spooler crashing

  • Thread starter Thread starter eric
  • Start date Start date
E

eric

Hi, I have a problem when developing a print monitor,I am using
win2k,SP4, the monitor works fine when I logon as administrator but
crash when I logon as user. the DrWtsn32 log shows spooler crashed at:

function: RtlEnterCriticalSection
77f82060 648b0d18000000 mov ecx,fs:[00000018]
fs:00000018=????????
77f82067 8b542404 mov edx,[esp+0x4]
ss:02047b57=????????
FAULT ->77f8206b 837a1400 cmp dword ptr [edx+0x14],0x0
ds:00a79f06=????????
77f8206f 0f859c7b0100 jne NtSetTimerResolution+0x227d
(77f99c11)
77f82075 90 nop
77f82076 ff4204 inc dword ptr [edx+0x4]
ds:00a79f06=????????
77f82079 0f852e080000 jne ZwQueryInformationThread+0xe
(77f828ad)
77f8207f 8b4124 mov eax,[ecx+0x24]
ds:80a21ee6=????????
77f82082 89420c mov [edx+0xc],eax
ds:00a79f06=????????
77f82085 c7420801000000 mov dword ptr [edx+0x8],0x1
ds:00a79f06=????????
77f8208c 33c0 xor eax,eax
77f8208e c20400 ret 0x4

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
015CDCB4 00D325B9 00000000 00D31340 015CE5E4 00C96F28
ntdll!RtlEnterCriticalSection
015CE658 00D32D7F 00D31A9C 00C96F28 00C9F2F0 00001000 !<nosymbols>
015CE674 761275BD 00D35580 00000001 00C9EFC8 015CF6E4
!InitializePrintMonitorUI
00000000 00000000 00000000 00000000 00000000 00000000
localspl!PrintDocumentOnPrintProcessor


Any one see this problem before? Any help will be welcome!
Eric
 
The symbols are wrong, but I can see a monitor on the stack. I assume the
monitor passes a bad critical section pointer to EnterCriticalSection.

Get the correct symbols and then set breakpoints on your monitor's
StartDocPort and WritePort (to begin with). Print and trace inthe debugger
through your code. Have a look what you're passing in to
EnterCriticalSection.

Hope this helps
 
Felix:
Thanks very much for reply, I did a lot of testing for this problem,
Here is more detail:
My system is a Dell machine + window2000(latest SP4) + Deepfreeze(a OS
freeze software to protect public computer).

It is not like a coding error:
1)On the same machine, if I logon as an administrator, there is no any
problem for printing.
2)When I logon as a User, normally the spooler crashed when I try to
print the second job.And the spooler still crashs even after I removed
criticalsection from my monitor code, just not that often,not for the
second printing, usually crash after 5 or 6 print. and Dr watson log
looks like it crashed at same place.
3)With the critical section code, if I uninstalled the Deepfreeze, the
print monitor works fine.

Is it sounds like a Deepfreeze problem? Might related,but should
relate with something else.
4)My project is building a Window2000 image for customer plus a
special print monitor,the project starts from months ago, and keeps
updating by adding software and service package, before June, we
didn't see any problem when using my latest print monitor and
Deepfreeze .
So, the problem looks like caused by some update in Window2000
combined with Deepfreeze, of course still might be my coding
error.Unfortunately, we didnot trace the window2000 updating, we just
go to the microsoft web site and intall all updates. I compared the my
June Windows image and the latest one, some dll (like sp3res.dll) are
updated, but I can not classify which update is related.

As the explaination from MSDN, the "EnterCriticalSection" might fail
when memory is low, Any body knows how to verify it?

Felix, thanks for you response,Do you have idea which system library
are involved when print to print monitor?
Thanks advance any help or suggestion to fix or narrow down the
problem.

Eric

Felix Maxa said:
The symbols are wrong, but I can see a monitor on the stack. I assume the
monitor passes a bad critical section pointer to EnterCriticalSection.

Get the correct symbols and then set breakpoints on your monitor's
StartDocPort and WritePort (to begin with). Print and trace inthe debugger
through your code. Have a look what you're passing in to
EnterCriticalSection.

Hope this helps

--
Felix Maxa
Windows Printing Team

This posting is provided "AS IS" with no warranties, and confers no rights.


eric said:
Hi, I have a problem when developing a print monitor,I am using
win2k,SP4, the monitor works fine when I logon as administrator but
crash when I logon as user. the DrWtsn32 log shows spooler crashed at:

function: RtlEnterCriticalSection
77f82060 648b0d18000000 mov ecx,fs:[00000018]
fs:00000018=????????
77f82067 8b542404 mov edx,[esp+0x4]
ss:02047b57=????????
FAULT ->77f8206b 837a1400 cmp dword ptr [edx+0x14],0x0
ds:00a79f06=????????
77f8206f 0f859c7b0100 jne NtSetTimerResolution+0x227d
(77f99c11)
77f82075 90 nop
77f82076 ff4204 inc dword ptr [edx+0x4]
ds:00a79f06=????????
77f82079 0f852e080000 jne ZwQueryInformationThread+0xe
(77f828ad)
77f8207f 8b4124 mov eax,[ecx+0x24]
ds:80a21ee6=????????
77f82082 89420c mov [edx+0xc],eax
ds:00a79f06=????????
77f82085 c7420801000000 mov dword ptr [edx+0x8],0x1
ds:00a79f06=????????
77f8208c 33c0 xor eax,eax
77f8208e c20400 ret 0x4

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
015CDCB4 00D325B9 00000000 00D31340 015CE5E4 00C96F28
ntdll!RtlEnterCriticalSection
015CE658 00D32D7F 00D31A9C 00C96F28 00C9F2F0 00001000 !<nosymbols>
015CE674 761275BD 00D35580 00000001 00C9EFC8 015CF6E4
!InitializePrintMonitorUI
00000000 00000000 00000000 00000000 00000000 00000000
localspl!PrintDocumentOnPrintProcessor


Any one see this problem before? Any help will be welcome!
Eric
Click to expand...
Click to expand...
 
Can you print as regular user with a different port monitor? Add a queue and
a local port called "nul:" and print to it as user. Does the spooler crash?

I am not familiar with Deepfreeze. It might inject DLLs in the spooler
process and this can lead to instability under certain circumstances.

It is true that EnterCriticalSection can fail on w2k/xp. This happens if
there is contention on the CS when the machine is out of memory. It's very
hard to reach this state on a workstation. I wouldn't suspect this for now.
I don't quite understand the question.

--
Felix Maxa
Windows Printing Team

This posting is provided "AS IS" with no warranties, and confers no rights.


eric said:
Felix:
Thanks very much for reply, I did a lot of testing for this problem,
Here is more detail:
My system is a Dell machine + window2000(latest SP4) + Deepfreeze(a OS
freeze software to protect public computer).

It is not like a coding error:
1)On the same machine, if I logon as an administrator, there is no any
problem for printing.
2)When I logon as a User, normally the spooler crashed when I try to
print the second job.And the spooler still crashs even after I removed
criticalsection from my monitor code, just not that often,not for the
second printing, usually crash after 5 or 6 print. and Dr watson log
looks like it crashed at same place.
3)With the critical section code, if I uninstalled the Deepfreeze, the
print monitor works fine.

Is it sounds like a Deepfreeze problem? Might related,but should
relate with something else.
4)My project is building a Window2000 image for customer plus a
special print monitor,the project starts from months ago, and keeps
updating by adding software and service package, before June, we
didn't see any problem when using my latest print monitor and
Deepfreeze .
So, the problem looks like caused by some update in Window2000
combined with Deepfreeze, of course still might be my coding
error.Unfortunately, we didnot trace the window2000 updating, we just
go to the microsoft web site and intall all updates. I compared the my
June Windows image and the latest one, some dll (like sp3res.dll) are
updated, but I can not classify which update is related.

As the explaination from MSDN, the "EnterCriticalSection" might fail
when memory is low, Any body knows how to verify it?

Felix, thanks for you response,Do you have idea which system library
are involved when print to print monitor?
Thanks advance any help or suggestion to fix or narrow down the
problem.

Eric

Felix Maxa said:
The symbols are wrong, but I can see a monitor on the stack. I assume the
monitor passes a bad critical section pointer to EnterCriticalSection.

Get the correct symbols and then set breakpoints on your monitor's
StartDocPort and WritePort (to begin with). Print and trace inthe
debugger
through your code. Have a look what you're passing in to
EnterCriticalSection.

Hope this helps

--
Felix Maxa
Windows Printing Team

This posting is provided "AS IS" with no warranties, and confers no
rights.


eric said:
Hi, I have a problem when developing a print monitor,I am using
win2k,SP4, the monitor works fine when I logon as administrator but
crash when I logon as user. the DrWtsn32 log shows spooler crashed at:

function: RtlEnterCriticalSection
77f82060 648b0d18000000 mov ecx,fs:[00000018]
fs:00000018=????????
77f82067 8b542404 mov edx,[esp+0x4]
ss:02047b57=????????
FAULT ->77f8206b 837a1400 cmp dword ptr [edx+0x14],0x0
ds:00a79f06=????????
77f8206f 0f859c7b0100 jne NtSetTimerResolution+0x227d
(77f99c11)
77f82075 90 nop
77f82076 ff4204 inc dword ptr [edx+0x4]
ds:00a79f06=????????
77f82079 0f852e080000 jne ZwQueryInformationThread+0xe
(77f828ad)
77f8207f 8b4124 mov eax,[ecx+0x24]
ds:80a21ee6=????????
77f82082 89420c mov [edx+0xc],eax
ds:00a79f06=????????
77f82085 c7420801000000 mov dword ptr [edx+0x8],0x1
ds:00a79f06=????????
77f8208c 33c0 xor eax,eax
77f8208e c20400 ret 0x4

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
015CDCB4 00D325B9 00000000 00D31340 015CE5E4 00C96F28
ntdll!RtlEnterCriticalSection
015CE658 00D32D7F 00D31A9C 00C96F28 00C9F2F0 00001000 !<nosymbols>
015CE674 761275BD 00D35580 00000001 00C9EFC8 015CF6E4
!InitializePrintMonitorUI
00000000 00000000 00000000 00000000 00000000 00000000
localspl!PrintDocumentOnPrintProcessor


Any one see this problem before? Any help will be welcome!
Eric
Click to expand...
Click to expand...
Click to expand...
 
Felix:
Thanks for reponse, I don't have a different port monitor for testing
now, I will try to find one, Does microsoft has any one that I can
use?
Can you print as regular user with a different port monitor? Add a queue and
a local port called "nul:" and print to it as user. Does the spooler crash?

I am not familiar with Deepfreeze. It might inject DLLs in the spooler
process and this can lead to instability under certain circumstances.

It is true that EnterCriticalSection can fail on w2k/xp. This happens if
there is contention on the CS when the machine is out of memory. It's very
hard to reach this state on a workstation. I wouldn't suspect this for now.

I don't quite understand the question.
Click to expand...
I want know which DLL is directly involved in printing, for example,
"localspl.dll" , I want to compare the dll's version between my
working image and not working image, and maybe manually replace them
for testing. I am still suspect some combination of OS,DeepFreeze and
my port monitor leading to problem.

I will do more testing and let you know what I can find.
Eric
 
yes, the local port monitor is always installed. it handles FILE:, LPTs, and
file ports (as in "c:\mydir\foo.prn" or the like).

Go to the print server properties, ports, click on add new port, select the
local port and type in nul:. When you print to nul: the data goes to the
monitor, but eventually the data is discarded. Very useful for testing.
 
Felix:
I tried to install and print to a nul port, there was not crashing, Is
it means the problem definitly in my print monitor?
Eric
 
Yes, very likely. Please go to www.microsoft.com and do a search for
"application verifier". You will find a whole bunch of links to documents
how to use the application verifier. You can download the app verifier. This
link should also help:
http://www.microsoft.com/windows/appcompatibility/toolkit.mspx

Since the port monitor run in the spooler you need to configure the app
verifier for the spoolsv.exe process. The app verifier is very useful for
finding problems with ciritical sections, handles, pointers used after the
memory was freed etc. It may help you find the problem in your code
(sooner).


--
Felix Maxa
Windows Printing Team

This posting is provided "AS IS" with no warranties, and confers no rights.
 
Thanks!

Felix Maxa said:
Yes, very likely. Please go to www.microsoft.com and do a search for
"application verifier". You will find a whole bunch of links to documents
how to use the application verifier. You can download the app verifier. This
link should also help:
http://www.microsoft.com/windows/appcompatibility/toolkit.mspx

Since the port monitor run in the spooler you need to configure the app
verifier for the spoolsv.exe process. The app verifier is very useful for
finding problems with ciritical sections, handles, pointers used after the
memory was freed etc. It may help you find the problem in your code
(sooner).


--
Felix Maxa
Windows Printing Team

This posting is provided "AS IS" with no warranties, and confers no rights.
Click to expand...
 
Felix:
I still need you help. I tried to use "application verifier", the tool
need an administrator privilege(not for power user also), but as I
mentioned before, my print monitor works fine when logon as
administrator. Any comment?
Eric
 
eric said:
I still need you help. I tried to use "application verifier", the
tool need an administrator privilege(not for power user also), but as
I mentioned before, my print monitor works fine when logon as
administrator. Any comment?
Click to expand...

Hi Eric,

Log on as the non-administrative user and run the app verifier tool
using runas.

HTH,

Bill
 
The problem is fixed, it is not a coding issue, it is casued by
security setting combined with DeepFreeze, DeepFreeze not handled
security issue very good.
 
Back
Top