Re: Crash dump
Thanks!
Right, so the bug check itself is
UNEXPECTED_KERNEL_MODE_TRAP (7f)
This bug check indicates that the Intel CPU generated a trap and the kernel failed to catch this trap.
BugCheck 7F, {8, 80050031, 406f8, fffff80002ea614e}
The 1st parameter of the bug check is 0x00000008, or Double Fault, indicates that an exception occurs during a call to the handler for a prior exception. Typically, the two exceptions are handled serially. However, there are several exceptions that cannot be handled serially, and in this situation the processor signals a double fault. There are two common causes of a double fault:
- A kernel stack overflow. This overflow occurs when a guard page is hit, and the kernel tries to push a trap frame. Because there is no stack left, a stack overflow results, causing the double fault.
- A hardware problem.
As you already noted, the process at the time of the crash is worth noting - PROCESS_NAME:
mscorsvw.exe
mscorsvw.exe is used to precompile .NET assemblies in the background. When you install the .NET redistributable, it handles all of the high priority assemblies for 5-10 minutes, finishes them, and then waits for the system to be at an idle-state to handle the low priority assemblies.You can force all of the low priorities to finish and not wait for idle-state, also. Once all of that's said & done, the process will kill and you won't see mscorsvw.exe.
So, why did the system crash when this was occurring? It's noted that this process at times can cause 100% CPU usage, however the compilation itself happens in a process with low priority so your CPU is still handling other important tasks, calls, etc, much more frequently than it is the compilation process. With this said, no crash based off of CPU usage should occur.
Code:
1: kd> !thread
GetPointerFromAddress: unable to read from fffff800030b4000
THREAD fffffa8010685060 Cid 0e7c.11e8 Teb: 000007fffffdd000 Win32Thread: 0000000000000000 RUNNING on processor 1
Not impersonating
GetUlongFromAddress: unable to read from fffff80002ff3ba4
Owning Process fffffa8050725730 Image: mscorsvw.exe
Attached Process N/A Image: N/A
fffff78000000000: Unable to get shared data
Wait Start TickCount 122578
Context Switch Count 5
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime 00:00:00.000
KernelTime 00:00:00.000
Win32 Start Address 0x000000013fe71f80
Stack Init fffff8800846ec70 Current fffff8800846e460
Base fffff8800846f000 Limit fffff88008469000 Call 0
Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5
Child-SP RetAddr : Args to Child : Call Site
fffff880`009c6ce8 fffff800`02e7c169 : 00000000`0000007f 00000000`00000008 00000000`80050031 00000000`000406f8 : nt!KeBugCheckEx
fffff880`009c6cf0 fffff800`02e7a632 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`009c6e30 fffff800`02ea614e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDoubleFaultAbort+0xb2 (TrapFrame @ fffff880`009c6e30)
fffff880`08468cf0 fffff800`02eb74c1 : fffff880`08469ba8 fffff880`08469900 fffff880`08469c50 fffff880`0846e660 : nt!RtlDispatchException+0x2e
fffff880`084693d0 fffff800`02e7c242 : fffff880`08469ba8 00000000`00000017 fffff880`08469c50 fffff800`02e07000 : nt!KiDispatchException+0x135
fffff880`08469a70 fffff800`02e7ab4a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0xc2
fffff880`08469c50 fffff800`02ea07fe : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiGeneralProtectionFault+0x10a (TrapFrame @ fffff880`08469c50)
fffff880`08469de0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveAnyPage+0x13e
Looking at an excerpt from the raw stack:
Code:
fffff880`08469a68 fffff800`02e7c242 nt!KiExceptionDispatch+0xc2
fffff880`08469a70 fffff880`08469ba8
fffff880`08469a78 00000000`00000017
fffff880`08469a80 fffff880`08469c50
fffff880`08469a88 fffff800`02e07000 nt!KiSelectNextThread <PERF> (nt+0x0)
fffff880`08469a90 00000000`00000001
fffff880`08469a98 00000000`00000000
fffff880`08469aa0 00000000`00000000
fffff880`08469aa8 00000000`00000000
fffff880`08469ab0 00000000`00000000
fffff880`08469ab8 00000000`00000000
fffff880`08469ac0 00000000`00000000
fffff880`08469ac8 00000000`00000000
fffff880`08469ad0 00000000`00000000
fffff880`08469ad8 00000000`00000000
fffff880`08469ae0 00000000`00000000
fffff880`08469ae8 00000000`00000000
fffff880`08469af0 00000000`00000000
fffff880`08469af8 00000000`00000000
fffff880`08469b00 00000000`00000000
fffff880`08469b08 00000000`00000000
fffff880`08469b10 00000000`00000000
fffff880`08469b18 00000000`00000000
fffff880`08469b20 00000000`00000000
fffff880`08469b28 00000000`00000000
fffff880`08469b30 00000000`00000000
fffff880`08469b38 00000000`00000000
fffff880`08469b40 00000000`00000000
fffff880`08469b48 00000000`00000000
fffff880`08469b50 00000000`00000000
fffff880`08469b58 00000000`00000000
fffff880`08469b60 00000000`00000000
fffff880`08469b68 00000000`00000000
fffff880`08469b70 00000000`00000017
fffff880`08469b78 fffff880`0846e660
fffff880`08469b80 fffff800`02e07000 nt!KiSelectNextThread <PERF> (nt+0x0)
fffff880`08469b88 fffe9281`8d4b3200
fffff880`08469b90 00000000`00000000
fffff880`08469b98 00000000`0000001f
fffff880`08469ba0 00000000`00000017
fffff880`08469ba8 00000000`c0000005
fffff880`08469bb0 00000000`00000000
fffff880`08469bb8 fffff800`02ea07fe nt!MiRemoveAnyPage+0x13e
fffff880`08469bc0 00000000`00000002
fffff880`08469bc8 00000000`00000000
fffff880`08469bd0 ffffffff`ffffffff
fffff880`08469bd8 00000000`00000001
fffff880`08469be0 00000000`00000000
fffff880`08469be8 00000000`00000000
fffff880`08469bf0 00000000`00000000
fffff880`08469bf8 00000000`00000000
fffff880`08469c00 00000000`00000000
fffff880`08469c08 00000000`00000000
fffff880`08469c10 00000000`00000000
fffff880`08469c18 00000000`00000000
fffff880`08469c20 00000000`00000000
fffff880`08469c28 00000000`00000000
fffff880`08469c30 00000000`00000000
fffff880`08469c38 00000000`00000000
fffff880`08469c40 00000000`00000000
fffff880`08469c48 fffff800`02e7ab4a nt!KiGeneralProtectionFault+0x10a
We can see
nt!KiGeneralProtectionFault, which is a routine then eventually leads to the execution of the exception handler that is associated with the routine that triggered the fault. I didn't paste what the routine was before it, because it's a huge gap, but it was
nt!MiRemoveAnyPage.
We then have a
nt!MiRemoveAnyPage call, a next thread select call, again, and then the exception itself is dispatched.
I don't like the fact that we're seeing memory related routines causing exceptions.
If you crash again, run Memtest on the RAM for no less than ~8 passes.
Regards,
Patrick