I'm investigating a curious problem with crashing IE11.
Our Environment is a website running in IE11 deployed via Citrix Xenapp to iPads with Citrix Receiver.
In approx. 10% the cases of opening the website the crash of IE occurs.
The use case is, that we want to play a sound when buttons are pushed.
Investigation
We nailed it down to the html5 audio tag which causes the trouble. So we built two minimal examples for reproducing this failure behaviour. On with plain html5 audio tags and the other with scripted audio elements:
<!-- audio1.html -->
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">
</head>
<body>
<audio id="player" controls preload="auto">
<source src="img/sound/beep.mp3" type="audio/mpeg" />
<source src="img/sound/beep.ogg" type="audio/ogg" />
<source src="img/sound/beep.wav" type="audio/wav" />
</audio>
<audio id="player2" controls preload="auto">
<source src="img/sound/beep2.mp3" type="audio/mpeg" />
</audio>
<audio id="player3" controls preload="auto">
<source src="img/sound/beep3.mp3" type="audio/mpeg" />
</audio>
<audio id="player4" controls preload="auto">
<source src="img/sound/beep4.mp3" type="audio/mpeg" />
</audio>
</body>
</html>
<!-- audio2.html -->
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">
</head>
<body>
<script src="https://ajax.googleapis.com/ajax/libs/jquery/1.11.1/jquery.min.js"></script>
<script>
jQuery(document).ready(function() {
function createAudio(url) {
var audio = document.createElement("audio");
audio.setAttribute('preload', 'auto');
audio.setAttribute('controls', 'controls');
audio.setAttribute('type', 'audio/mpeg');
if (audio != null && audio.canPlayType && audio.canPlayType("audio/mpeg")) {
audio.src = url;
}
document.body.appendChild(audio);
return audio;
}
var audio1 = createAudio("img/sound/beep.mp3");
var audio2 = createAudio("img/sound/beep2.mp3");
var audio3 = createAudio("img/sound/beep3.mp3");
var audio4 = createAudio("img/sound/beep4.mp3");
});
</script>
</body>
</html>
Result
With this examples we could reproduce the failure more often
Ungültige Quelle or Invalid Source.Crash Dumps
Windows Event Log
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2015-03-05T15:39:00.000000000Z" />
<EventRecordID>9994</EventRecordID>
<Channel>Application</Channel>
<Computer>T02.ADL.local</Computer>
<Security />
</System>
<EventData>
<Data>IEXPLORE.EXE</Data>
<Data>11.0.9600.17416</Data>
<Data>5452eed9</Data>
<Data>ntdll.dll</Data>
<Data>6.3.9600.17630</Data>
<Data>54b0d74f</Data>
<Data>c0000005</Data>
<Data>000411d2</Data>
<Data>19d4</Data>
<Data>01d0575a7d7ee406</Data>
<Data>C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE</Data>
<Data>C:\Windows\SYSTEM32\ntdll.dll</Data>
<Data>bdb9a4d8-c34d-11e4-80e9-f246be8a9fe6</Data>
<Data />
<Data />
</EventData>
</Event>
With windbg.exe and !analye -v i got the following crash dump:
************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred SRV*C:\crashdebug\Symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*C:\crashdebug\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 8 Version 9600 MP (4 procs) Free x86 compatible
Product: Server, suite: TerminalServer
Built by: 6.3.9600.17031 (winblue_gdr.140221-1952)
Machine Name:
Debug session time: Fri Feb 27 12:37:14.000 2015 (UTC + 1:00)
System Uptime: 0 days 11:35:11.637
Process Uptime: 0 days 0:01:08.000
................................................................
................................................................
......
Loading unloaded module list
..
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(d20.1b10): Access violation - code c0000005 (first/second chance not available)
eax=00000000 ebx=00000000 ecx=43f23b31 edx=7e78d000 esi=00000003 edi=00000003
eip=7756cc2c esp=0d78e78c ebp=0d78e914 iopl=0 nv up ei pl nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000202
ntdll!NtWaitForMultipleObjects+0xc:
7756cc2c c21400 ret 14h
0:024> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ScriptSn.20140828074232.dll -
GetUrlPageData2 (WinHttp) failed: 12007.
FAULTING_IP:
ntdll!RtlEnterCriticalSection+12
775711d2 f00fba3000 lock btr dword ptr [eax],0
EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 775711d2 (ntdll!RtlEnterCriticalSection+0x00000012)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000001
Parameter[1]: 43f23b35
Attempt to write to address 43f23b35
CONTEXT: 00000000 -- (.cxr 0x0;r)
eax=00000000 ebx=00000000 ecx=43f23b31 edx=7e78d000 esi=00000003 edi=00000003
eip=7756cc2c esp=0d78e78c ebp=0d78e914 iopl=0 nv up ei pl nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000202
ntdll!NtWaitForMultipleObjects+0xc:
7756cc2c c21400 ret 14h
DEFAULT_BUCKET_ID: INVALID_POINTER_WRITE
PROCESS_NAME: iexplore.exe
ERROR_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.
EXCEPTION_PARAMETER1: 00000001
EXCEPTION_PARAMETER2: 43f23b35
WRITE_ADDRESS: 43f23b35
FOLLOWUP_IP: mfcore!CSampleQueue::Flush+1b
7481999c 68ffffff7f push 7FFFFFFFh
NTGLOBALFLAG: 400
APPLICATION_VERIFIER_FLAGS: 0
APP: iexplore.exe
ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre
FAULTING_THREAD: 00001b10
PRIMARY_PROBLEM_CLASS: INVALID_POINTER_WRITE
BUGCHECK_STR: APPLICATION_FAULT_INVALID_POINTER_WRITE
LAST_CONTROL_TRANSFER: from 7481999c to 775711d2
STACK_TEXT:
0d78f2e4 7481999c 43f23b31 0c2a80d0 43f23939 ntdll!RtlEnterCriticalSection+0x12
0d78f304 7481acd6 00000001 0c2a80d0 43f23939 mfcore!CSampleQueue::Flush+0x1b
0d78f328 747f6c7a 0c2a80d0 0c2a80d0 00000000 mfcore!CSampleQueue::~CSampleQueue+0x17
0d78f364 7483de0d 7483de00 0d78f38c 7481a61e mfcore!CAudStreamSink::~CAudStreamSink+0x120
0d78f370 7481a61e 00000001 0c2a806c 80004005 mfcore!CAudStreamSink::`vector deleting destructor'+0xd
0d78f38c 748cc0ef 0c2a80d0 0c2a7f08 0c2a7f50 mfcore!CAudStreamSink::Release+0x4e
0d78f3ac 747eec7d 00000000 0d78f448 0d78f3d0 mfcore!CAudioMediaSink::InternalCreateStreamSink+0xdd3a8
0d78f3d8 747eeba0 0d78f3f4 0d78f448 00000000 mfcore!CAudioMediaSink::CAudioMediaSink+0xb1
0d78f3f8 747eeafe 0c2b7380 00000000 0c2b73b8 mfcore!CAudioMediaSink::CreateInstance+0x30
0d78f4a8 747ee809 0c2b7380 0c2b73b8 0d78f520 mfcore!MFCreateAudioRenderer+0x2be
0d78f4c0 7483a03d 0c2b7380 7483a000 0c2dfa60 mfcore!CMFAudioRendererActivate::InstantiateMediaObject+0x29
0d78f4d8 74839fdf 747c4a80 0d78f520 0c2dfb98 mfcore!CMFActivate::DoActivate+0x3d
0d78f4f4 747f205a 0c2b7380 747c4a80 0d78f520 mfcore!CMFActivate::ActivateObject+0x2f
0d78f52c 747f1f91 05a0d670 0c2b7380 00000000 mfcore!CMediaSession::BindOutputNode+0x75
0d78f56c 74938512 0c2a6ab8 00000000 748c3320 mfcore!CMediaSession::BindOutputNodes+0x10e
0d78f5b4 747efaa1 05a0fd08 05a0fd08 747efa30 mfcore!CMediaSession::OpQueueTopology+0x32b
0d78f5d8 74819621 05a0fd08 0c2b74e8 74819580 mfcore!CMediaSession::DispatchOperation+0x71
0d78f5f8 74819591 74819580 0d78f63c 74c02459 mfcore!COpQueue::ProcessMarshalledOperations+0x85
0d78f604 74c02459 0c2dfa7c 0c2b74e8 0c211f40 mfcore!COpQueue::ProcessMarshalledOperationsAsyncCallback::Invoke+0x11
0d78f63c 74bf72e9 0c26c788 031cef88 74bf7240 RTWorkQ!CSerialWorkQueue::QueueItem::ExecuteWorkItem+0x1b2
0d78f674 77553cc7 0d78f6f8 0c211f40 031cef88 RTWorkQ!ThreadPoolWorkCallback+0xa9
0d78f6b4 775514b1 0d78f6f8 031cefe8 035d296c ntdll!TppWorkpExecuteCallback+0x137
0d78f84c 76de7c04 085b1e48 76de7be0 02dce3d3 ntdll!TppWorkerThread+0x48e
0d78f860 7758b5af 085b1e48 035d2988 00000000 kernel32!BaseThreadInitThunk+0x24
0d78f8a8 7758b57a ffffffff 77570411 00000000 ntdll!__RtlUserThreadStart+0x2f
0d78f8b8 00000000 77544b50 085b1e48 00000000 ntdll!_RtlUserThreadStart+0x1b
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: mfcore!CSampleQueue::Flush+1b
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: mfcore
IMAGE_NAME: mfcore.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 545036e9
STACK_COMMAND: ~24s; .ecxr ; kb
FAILURE_BUCKET_ID: INVALID_POINTER_WRITE_c0000005_mfcore.dll!CSampleQueue::Flush
BUCKET_ID: APPLICATION_FAULT_INVALID_POINTER_WRITE_mfcore!CSampleQueue::Flush+1b
ANALYSIS_SOURCE: UM
FAILURE_ID_HASH_STRING: um:invalid_pointer_write_c0000005_mfcore.dll!csamplequeue::flush
FAILURE_ID_HASH: {0351a28f-6605-92a0-dcfc-74117e20afcb}
Followup: MachineOwner
As I understand the crash dump IE crashs by registering an audio device. propably for citrix.?
Other attemps for solving this issue
Invalid Source in most timesOther already regarded Questions from SO with no suitable solution for our problem
Finally
My problem is now, that i have no idea, what to do to solve this problem. Is it windows problem, a citrix problem, an iOS problem? Or is it a combination of all of them.
Does anybody knows a workaround for it?
Or is there another point from which i can start another debugging attempt?
If you need more data, please let me know.
Update 2015-03-10
For completeness, this were my workarounds:
Our final fix was upgrading to Windows Server 2016 and Citrix Xenapp 7.15 and there, this problem does not occur.
The tickets we opened at microsoft and citrix were closed/rejected with "No problem with our software, it must be the other vendors."