Application Crash - Access Violation in MSHTML.DLL RRS feed

  • Question

  • I have a problem where my application crashes in a specific scenario. Here are the details.

    My app is IWebBrowser2 control based. The HTML document in the control has an IFRAME in which different pages are loaded as per a selection criteria. The crash occurs in the following scenario.

    1) Load a particular page (say PAGE 1) in the IFRAME

    2) Clicking on a link on this page pops up a modal dialog which is also IWebBrowser2 based. The page in this modal dialog contains some    (around 20-25) custom checkboxes in a table (along with some custom dropdown elements).

    3) Close this modal dialog. Load another page (say PAGE 2) in the IFRAME.

    4) Navigating back to PAGE 1 results in an MSHTML crash (access violation).

    One particular observation is that, when I remove the 'background-image' property for the custom checkboxes and dropdowns, this particular crash doesn't occur.

    Here are further more details.

    OS: Windows XP Professional SP2 32-bit

    IE Version: 6.0.2900.2180.xpsp_sp2_rtm.040803-2158


    0012eb38 7dc5fbed 00000000 0012eb58 7dcd31b5 mshtml!CFancyFormat::Compare+0x18
    0012eb44 7dcd31b5 0012f1ec 00000000 06511104 mshtml!CDataCache<CFancyFormat>::CompareData+0x10
    0012eb58 7dc4abdb 06511100 0012f1ec 000001a9 mshtml!CDataCacheBase::CompareIt+0x1d
    0012eb6c 7dc63ed1 06d653d8 000003f0 0012f1ec mshtml!CHtPvPv::HtKeyEqual+0x2d
    0012eb90 7dcd46af 000003f0 0012f1ec 0012ebb4 mshtml!CHtPvPv::LookupSlow+0x7d
    0012ebb8 7dc4d1e6 0012f1ec 06510930 0012f054 mshtml!CDataCacheBase::Find+0x2e
    0012ebd0 7dc608db 0012f1ec 0012ec04 00000000 mshtml!CDataCacheBase::CacheData+0x14
    0012ec08 7dc62c9a 0012f054 067d3f60 067d32c0 mshtml!CTreeNode::CacheNewFormats+0x2ea
    0012ec44 7dc6176e ffffffff 067d32c0 067d32c0 mshtml!CRootElement::ComputeFormatsVirtual+0x2de
    0012ec60 7dc6224e 0012f054 067d32c0 067f27b0 mshtml!CElement::ComputeFormats+0x3a
    0012eca4 7dc6176e 067d32c0 067f2830 067f2830 mshtml!CElement::ComputeFormatsVirtual+0x141
    0012ecc0 7dc6224e 0012f054 067f2830 065fa7a0 mshtml!CElement::ComputeFormats+0x3a
    0012ed04 7dc6176e 067f2830 065fa840 065fa840 mshtml!CElement::ComputeFormatsVirtual+0x141
    0012ed20 7dc6224e 0012f054 065fa840 065fadb0 mshtml!CElement::ComputeFormats+0x3a
    0012ed64 7dc6176e 065fa840 065fae50 065fae50 mshtml!CElement::ComputeFormatsVirtual+0x141
    0012ed80 7dc6224e 0012f054 065fae50 065faeb0 mshtml!CElement::ComputeFormats+0x3a
    0012edc4 7dc6176e 065fae50 065fb880 065fb880 mshtml!CElement::ComputeFormatsVirtual+0x141
    0012ede0 7dc6224e 0012f054 065fb880 065fb8e0 mshtml!CElement::ComputeFormats+0x3a
    0012ee24 7dc6176e 065fb880 065fc710 065fc710 mshtml!CElement::ComputeFormatsVirtual+0x141
    0012ee40 7dc6224e 0012f054 065fc710 065fc850 mshtml!CElement::ComputeFormats+0x3a
    0012ee84 7dc6176e 065fc710 065fca00 065fca00 mshtml!CElement::ComputeFormatsVirtual+0x141
    0012eea0 7dc6224e 0012f054 065fca00 065fca70 mshtml!CElement::ComputeFormats+0x3a
    0012eee4 7dc6176e 065fca00 065fcb10 065fcb10 mshtml!CElement::ComputeFormatsVirtual+0x141
    0012ef00 7dc6224e 0012f054 065fcb10 065fcb40 mshtml!CElement::ComputeFormats+0x3a
    0012ef44 7dc6176e 065fcb10 065fcbd0 065fcbd0 mshtml!CElement::ComputeFormatsVirtual+0x141
    0012ef60 7dc6224e 0012f054 065fcbd0 065fcc00 mshtml!CElement::ComputeFormats+0x3a
    0012efa4 7dc6176e 065fcbd0 065fcc40 065fcc40 mshtml!CElement::ComputeFormatsVirtual+0x141
    0012efc0 7dc6224e 0012f054 065fcc40 065fcd30 mshtml!CElement::ComputeFormats+0x3a
    0012f004 7dc974a5 065fcc40 065fcd30 065fcc70 mshtml!CElement::ComputeFormatsVirtual+0x141
    0012f024 7dc6176e 0012f054 065fcd30 065fcd60 mshtml!CTableRow::ComputeFormatsVirtual+0x196
    0012f040 7dc92825 0012f054 065fcd30 0012f368 mshtml!CElement::ComputeFormats+0x3a
    0012f2bc 7dc9774e 065fcd60 065fce00 0012f368 mshtml!CTreeNode::GetParaFormatHelper+0x33
    0012f338 7dc6176e 00000063 065fce00 00000000 mshtml!CTableCell::ComputeFormatsVirtual+0x129
    0012f354 7dc85798 0012f368 065fce00 065fce00 mshtml!CElement::ComputeFormats+0x3a
    0012f5d0 7dc9710b 065fd4a0 065fcd60 00000000 mshtml!CTreeNode::GetFancyFormatHelper+0x33
    0012f608 7dc987a4 065fcd60 065fcd60 0012f644 mshtml!CTableRowLayout::AddCell+0x67
    0012f61c 7dc98738 065fcd60 067d9850 0012f684 mshtml!CTableCell::EnterTree+0x53
    0012f62c 7dc50e01 0012f644 00000000 00000001 mshtml!CTableCell::Notify+0x80
    0012f684 7dc50eaa 00a131ac 067d8840 00000000 mshtml!CHtmRootParseCtx::FlushNotifications+0xa5
    0012f698 7dc4cf17 067d8180 067d8840 7dc4d5a2 mshtml!CHtmParse::Commit+0x4b
    0012f6a4 7dc4d5a2 7dc50e67 00a131ac 067d8840 mshtml!CHtmPost::Broadcast+0xd
    0012f760 7dc81b98 00a131ac 067d8840 06510930 mshtml!CHtmPost::Exec+0x137
    0012f778 7dc64a38 00a131ac 06510930 067d8840 mshtml!CHtmPost::Run+0x55
    0012f788 7dc64e77 06510930 00a131ac 067d8840 mshtml!PostManExecute+0x51
    0012f7a0 7dc64dfa 067d8840 00000001 7dc63e50 mshtml!PostManResume+0x71
    0012f7ac 7dc63e50 067d8b10 067d8840 0012f7f0 mshtml!CHtmPost::OnDwnChanCallback+0xc
    0012f7bc 7dc4cb02 067d8b10 00000000 00000000 mshtml!CDwnChan::OnMethodCall+0x19
    0012f7f0 7dc489d8 0012f98c 7dc488f3 00000000 mshtml!GlobalWndOnMethodCall+0x66
    0012f924 77d18709 00050114 00008002 00000000 mshtml!GlobalWndProc+0x1e2
    0012f950 77d187eb 7dc488f3 00050114 00008002 user32!InternalCallWinProc+0x28
    0012f9b8 77d189a5 00000000 7dc488f3 00050114 user32!UserCallWinProcCheckWow+0x150
    0012fa18 77d189e8 0012fa44 00000000 77d18bce user32!DispatchMessageWorker+0x306
    0012fa28 0040232e 0012fa44 00000008 0012fd74 user32!DispatchMessageW+0xf

    I would appreciate any help on this. Please let me know if i missed any detail.


    Friday, March 11, 2011 12:47 PM


  • Microsoft has officially asked our customers and partners to Please Stop Using IE6
    SDET Windows C++ CodeGenerationTeam - Performance
    • Marked as answer by lucy-liu Friday, March 18, 2011 9:52 AM
    Sunday, March 13, 2011 8:45 AM

All replies

  • Can you test on a system with a newer version of IE?  So far your evidence suggests it's just a bug in IE.
    Friday, March 11, 2011 4:33 PM
  • Actually, after installing Windows XP Service Pack 3 the issue dissappeared.Also, this issue doesn't occur in the presence of IE7 and IE8. It seems to be an IE6 specific issue (that too pre-SP3).

    But when I eliminated the modal dialog, and put all those custom checkboxes/dropdownn in the original parent page (i.e. PAGE 1), the issue doesn't appear. The issue seems to occur only in presence of this modal dialog. This observation (upto a certain extent) forced me to believe that the issue could be on my side.

    Friday, March 11, 2011 6:01 PM
  • Microsoft has officially asked our customers and partners to Please Stop Using IE6
    SDET Windows C++ CodeGenerationTeam - Performance
    • Marked as answer by lucy-liu Friday, March 18, 2011 9:52 AM
    Sunday, March 13, 2011 8:45 AM