IDE crashing

[vefatica]

I've started IDE (via BDEBUGGER) several times tonight, and it's crashing a lot when I "Start without debugging". I recall this being an issue some time back. The details (below) are the same each time.

TCC 16.01.46
Address=EC8B55FF
Exception=C0000005
EAX=75ACF7E4 EBX=FFFFFFFF ECX=0338C878 EDX=01C5F2D4
ESI=7681B225 EDI=034226F0 EBP=01C6F2F0 ESP=01C5F2BC
CS=0000001B DS=00000023 ES=00000023 SS=00000023
Flags=00010246

Stack:
1 : 0000:00000000
2 : IDE.EXE 0001:0002a0d3
3 : IDE.EXE 0001:00042f6a
4 : IDE.EXE 0001:00035bb4
5 : IDE.EXE 0001:0002efda
6 : IDE.EXE 0001:00035c80
7 : IDE.EXE 0001:0002fbc7
8 : IDE.EXE 0001:0003138d

Problem signature:
Problem Event Name: BEX
Application Name: IDE.EXE
Application Version: 16.1.46.0
Application Timestamp: 5349cb41
Fault Module Name: StackHash_0864
Fault Module Version: 0.0.0.0
Fault Module Timestamp: 00000000
Exception Offset: ec8b55ff
Exception Code: c0000005
Exception Data: 00000008
OS Version: 6.1.7601.2.1.0.256.48
Locale ID: 1033
Additional Information 1: 0864
Additional Information 2: 0864d224a5c100309cff114a52297350
Additional Information 3: 56bc
Additional Information 4: 56bc8fe2880aa2998732de0cebe48cf7

 

[rconn]

Not reproducible here. Does this only happen with specific batch files or with any? Did you try it without any plugins?

Your crash is in uafxcw, which is Microsoft's code. Not sure I could do much about this even if I can reproduce it.

 

[vefatica]

With no plugins and a different BTM, I got this (below) moments ago. In fact I got it 4 times in a row, starting all from the same plugin-free instance of TCC. I used the BTM involving CLIP: that Steve posted recently. The error happens about 2/3 of the time here.
g:\tc16> type TCMD.gpf
TCC 16.01.46
Address=EC8B55FF
Exception=C0000005
EAX=75ACF7E4 EBX=FFFFFFFF ECX=0321C8D8 EDX=0190F08C
ESI=7681B225 EDI=032B26D8 EBP=0191F0A8 ESP=0190F074
CS=0000001B DS=00000023 ES=00000023 SS=00000023
Flags=00010246

Stack:
1 : 0000:00000000
2 : IDE.EXE 0001:0002a0d3
3 : IDE.EXE 0001:00042f6a
4 : IDE.EXE 0001:00035bb4
5 : IDE.EXE 0001:0002efda
6 : IDE.EXE 0001:00035c80
7 : IDE.EXE 0001:0002fbc7
8 : IDE.EXE 0001:0003138d

 

[vefatica]

And it crashes equally often with /ip /is /ii.

 

[vefatica]

Neither timing nor "Start without debugging" is crucial. Though it's not necessary, I facilitated testing with command lines like this:

keystack /w25 F5 & bdebugger steve.btm

with delays up to 500 and both F5 and Ctrl-F5.
Before the crash, the console scrolls. After he scrolling there is often a considerable delay before the crash (during which output would be expected).

Watching with ProcessMonitor, these are the last few entries before IDE creates the GPF file.

13:16:57.2394622   IDE.EXE   1788   RegOpenKey   HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced   SUCCESS   Desired Access: Query Value
13:16:57.2394749   IDE.EXE   1788   RegQueryValue   HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackDocs   SUCCESS   Type: REG_DWORD, Length: 4, Data: 0
13:16:57.2394818   IDE.EXE   1788   RegCloseKey   HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced   SUCCESS   
13:16:57.2398533   IDE.EXE   1788   RegOpenKey   HKLM\SOFTWARE\Microsoft\CTF\KnownClasses   NAME NOT FOUND   Desired Access: Read
13:16:57.2399768   IDE.EXE   1788   RegOpenKey   HKLM\SOFTWARE\Microsoft\CTF\KnownClasses   NAME NOT FOUND   Desired Access: Read
13:16:57.2400746   IDE.EXE   1788   RegOpenKey   HKLM\SOFTWARE\Microsoft\CTF\KnownClasses   NAME NOT FOUND   Desired Access: Read
13:16:57.2404611   IDE.EXE   1788   RegOpenKey   HKLM\SOFTWARE\Microsoft\CTF\KnownClasses   NAME NOT FOUND   Desired Access: Read
13:16:57.2405385   IDE.EXE   1788   RegOpenKey   HKLM\SOFTWARE\Microsoft\CTF\KnownClasses   NAME NOT FOUND   Desired Access: Read
13:16:57.2417738   IDE.EXE   1788   RegOpenKey   HKLM\SOFTWARE\Microsoft\CTF\KnownClasses   NAME NOT FOUND   Desired Access: Read
13:16:57.2419240   IDE.EXE   1788   RegOpenKey   HKLM\SOFTWARE\Microsoft\CTF\KnownClasses   NAME NOT FOUND   Desired Access: Read
13:16:57.2721904   IDE.EXE   1788   RegOpenKey   HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback   SUCCESS   Desired Access: Query Value, Enumerate Sub Keys
13:16:57.2722216   IDE.EXE   1788   RegOpenKey   HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Segoe UI   NAME NOT FOUND   Desired Access: Query Value
13:16:57.2722304   IDE.EXE   1788   RegCloseKey   HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback   SUCCESS

 

[Steve Fabian]

I presume steve.btm is the one uses clip: to collect various TCC-related tasks. I just noticed that in at least one instance a COUThhh.JPS was not deleted in %tmp.

 

[vefatica]

I presume steve.btm is the one uses clip: to collect various TCC-related tasks. I just noticed that in at least one instance a COUThhh.JPS was not deleted in %tmp.

Yes, though I had to fix the "FORN" statement and get rid of the @F5 function (what's that?). I have run it many times and I have no leftovers in my temp directory.

 

[Steve Fabian]

FORN is my shorthand for FOR /L, which I assume you figured out. @F5 is shorthand for %@format[5,%&]; I have lots of similar ones. BTW, I only found leftover once; I failed to observe before deletion whether or not it was empty.

 

[vefatica]

And, once "Start debugging" or "Start without debugging" has worked correctly in a given instance of IDE.EXE, neither will subsequently cause that instance to crash.

 

[rconn]

I tried it again, running Steve's batch file 500 times and it never crashed.

And IDE is not doing any of those registry accesses; you've got something else going on in your system (probably some code injection) that you haven't mentioned yet.

 

[rconn]

Any chance your tasklist titles contain special characters (i.e., &<>|` etc.)? Steve's batch file didn't have any protection against something like that.

 

[Steve Fabian]

I list only TC family items, with titles assigned exclusively with TCC text commands (or with 4NT if checking something really old). I added 1ms delay after each of the four takslist command. Without the delay about every 5th invocation had the error. With the delay it was only on the 19th cll.