none
Blue screen with mini dump - EXCEPTION_CODE: 0xc0000005 RRS feed

  • 질문

  • hi

    our company application crash(blue screen) randomly.

    our company application process name is LinkMain.exe shown as below dump log.

    we use C++ user-mode. not kernel-mode.

    but like below dump log. the log show that crash always happen in win32k!XLATE::pfnXlateBetweenBitfields+0x6(stack)

    as I know, generally blue screen happen in kernel mode. but we don't use kernel-mode.

    and H/W device nothing to do with this blue screen. we checked all of device and driver. there is no issue.

    so I'm guessing that our program have problem with this.

    but how could happen blue screen in user mode?

    as below dump log, every dump show same stack trace.

    crash happen in win32k!XLATE::pfnXlateBetweenBitfields+0x6 code.

    the cause is memory violation. "pfnXlateBetweenBitfields"  is GDI function.

    the meaning is that the crash have to do with GDI?

    and we just use DC object. not GDI Plus.

    could anyone help me about cause of blue screen?  your any comment will hep me.

    STACK_TEXT:  
    a8595568 bf966c5a 00000000 0000000a e1284018 win32k!XLATE::pfnXlateBetweenBitfields+0x6
    a85955a0 bf836b4e bf9a5ea8 00000000 001ed8a0 win32k!vSrcCopyS16D24+0x4e
    a85957b4 bf844f5f e36f12b8 00000000 00000000 win32k!EngCopyBits+0x51a
    a8595870 bf8455d9 00000018 00000000 0000000a win32k!GreGetDIBitsInternal+0x79f
    a8595908 8054161c 08010b4c 0b0509f0 00000000 win32k!NtGdiGetDIBitsInternal+0x27e
    a8595934 7c90e4f4 badb0d00 00115234 bf8513fb nt!RtlIpv4StringToAddressExW+0x9d
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    a8595948 00000000 00000000 00000000 80535733 0x7c90e4f4

    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - "0x%08lx"               "0x%08lx"                        .          "%s"                .

    FAULTING_IP: 
    win32k!XLATE::pfnXlateBetweenBitfields+6
    bf8ed7f7 8b4910          mov     ecx,dword ptr [ecx+10h]

    TRAP_FRAME:  a85954f8 -- (.trap 0xffffffffa85954f8)
    ErrCode = 00000000
    eax=ffffff99 ebx=04910144 ecx=00000000 edx=00000000 esi=001eda74 edi=00000011
    eip=bf8ed7f7 esp=a859556c ebp=a85955a0 iopl=0         nv up ei ng nz na pe nc
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010286
    win32k!XLATE::pfnXlateBetweenBitfields+0x6:
    bf8ed7f7 8b4910          mov     ecx,dword ptr [ecx+10h] ds:0023:00000010=????????
    Resetting default scope

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  DRIVER_FAULT

    BUGCHECK_STR:  0x8E

    PROCESS_NAME:  LinkMain.exe

    LAST_CONTROL_TRANSFER:  from bf966c5a to bf8ed7f7

    STACK_TEXT:  
    a8595568 bf966c5a 00000000 0000000a e1284018 win32k!XLATE::pfnXlateBetweenBitfields+0x6
    a85955a0 bf836b4e bf9a5ea8 00000000 001ed8a0 win32k!vSrcCopyS16D24+0x4e
    a85957b4 bf844f5f e36f12b8 00000000 00000000 win32k!EngCopyBits+0x51a
    a8595870 bf8455d9 00000018 00000000 0000000a win32k!GreGetDIBitsInternal+0x79f
    a8595908 8054161c 08010b4c 0b0509f0 00000000 win32k!NtGdiGetDIBitsInternal+0x27e
    a8595934 7c90e4f4 badb0d00 00115234 bf8513fb nt!RtlIpv4StringToAddressExW+0x9d
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    a8595948 00000000 00000000 00000000 80535733 0x7c90e4f4


    STACK_COMMAND:  kb

    FOLLOWUP_IP: 
    win32k!XLATE::pfnXlateBetweenBitfields+6
    bf8ed7f7 8b4910          mov     ecx,dword ptr [ecx+10h]

    SYMBOL_STACK_INDEX:  0

    SYMBOL_NAME:  win32k!XLATE::pfnXlateBetweenBitfields+6

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: win32k

    IMAGE_NAME:  win32k.sys

    DEBUG_FLR_IMAGE_TIMESTAMP:  48025f2a

    FAILURE_BUCKET_ID:  0x8E_win32k!XLATE::pfnXlateBetweenBitfields+6

    BUCKET_ID:  0x8E_win32k!XLATE::pfnXlateBetweenBitfields+6

    Followup: MachineOwner

    2014년 2월 10일 월요일 오전 6:06

모든 응답

  • Please understand that debugging is not officially supported in Technet forum, please contact Korea CSS if you need any help on dump file debugging.

    [Microsoft 고객지원센터]

    1577-9700

    2014년 2월 10일 월요일 오전 7:22
    중재자