Previous Next

• 05-09-2008, 2:39 PM

  USMCEddie Joined on 05-09-2008, 6:22 PM Posts 1 USMCEddie

  Something wrong with rpcrt4.dll? Maybe msvcr80.dll? Symptoms: Dropping Sessions Reply Contact Ladies and Gents,    I've been digging on this one for several days, and I just can't quite get a handle on it. I've run as many diagnostics agents that I could get my hands on, and read several blogs and articles, but nothing seems to have precisely what I'm after. Would someone take a peek at this for me and nudge me in the right direction please?    The symptom I'm observing: The session is unexpectedly severed, which triggers the user to log back in seconds after initially logging in... this ticks them off quite badly, and the encrypted session id is how we allow them to navigate the site securely.    In HTTP Errors I get 1492904551 Connection_Dropped AppPool+#2    Event viewer shows nothing. Filemon shows no errors.    Analysis for crashed iis related processes (all) in debugdiag is: In w3wp__PID__9440__Date__05_08_2008__Time_09_51_18AM__89__First chance exception 0X00000005.dmp the assembly instruction at kernel32!RaiseException+53 in C:\WINDOWS\system32\kernel32.dll from Microsoft Corporation has caused an unknown exception (0x00000005) on thread 21 This exception originated from rpcrt4!RpcpRaiseException+24. Type of Analysis Performed   Crash Analysis Machine Name   SPIDERMAN Operating System   Windows Server 2003 Service Pack 2 Number Of Processors   8 Process ID   9440 Process Image   c:\WINDOWS\system32\inetsrv\w3wp.exe System Up-Time   20 day(s) 07:42:34 Process Up-Time   0 day(s) 01:06:50 Thread 21 - System ID 9004 Entry point   msvcrt!_endthreadex+2f Create time   5/8/2008 8:44:29 AM Time spent in user mode   0 Days 0:0:0.0 Time spent in kernel mode   0 Days 0:0:0.15   Function     Arg 1     Arg 2     Arg 3   Source kernel32!RaiseException+53     00000005     00000001     00000000    rpcrt4!RpcpRaiseException+24     00000005     770e7278     02f2e60c    rpcrt4!NdrSendReceive+35     02f2e24c     000914a8     00000000    rpcrt4!NdrClientCall2+22e     770e7278     770e92d8     02f2e60c    setupapi!PNP_GetInterfaceDeviceListSize+1c     000f5d90     02f2e6d8     7c914328    setupapi!CM_Get_Device_Interface_List_Size_ExW+62     02f2e6d8     7c914328     00000000    shell32!CMountPoint::_EnumVolumes+c5     00000000     00000000     00000004    shell32!CMountPoint::_InitLocalDriveHelper+52     00000000     7cae52d0     80004005    shell32!CMountPoint::_InitLocalDrives+c8     00000000     7cae52d0     00000000    shell32!CMountPoint::_GetMountPointDL+48     00000004     00000000     000f48a8    shell32!CMountPoint::GetMountPoint+46     00000004     00000000     00000001    shell32!CDrivesFolder::_FillIDDrive+5c     02f2e7b4     00000004     00000000    shell32!CDrivesFolder::ParseDisplayName+9f     000dbe90     00000000     000f48a8    shell32!CRegFolder::ParseDisplayName+93     000ca3a0     00000000     000f48a8    shell32!CDesktopFolder::_ChildParseDisplayName+22     00000000     000c7d78     00000000    shell32!CDesktopFolder::ParseDisplayName+7e     00106fb0     00000000     000f48a8    shell32!CRegFolder::ParseDisplayName+93     000b1650     00000000     000f48a8    shell32!SHParseDisplayName+a3     00000000     00000000     00000000    shell32!ILCreateFromPathEx+3d     01c14958     00000000     00000002    shell32!SHILCreateFromPath+17     01c14958     02f2e9b8     00000000    shell32!ILCreateFromPathW+18     01c14958     01c14958     01c14910    shell32!SHGetFileInfoW+117     01c14958     00000000     02f2ee64    scrrun!GetFileType+51     01c14958     02f2f134     00000000    scrrun!PathObject::InternalGetType+71     02f2f4cc     02f2f488     77d05186    scrrun!FileObject::get_Type+13     01c14948     02f2f4cc     01c10cf8    oleaut32!DispCallFunc+16a     01c14948     00000050     00000004    oleaut32!CTypeInfo2::Invoke+234     000f57d4     01c14948     00000000    scrrun!FileObject::Invoke+2e     01c14948     000003f2     02bc1b18    vbscript!IDispatchInvoke2+b2     01c18af8     01c14948     000003f2    vbscript!IDispatchInvoke+59     01c18af8     01c14948     000003f2    vbscript!InvokeDispatch+13a     01c18af8     01c14948     000003f2    vbscript!InvokeByName+42     01c18af8     01c14948     000003f2    vbscript!CScriptRuntime::RunNoEH+10b4     00000000     02f2f72e     01c18af8    vbscript!CScriptRuntime::Run+62     00000000     00000000     01c18af8    vbscript!CScriptEntryPoint::Call+51     00000000     00000000     00000000    vbscript!CSession::Execute+b4     01c15a20     00000000     00000000    vbscript!COleScript::ExecutePendingScripts+144     00000000     00000000     709e19c0    vbscript!COleScript::SetScriptState+14d     02822060     02822060     02122160    asp!CActiveScriptEngine::TryCall+19     00000000     709e19c0     02f2fb38    asp!CActiveScriptEngine::Call+31     00000000     6472474e     02421e90    asp!CallScriptFunctionOfEngine+5b     02f2fb0c     00000000     00000000    asp!ExecuteRequest+17e     029223f0     00000000     02f2fb68    asp!Execute+24c     029223f0     02421e90     02f2fb68    asp!CHitObj::ViperAsyncCallback+3f0     00000000     00000000     000efd38    asp!CViperAsyncRequest::OnCall+92     024a1e90     0008b2e8     02f2fd74    comsvcs!CSTAActivityWork::STAActivityWorkHelper+32     000efd38     000e2b8c     00000000    ole32!EnterForCallback+c4     00000000     000e2b8c     4a77b5b8    ole32!SwitchForCallback+1a3     02f2fc54     4a77b5b8     000efd38    ole32!PerformCallback+54     000e2b8c     4a77b5b8     000efd38    ole32!CObjectContext::InternalContextCallback+159     0008b2e8     4a77b5b8     000efd38    ole32!CObjectContext::DoCallback+1c     0008b2e8     4a77b5b8     000efd38    comsvcs!CSTAActivityWork::DoWork+12d     000d92d0     000d92b0     0009012c    comsvcs!CSTAThread::DoWork+18     000efd38     00000001     000d92b0    comsvcs!CSTAThread::ProcessQueueWork+37     00000000     01c15de0     01c15d48    comsvcs!CSTAThread::WorkerLoop+190     000d92b0     00000000     00000000    msvcrt!_endthreadex+a3     01c15d48     00000000     00000000    kernel32!BaseThreadStart+34     77bcb4bc     01c15d48     00000000    In w3wp__PID__9440__Date__05_08_2008__Time_09_51_18AM__89__First chance exception 0X00000005.dmp the assembly instruction at kernel32!RaiseException+53 in C:\WINDOWS\system32\kernel32.dll from Microsoft Corporation has caused an unknown exception (0x00000005) on thread 21 This exception originated from rpcrt4!RpcpRaiseException+24. Module Information Image Name: C:\WINDOWS\system32\kernel32.dll   Symbol Type: PDB Base address: 0x77e40000   Time Stamp: Wed Apr 18 11:25:36 2007 Checksum: 0x001083fc   Comments: COM DLL: False   Company Name: Microsoft Corporation ISAPIExtension: False   File Description: Windows NT BASE API Client DLL ISAPIFilter: False   File Version: 5.2.3790.4062 (srv03_sp2_gdr.070417-0203) Managed DLL: False   Internal Name: kernel32 VB DLL: False   Legal Copyright: © Microsoft Corporation. All rights reserved. Loaded Image Name: kernel32.dll   Legal Trademarks: Mapped Image Name:   Original filename: kernel32 Module name: kernel32   Private Build: Single Threaded: False   Product Name: Microsoft® Windows® Operating System Module Size: 1.01 MBytes   Product Version: 5.2.3790.4062 Symbol File Name: c:\symcache\kernel32.pdb\7FD4C98964054C24B2C472948D829DF52\kernel32.pdb   Special Build: &    I also get these from the memory leak tester. msvcr80.dll is responsible for 4.16 KBytes worth of outstanding allocations. The following are the top 2 memory consuming functions: msvcr80!_calloc_impl+125: 4.16 KBytes worth of outstanding allocations. unction details Function   msvcr80!_calloc_impl+125 Allocation type   Heap allocation(s) Heap handle   0x01220000 Allocation Count   8 allocation(s) Allocation Size   4.16 KBytes Leak Probability   78% and kernel32.dll (a known Windows memory manager) is responsible for 4.06 KBytes worth of outstanding allocations. These allocations appear to have originated from the following module(s) and function(s): No module info available. Please see the callstack samples for further information on these allocations.   Call stack sample 1 Address   0x0009bca8 Allocation Time   0 day(s) 00:12:15 since tracking started Allocation Size   520 Bytes Function   Source   Destination kernel32!FlsSetValue+50      ntdll!RtlAllocateHeap msvcrt!__CRTDLL_INIT+1ac      kernel32!FlsSetValue ntdll!LdrpCallInitRoutine+14       ntdll!LdrpInitializeThread+10d      ntdll!LdrpCallInitRoutine ntdll!_LdrpInitialize+16f      ntdll!LdrpInitializeThread ntdll!KiUserApcDispatcher+25       ntdll!RtlpWorkerThread   Would someone please give me a hand? I'm pretty rookie with this debugging thing.   Thanks, "Eddie"

• 05-11-2008, 3:37 PM

  In reply to

  JaroDunajsky Joined on 04-19-2005, 6:23 PM Redmond Posts 50 JaroDunajsky

  Re: Something wrong with rpcrt4.dll? Maybe msvcr80.dll? Symptoms: Dropping Sessions Reply Contact I don't think the leaks have any significance for your investigation. The COM object being accesed may have already been already released.  It looks like code on the stack should be beyond control of your application. Can you consistently reproduce with the same stack? If not then there may be a heap corruption in your process.  You could use pageheap (http://support.microsoft.com/kb/286470) to narrow down the issue, but I'm not sure it would help in your case. (Just don't forget to disable pageheap once you are done with investigation). Jaroslav Dunajsky (MSFT, IIS)