuickTimeVisualContext::registerMediaEngine+6

WATSON_IBUCKET:  -2104907571

WATSON_IBUCKETTABLE:  1

WATSON_STAGEONE_URL:  http://watson.microsoft.com/StageOne/Safari_exe/5_33_19_4/4cd2131b/unknown/0_0_0_0/bbbbbbb4/c0000005/00000000.htm?Retriage=1

Followup: MachineOwner
---------

[Adam Roben (:aroben)]

Comment on attachment 79248 [details]
Crash dump from r76001 (procdump)

I just spent a while trying to make sure that the problem really is that we're failing to load QTMovieWin.dll, and learned a bit about WinDbg in the process. I figured I'd document it here for posterity (i.e., my future self who has forgotten all of this).

MSDN says that the delay-load machinery throws exceptions when it fails to load a DLL or find an entry point in that DLL [1]. That seems to match what we're seeing here, so I wanted to see what the exception being thrown was.

The backtrace in comment 25 shows a call to RaiseException. Here's the function declaration from MSDN [2]:

void WINAPI RaiseException(
  __in  DWORD dwExceptionCode,
  __in  DWORD dwExceptionFlags,
  __in  DWORD nNumberOfArguments,
  __in  const ULONG_PTR *lpArguments
);

MSDN also says "The exception passes a pointer to a DelayLoadInfo structure in the LPDWORD value that can be retrieved by GetExceptionInformation in the EXCEPTION_RECORD structure, ExceptionInformation[0] field." [1] The docs for EXCEPTION_RECORD [3] made me think that the DelayLoadInfo must be passed in the lpArguments parameter. So I wanted to see if we could inspect that parameter.

After loading the dump into WinDbg (Ctrl+D) and setting up the symbol path (.sympath), I wanted to find RaiseException's paramters. The WINAPI calling convention is __stdcall, which passes arguments on the stack right-to-left [4]. So, let's find the stack for RaiseException:

0:000> kb 2
ChildEBP RetAddr  Args to Child              
0013f52c 027b8fcc c06d007e 00000000 00000001 kernel32!RaiseException+0x53
0013f594 027b2c7b 00000054 0013f550 00000002 WebKit!__delayLoadHelper2+0x13b [f:\dd\vctools\delayimp\delayhlp.cpp @ 331]

The first number in each row is the base pointer for the function (i.e., where the stack pointer was when the function was called). The second number is the return address that we should jump back to when the function is finished. The next three numbers are the first three arguments to the function. For RaiseException, this gives us the dwExceptionCode (0xc06d007e), dwExceptionFlags (0), and nNumberOfArguments (1) arguments. Unfortunately, it doesn't give us lpArguments! But, having nNumberOfArguments set to 1 does imply that we're right about the DelayLoadInfo struct is being passed in lpArguments. The exception code also gives a clue that we're interpreting things correctly: in [1], we see that 0x6d should be part of the exception code, and indeed it seems to be.

To get the fourth argument, we're going to have to look at the stack ourselves. Let's look at the stack around RaiseException's EBP (looking at ESP at this point probably wouldn't be helpful, as we're already 0x53 bytes into RaiseException, and it's probably moved the stack pointer farther down by now):

0:000> dds 0013f52c l6
0013f52c  0013f594
0013f530  027b8fcc WebKit!__delayLoadHelper2+0x13b [f:\dd\vctools\delayimp\delayhlp.cpp @ 331]
0013f534  c06d007e
0013f538  00000000
0013f53c  00000001
0013f540  0013f5a0

The left column is the memory address, the right column is the 4-byte word stored at that address. (I wish the rows were reversed, since the stack grows down from higher addresses. Oh well!) Going from the top row to the bottom, which means we're going backwards in time, we see:

0013f52c  0013f594

The EBP of the previous frame; RaiseException must have pushed it onto the stack before storing its own base pointer in EBP.

0013f530  027b8fcc WebKit!__delayLoadHelper2+0x13b [f:\dd\vctools\delayimp\delayhlp.cpp @ 331]

The return address; this was pushed here by the call instruction.

0013f534  c06d007e
0013f538  00000000
0013f53c  00000001

The first three arguments to RaiseException that we saw in the backtrace, which means the next row is...

0013f540  0013f5a0

The fourth argument, AKA lpArguments!

lpArguments is a ULONG_PTR*. We know there's only one argument being passed (from the nNumberOfArguments parameter), so lpArguments[0] should be a pointer to that DelayLoadInfo struct:

0:000> dd 0013f5a0 l1
0013f5a0  0013f550

0x0013f550 is the address of our DelayLoadInfo struct. The declaration of the struct in MSDN shows that it's 36 bytes long [4]. Let's have a look!

0:000> dds 0013f550 l9
0013f550  00000024
0013f554  028c57c4 WebKit!_DELAY_IMPORT_DESCRIPTOR_QTMovieWin_dll
0013f558  028f5374 WebKit!_imp_?initializeQuickTimeQTMovieSA_NXZ
0013f55c  028b1850 WebKit!_sz_QTMovieWin_dll
0013f560  00000001
0013f564  028c5dae WebKit!libxslt_NULL_THUNK_DATA_DLN+0x31a
0013f568  00000000
0013f56c  00000000
0013f570  0000007e

Inserting those values into the DelayLoadInfo declaration from MSDN gives:

struct DelayLoadInfo {
    DWORD           cb == 0x24;         // size of structure
    PCImgDelayDescr pidd == 0x28c57c4;       // raw form of data (everything is there)
    FARPROC *       ppfn == 0x28f5374;       // points to address of function to load
    LPCSTR          szDll == 0x28b1850;      // name of dll
    DelayLoadProc   dlp {
        BOOL fImportByName == 0x1;
        union {
            LPCSTR          szProcName == 0x28c5dae;
            DWORD           dwOrdinal;
        }
    }
    HMODULE         hmodCur == 0x0;    // the hInstance of the library we have loaded
    FARPROC         pfnCur == 0x0;     // the actual function that will be called
    DWORD           dwLastError == 0x7e; // error received (if an error notification)
}

We can confirm we've interpreted this correctly by looking at some of the strings involved:

0:000> da 028b1850
028b1850  "QTMovieWin.dll"
0:000> da 028c5dae
028c5dae  "?initializeQuickTime@QTMovie@@SA"
028c5dce  "_NXZ"

So we're trying to load QTMovieWin.dll and get the address of ?initializeQuickTime@QTMovie@@SA_NXZ. Looks like we've got it right.

The interesting thing here is dwLastError. Hopefully that will tell us what went wrong:

0:000> !error 7e
Error code: (Win32) 0x7e (126) - The specified module could not be found.

Oh. Great. We already knew that. But at least now we are more confident!

After going through all of this, I realized that the error code is right there in the exception code c06d007e. (See [1] for how that value is constructed.) And we also could have gotten it much more easily right from the start:

0:000> !gle
LastErrorValue: (Win32) 0x7e (126) - The specified module could not be found.
LastStatusValue: (NTSTATUS) 0xc0000135 - {Unable To Locate Component}  This application has failed to start because %hs was not found. Re-installing the application may fix this problem.

I'll choose to view this as a character-building experience. And I got to learn a little more about WinDbg, exceptions, and the delay-load mechanism!

1. http://msdn.microsoft.com/en-us/library/1c9e046h(v=VS.80).aspx
2. http://msdn.microsoft.com/en-us/library/ms680552(v=vs.85).aspx
3. http://msdn.microsoft.com/en-us/library/aa363082(v=vs.85).aspx
4. http://msdn.microsoft.com/en-us/library/16b2dyk5(v=vs.80).aspx

[Adam Roben (:aroben)]

Jyrki, could you try opening QTMovieWin.dll in Dependency Walker [1] and seeing if it gives you any errors?

1. http://www.dependencywalker.com/

[Steve Falkenburg]

I can repro this crash on Windows 7 x64 opening the twitter.com home page with:
http://build.webkit.org/archives/win-i386-release/76001.zip

[Steve Falkenburg]

(note that to repro, I had to actually log into my twitter account)

[Steve Falkenburg]

Hmm.. Crash went away when I disabled Application Verifier. False alarm (on my ability to repro).

[Jyrki Wahlstedt]

(In reply to comment #28)
> Jyrki, could you try opening QTMovieWin.dll in Dependency Walker [1] and seeing if it gives you any errors?
> 
> 1. http://www.dependencywalker.com/

I did that (the r76001 release build), got the following in the bottom pane:
Error: At least one required implicit or forwarded dependency was not found.
Warning: At least one delay-load dependency module was not found.
Warning: At least one module has an unresolved import due to a missing export function in a delay-load dependent module.

Not quite certain, though, how to read the information. However, there seems to be some missing files(?) JavaScriptCore.dll depends on (.dll files CoreFoundation, icuuc40, pthreadvc2, icuin40, ieshims, wer, and msvcr80). Of these the last one is odd, there's at least 11 copies of the file around the system (bad mngmnt, MS!), but none is found (the Platform SDK copies seem to be for 64-bit architecture).

Looking at the same in r74232 publicly downloadable nightly build produces the same with missing dll's CoreFoundation, pthreadvc2, ieshims, wer, and msvcr80.

BTW, I opened the other dll's, too, and got similar results, i.e. errors due to missing dependencies, so I'm not sure, how much sense this makes.

[Adam Roben (:aroben)]

(In reply to comment #32)
> (In reply to comment #28)
> > Jyrki, could you try opening QTMovieWin.dll in Dependency Walker [1] and seeing if it gives you any errors?
> > 
> > 1. http://www.dependencywalker.com/
> 
> I did that (the r76001 release build), got the following in the bottom pane:
> Error: At least one required implicit or forwarded dependency was not found.
> Warning: At least one delay-load dependency module was not found.
> Warning: At least one module has an unresolved import due to a missing export function in a delay-load dependent module.
> 
> Not quite certain, though, how to read the information. However, there seems to be some missing files(?) JavaScriptCore.dll depends on (.dll files CoreFoundation, icuuc40, pthreadvc2, icuin40, ieshims, wer, and msvcr80). Of these the last one is odd, there's at least 11 copies of the file around the system (bad mngmnt, MS!), but none is found (the Platform SDK copies seem to be for 64-bit architecture).
> 
> Looking at the same in r74232 publicly downloadable nightly build produces the same with missing dll's CoreFoundation, pthreadvc2, ieshims, wer, and msvcr80.
> 
> BTW, I opened the other dll's, too, and got similar results, i.e. errors due to missing dependencies, so I'm not sure, how much sense this makes.

I think what you need to do is this:

1) Create a new directory
2) Copy all the DLLs from %COMMONPROGRAMFILES%\Apple\Apple Application Support into that new directory
3) Copy all the DLLs from the WebKit build into that new directory (overwriting any existing files with the same names)

Then point Dependency Walker at WebKit.dll in the new directory.

[Jyrki Wahlstedt]

(In reply to comment #33)
> (In reply to comment #32)
> 
> I think what you need to do is this:
> 
> 1) Create a new directory
> 2) Copy all the DLLs from %COMMONPROGRAMFILES%\Apple\Apple Application Support into that new directory
> 3) Copy all the DLLs from the WebKit build into that new directory (overwriting any existing files with the same names)
> 
> Then point Dependency Walker at WebKit.dll in the new directory.

Well,
doesn't seem too promising, at least I don't get any errors except about missing IESHIMS.DLL, and WER.DLL (according to net search not really necessary here?). One symbol (in the module list pane), MPR.DLL, is shown red.
This is based on the latest, r76210 build from archive.

[Adam Roben (:aroben)]

(In reply to comment #34)
> (In reply to comment #33)
> > (In reply to comment #32)
> > 
> > I think what you need to do is this:
> > 
> > 1) Create a new directory
> > 2) Copy all the DLLs from %COMMONPROGRAMFILES%\Apple\Apple Application Support into that new directory
> > 3) Copy all the DLLs from the WebKit build into that new directory (overwriting any existing files with the same names)
> > 
> > Then point Dependency Walker at WebKit.dll in the new directory.
> 
> Well,
> doesn't seem too promising, at least I don't get any errors except about missing IESHIMS.DLL, and WER.DLL (according to net search not really necessary here?). One symbol (in the module list pane), MPR.DLL, is shown red.

<http://www.dependencywalker.com/faq.html> says that MPR.DLL isn't a problem, either.

So I guess missing dependencies isn't the issue. I wonder what could be causing the problem!

Have you tried catching this in the debugger with it set to break when exceptions are thrown (as opposed to when they are unhandled)? You can turn that on in VS via Debug > Exceptions... and checking all the checkboxes. When you hit the exception there might be more interesting information in the Output window.

[Jyrki Wahlstedt]

Encouraged by the functioning of the feature failed in 52795(?), I tried to load Twitter, and now everything goes ok! I can't tell what has happened in between, but something has cured the page. Thanks!

[Jyrki Wahlstedt]

Still ok with r76477 (from release archive)

[Steve Falkenburg]

Internal report with the same backtrace:
<rdar://problem/8990455>

[Jyrki Wahlstedt]

I've changed from WinXP to Win7 (broken disk, change not necessarily to better, but anyhow), so I am not able to provide any status checks anymore. Generally, however, I saw no repeatable crashes before the (disk & OS) change, so I'd say by me it's ok.

[Ahmad Saleem]

(In reply to Jyrki Wahlstedt from comment #39)
> I've changed from WinXP to Win7 (broken disk, change not necessarily to
> better, but anyhow), so I am not able to provide any status checks anymore.
> Generally, however, I saw no repeatable crashes before the (disk & OS)
> change, so I'd say by me it's ok.

Twitter has changed and also the bug reporter confirmed that it was not reproducible later for them.

Marking this as 'RESOLVED WONTFIX' (because it was never confirmed).