Internet explorer crashes in mshtml(v.6.0.2800.1264) when pressing backspace key

  • Thread starter Thread starter Paul Veitch
  • Start date Start date
P

Paul Veitch

Hi,

I have a very strange error happening with what I think is
the latest version of IE 6.
The error only happens on Windows XP SP1, IE reports
versions:

6.0.2800.1106.xpsp2.030422-1633
Update versions: SP1, Q818529, Q828750

On one machine, all of the windows in the current process
close without a message. On 2 other machines, the
following messages are displayed:

"The instruction at "0x6362e395" referenced memory
at "0x00000000", The memory could not be "read".

When the page then goes back to the previous page and the
following message is displayed:

"An error has occurred in Internet Explorer
Internet Explorer will now close

If you continue to experience problems, please restart
your computer"

I have a dump file from the affected machines, following
is the analysis from WinDBG of this file. Looking at the
stack trace the error occurs
in: "HandleAddAdornerNotification". The trace also seems
to be indicating that the page is being redrawn, although
the actual error is happening in the page that the delete
button was pressed on - I can tell this as I have put in
javascript to disable the backspace key from bubbling
(removing this code does not remove the problem).

I have tried reproducing the issue outside of the
application and cannot duplicate it.

Thanks very much for your help.
Paul Veitch


***********************************************************
********************
*
*
* Exception
Analysis *
*
*
***********************************************************
********************


FAULTING_IP:
MSHTML!CLayout::HandleAddAdornerNotification+97
6362e395 8b10 mov edx,[eax]

EXCEPTION_RECORD: ffffffff -- (.exr ffffffffffffffff)
ExceptionAddress: 6362e395 (MSHTML!
CLayout::HandleAddAdornerNotification+0x00000097)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000000
Attempt to read from address 00000000

DEFAULT_BUCKET_ID: APPLICATION_FAULT

PROCESS_NAME: IEXPLORE.EXE

READ_ADDRESS: 00000000

BUGCHECK_STR: ACCESS_VIOLATION

LAST_CONTROL_TRANSFER: from 635d7af7 to 6362e395

STACK_TEXT:
020ce01c 635d7af7 020ce0bc 02379a40 020ce0bc MSHTML!
CLayout::HandleAddAdornerNotification+0x97
020ce04c 63638fd6 020ce0bc 01000000 00002000 MSHTML!
CFlowLayout::Notify+0x2da
020ce064 635d7879 00000001 02378bd0 020ce0bc MSHTML!
CTableCellLayout::Notify+0xb2
020ce07c 635d86c3 02378bd0 020ce0bc 00000000 MSHTML!
NotifyElement+0x48
020ce098 635d858d 020ce0bc 02378c00 00000001 MSHTML!
NotifyTreeNode+0x4d
020ce0f8 635d75d0 020ce184 050b5b18 020ce184 MSHTML!
NotifyAncestors+0xe6
020ce154 635d757a 02378cb0 050b5bd8 00000000 MSHTML!
CMarkup::SendNotification+0x78
020ce170 6362e4f9 020ce184 00000000 02362a90 MSHTML!
CMarkup::Notify+0xac
020ce1bc 635fd7ec 02378f50 00000000 00000001 MSHTML!
CAdorner::EnsureDispNode+0x92
020ce1cc 635fd794 02362a90 02378cb0 637ea998 MSHTML!
CFocusAdorner::EnsureDispNode+0x8c
020ce208 636366c0 050b5cc8 63636640 02378cb0 MSHTML!
CFocusAdorner::ShapeChanged+0x11c
020ce210 63636640 02378cb0 00000000 00000000 MSHTML!
CFocusAdorner::SetElement+0x47
020ce22c 636372de 00000000 00000000 02378cb0 MSHTML!
CView::SetFocus+0x137
020ce2ec 63636e6a 02378f50 00000000 00000000 MSHTML!
CDoc::SetCurrentElem+0x51d
020ce330 635d9b69 00000000 00000000 00000000 MSHTML!
CElement::BecomeCurrent+0xc5
020ce3a4 63603845 0238c590 02378cb0 020ce544 MSHTML!
CElement::Notify+0x436
020ce3bc 635d7858 020ce544 0000011a 031228b0 MSHTML!
CAnchorElement::Notify+0x11
020ce3d4 635fcecb 02378cb0 020ce544 020ce510 MSHTML!
NotifyElement+0xb9
020ce4b4 635d74f9 020ce544 050b5b18 020ce544 MSHTML!
CMarkup::NotifyDescendents+0x92
020ce510 635d757a 0238c570 00000000 00000400 MSHTML!
CMarkup::SendNotification+0x78
020ce52c 635fa54e 020ce544 050b5b18 0238c590 MSHTML!
CMarkup::Notify+0xac
020ce588 635d95b8 050b5b18 050b5b28 0238c590 MSHTML!
CMarkup::OnLoadStatusParseDone+0x201
020ce598 635ff969 00000004 020cea0c 0015b408 MSHTML!
CMarkup::OnLoadStatus+0x7f
020ce9d8 635ff986 0239adf0 00000000 63599a6b MSHTML!
CProgSink::DoUpdate+0x46d
020ce9e4 63599a6b 0239adf0 0239adf0 00000000 MSHTML!
CProgSink::OnMethodCall+0xb
020cea18 63581d60 020cebb0 63581ca7 00000000 MSHTML!
GlobalWndOnMethodCall+0x64
020ceb3c 77d67ad7 000c0322 000000c2 00000000 MSHTML!
GlobalWndProc+0x193
020ceb68 77d6ccd4 63581ca7 000c0322 00008002 user32!
InternalCallWinProc+0x1b
020cebd0 77d44455 00000000 63581ca7 000c0322 user32!
UserCallWinProcCheckWow+0x150
020cec30 77d495d5 020cee74 00000000 75f8cbc7 user32!
DispatchMessageWorker+0x306
020cec3c 75f8cbc7 020cee74 00000000 001e2c08 user32!
DispatchMessageW+0xb
020cec54 75f8cba5 020cee74 020cffac 050987e0 browseui!
TimedDispatchMessage+0x35
020ceeac 75f958bd 00000000 020cffac 050987e0 browseui!
BrowserThreadProc+0x2d5
020cef38 75f9b91b 050987e0 ffffffff 77f944a8 browseui!
BrowserProtectedThreadProc+0xce
020cffb4 77e7d33b 050987e0 ffffffff 77f944a8 browseui!
SHOpenFolderWindow+0x1fc
020cffec 00000000 71730bd3 050987e0 00000000 kernel32!
BaseThreadStart+0x37


FOLLOWUP_IP:
browseui!TimedDispatchMessage+35
75f8cbc7 a1d0650076 mov eax,[browseui!
g_dwStopWatchMode (760065d0)]

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: browseui!TimedDispatchMessage+35

MODULE_NAME: browseui

IMAGE_NAME: browseui.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 3d6dfa1c

STACK_COMMAND: .ecxr ; kb

BUCKET_ID: ACCESS_VIOLATION_browseui!
TimedDispatchMessage+35

Followup: MachineOwner
 
I was going to give you a MS KB article to read but found a whole heap of
them. Go to MS Kb, select IE6 as your product, and do search for 'MSHTML' -
it will return quite a few causes for this along with the appropriate fixes.

Kev
 
Thanks for the Reply, however I have gone through all of
these and tried the fixes suggested, most of them however
relate to a previous version, suggesting updating to the
latest version (which these machines are running).
 
Paul Veitch said:
Hi,

I have a very strange error happening with what I think is
the latest version of IE 6.
The error only happens on Windows XP SP1, IE reports
versions:

6.0.2800.1106.xpsp2.030422-1633
Update versions: SP1, Q818529, Q828750

On one machine, all of the windows in the current process
close without a message. On 2 other machines, the
following messages are displayed:

"The instruction at "0x6362e395" referenced memory
at "0x00000000", The memory could not be "read".

When the page then goes back to the previous page and the
following message is displayed:

"An error has occurred in Internet Explorer
Internet Explorer will now close

If you continue to experience problems, please restart
your computer"

I have a dump file from the affected machines, following
is the analysis from WinDBG of this file. Looking at the
stack trace the error occurs
in: "HandleAddAdornerNotification". The trace also seems
to be indicating that the page is being redrawn, although
the actual error is happening in the page that the delete
button was pressed on - I can tell this as I have put in
javascript to disable the backspace key from bubbling
(removing this code does not remove the problem).

I have tried reproducing the issue outside of the
application and cannot duplicate it.

Thanks very much for your help.
Paul Veitch


***********************************************************
********************
*
*
* Exception
Analysis *
*
*
***********************************************************
********************


FAULTING_IP:
MSHTML!CLayout::HandleAddAdornerNotification+97
6362e395 8b10 mov edx,[eax]

EXCEPTION_RECORD: ffffffff -- (.exr ffffffffffffffff)
ExceptionAddress: 6362e395 (MSHTML!
CLayout::HandleAddAdornerNotification+0x00000097)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000000
Attempt to read from address 00000000

DEFAULT_BUCKET_ID: APPLICATION_FAULT

PROCESS_NAME: IEXPLORE.EXE

READ_ADDRESS: 00000000

BUGCHECK_STR: ACCESS_VIOLATION

LAST_CONTROL_TRANSFER: from 635d7af7 to 6362e395

STACK_TEXT:
020ce01c 635d7af7 020ce0bc 02379a40 020ce0bc MSHTML!
CLayout::HandleAddAdornerNotification+0x97
020ce04c 63638fd6 020ce0bc 01000000 00002000 MSHTML!
CFlowLayout::Notify+0x2da
020ce064 635d7879 00000001 02378bd0 020ce0bc MSHTML!
CTableCellLayout::Notify+0xb2
020ce07c 635d86c3 02378bd0 020ce0bc 00000000 MSHTML!
NotifyElement+0x48
020ce098 635d858d 020ce0bc 02378c00 00000001 MSHTML!
NotifyTreeNode+0x4d
020ce0f8 635d75d0 020ce184 050b5b18 020ce184 MSHTML!
NotifyAncestors+0xe6
020ce154 635d757a 02378cb0 050b5bd8 00000000 MSHTML!
CMarkup::SendNotification+0x78
020ce170 6362e4f9 020ce184 00000000 02362a90 MSHTML!
CMarkup::Notify+0xac
020ce1bc 635fd7ec 02378f50 00000000 00000001 MSHTML!
CAdorner::EnsureDispNode+0x92
020ce1cc 635fd794 02362a90 02378cb0 637ea998 MSHTML!
CFocusAdorner::EnsureDispNode+0x8c
020ce208 636366c0 050b5cc8 63636640 02378cb0 MSHTML!
CFocusAdorner::ShapeChanged+0x11c
020ce210 63636640 02378cb0 00000000 00000000 MSHTML!
CFocusAdorner::SetElement+0x47
020ce22c 636372de 00000000 00000000 02378cb0 MSHTML!
CView::SetFocus+0x137
020ce2ec 63636e6a 02378f50 00000000 00000000 MSHTML!
CDoc::SetCurrentElem+0x51d
020ce330 635d9b69 00000000 00000000 00000000 MSHTML!
CElement::BecomeCurrent+0xc5
020ce3a4 63603845 0238c590 02378cb0 020ce544 MSHTML!
CElement::Notify+0x436
020ce3bc 635d7858 020ce544 0000011a 031228b0 MSHTML!
CAnchorElement::Notify+0x11
020ce3d4 635fcecb 02378cb0 020ce544 020ce510 MSHTML!
NotifyElement+0xb9
020ce4b4 635d74f9 020ce544 050b5b18 020ce544 MSHTML!
CMarkup::NotifyDescendents+0x92
020ce510 635d757a 0238c570 00000000 00000400 MSHTML!
CMarkup::SendNotification+0x78
020ce52c 635fa54e 020ce544 050b5b18 0238c590 MSHTML!
CMarkup::Notify+0xac
020ce588 635d95b8 050b5b18 050b5b28 0238c590 MSHTML!
CMarkup::OnLoadStatusParseDone+0x201
020ce598 635ff969 00000004 020cea0c 0015b408 MSHTML!
CMarkup::OnLoadStatus+0x7f
020ce9d8 635ff986 0239adf0 00000000 63599a6b MSHTML!
CProgSink::DoUpdate+0x46d
020ce9e4 63599a6b 0239adf0 0239adf0 00000000 MSHTML!
CProgSink::OnMethodCall+0xb
020cea18 63581d60 020cebb0 63581ca7 00000000 MSHTML!
GlobalWndOnMethodCall+0x64
020ceb3c 77d67ad7 000c0322 000000c2 00000000 MSHTML!
GlobalWndProc+0x193
020ceb68 77d6ccd4 63581ca7 000c0322 00008002 user32!
InternalCallWinProc+0x1b
020cebd0 77d44455 00000000 63581ca7 000c0322 user32!
UserCallWinProcCheckWow+0x150
020cec30 77d495d5 020cee74 00000000 75f8cbc7 user32!
DispatchMessageWorker+0x306
020cec3c 75f8cbc7 020cee74 00000000 001e2c08 user32!
DispatchMessageW+0xb
020cec54 75f8cba5 020cee74 020cffac 050987e0 browseui!
TimedDispatchMessage+0x35
020ceeac 75f958bd 00000000 020cffac 050987e0 browseui!
BrowserThreadProc+0x2d5
020cef38 75f9b91b 050987e0 ffffffff 77f944a8 browseui!
BrowserProtectedThreadProc+0xce
020cffb4 77e7d33b 050987e0 ffffffff 77f944a8 browseui!
SHOpenFolderWindow+0x1fc
020cffec 00000000 71730bd3 050987e0 00000000 kernel32!
BaseThreadStart+0x37


FOLLOWUP_IP:
browseui!TimedDispatchMessage+35
75f8cbc7 a1d0650076 mov eax,[browseui!
g_dwStopWatchMode (760065d0)]

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: browseui!TimedDispatchMessage+35

MODULE_NAME: browseui

IMAGE_NAME: browseui.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 3d6dfa1c

STACK_COMMAND: .ecxr ; kb

BUCKET_ID: ACCESS_VIOLATION_browseui!
TimedDispatchMessage+35

Followup: MachineOwner
Click to expand...

See
Dealing with Unwanted Spyware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm
 
Frank,

Thanks for getting back to me, I have verified that there
are no parasites/toolbars/search engines. Perhaps I did
not explain the set up; I am in a corporate environment,
some machines running Win2k, some XP, all machines are
running the latest anti-virus, and all of the latest
patches. These errors only happen on one page of the
application that we are developing, and only on XP, and
has only happened since we applied the October 2003
security patches. If you look at the stack trace in the
original post - it appears to be a layout bug in MSHTML -
what I am looking for is an explaination, perhaps there is
some "invalid" markup that is specific to this page, or
some invalid JavaScript, or something else special about
this page.

I repeat, it is not an average run of the mill type of
problem, or a general internet browsing problem - it only
happens on this one page, and is very consistent, and
reproducible.

Thanks for any help you can provide.
Paul Veitch
 
Issues with IE and mshtml.
http://www.generation.net/~hleboeuf/ermshtml.htm



Paul Veitch said:
Frank,

Thanks for getting back to me, I have verified that there
are no parasites/toolbars/search engines. Perhaps I did
not explain the set up; I am in a corporate environment,
some machines running Win2k, some XP, all machines are
running the latest anti-virus, and all of the latest
patches. These errors only happen on one page of the
application that we are developing, and only on XP, and
has only happened since we applied the October 2003
security patches. If you look at the stack trace in the
original post - it appears to be a layout bug in MSHTML -
what I am looking for is an explaination, perhaps there is
some "invalid" markup that is specific to this page, or
some invalid JavaScript, or something else special about
this page.

I repeat, it is not an average run of the mill type of
problem, or a general internet browsing problem - it only
happens on this one page, and is very consistent, and
reproducible.

Thanks for any help you can provide.
Paul Veitch
Click to expand...
 
Back
Top