IE Window Hang on WinXP

[shuenmin@gmail.com]

hello everybody,

We got IE pop-up window frozen issue on WinXP SP2 and SP3 platforms.

The pop-up window is opened by a web app and it's frozen randomly....

I got the user dump file was generated when IE hung.

The following are my analysis result, but I still can not figure out what caused the IE window hang....i need your help.

.  0  Id: 15f8.15fc Suspend: 1 Teb: 7ffdf000 Unfrozen
 # ChildEBP RetAddr  Args to Child              
00 0012e7e4 77d19418 424198bd 001718e8 00173d78 ntdll!KiFastSystemCallRet (FPO: [0,0,0])
01 0012e818 4240ab4c 00174408 0012e848 4240bbbb user32!NtUserWaitMessage+0xc
02 0012e824 4240bbbb 00000000 00000000 001718e8 ieframe!BrowserThreadProc+0x3f (FPO: [Non-Fpo])
03 0012e848 4240bb09 15fc000a 001718e8 00000000 ieframe!BrowserNewThreadProc+0x7b (FPO: [Non-Fpo])
04 0012f8b8 4240b9b9 001718e8 77f448d4 00000000 ieframe!SHOpenFolderWindow+0x188 (FPO: [Non-Fpo])
05 0012fae8 0040147c 00168048 00000001 00410070 ieframe!IEWinMain+0x2d9 (FPO: [Non-Fpo])
06 0012ff2c 00401317 00400000 00000000 000208b8 iexplore!wWinMain+0x2c1 (FPO: [Non-Fpo])
07 0012ffc0 7c817067 80000001 0189de08 7ffdc000 iexplore!_initterm_e+0x1b1 (FPO: [Non-Fpo])
08 0012fff0 00000000 00402e45 00000000 00000000 kernel32!BaseProcessStart+0x23 (FPO: [Non-Fpo])

   1  Id: 15f8.f30 Suspend: 1 Teb: 7ffdd000 Unfrozen
 # ChildEBP RetAddr  Args to Child              
00 010ffdbc 7c92df2c 7c809574 00000002 010ffde8 ntdll!KiFastSystemCallRet (FPO: [0,0,0])
01 010ffdc0 7c809574 00000002 010ffde8 00000001 ntdll!NtWaitForMultipleObjects+0xc (FPO: [5,0,0])
02 010ffe5c 77d195f9 00000002 010ffe84 00000000 kernel32!WaitForMultipleObjectsEx+0x12c (FPO: [Non-Fpo])
03 010ffeb8 5dff6029 00000001 010ffeec ffffffff user32!RealMsgWaitForMultipleObjectsEx+0x13e (FPO: [Non-Fpo])
04 010ffed8 5dff93e4 [color="#FF0000"]000004ff [/color]ffffffff 00000001 ieui!CoreSC::Wait+0x49 (FPO: [Non-Fpo])
05 010fff0c 5dff98a6 010fff4c 00000000 00000000 ieui!CoreSC::xwProcessNL+0xa4 (FPO: [Non-Fpo])
06 010fff2c 5dff9806 010fff4c 00000000 00000000 ieui!GetMessageExA+0x44 (FPO: [Non-Fpo])
07 010fff80 77c0a3b0 00000000 7c930000 7c932cae ieui!ResourceManager::SharedThreadProc+0xb6 (FPO: [Non-Fpo])
08 010fffb4 7c80b713 003b5cd0 7c930000 7c932cae msvcrt!_endthreadex+0xa9 (FPO: [Non-Fpo])
09 010fffec 00000000 77c0a341 003b5cd0 00000000 kernel32!BaseThreadStart+0x37 (FPO: [Non-Fpo])

   2  Id: 15f8.1308 Suspend: 1 Teb: 7ffd7000 Unfrozen
 # ChildEBP RetAddr  Args to Child              
00 035cfad0 7c92df3c 719b402b 000003d8 00000001 ntdll!KiFastSystemCallRet (FPO: [0,0,0])
01 035cfad4 719b402b 000003d8 00000001 035cfafc ntdll!NtWaitForSingleObject+0xc (FPO: [3,0,0])
02 035cfb10 719b5f9f 000003d8 000003e0 00000000 mswsock!SockWaitForSingleObject+0x1a0 (FPO: [Non-Fpo])
03 035cfc04 71a1314f 00000001 035cfe84 035cfc7c mswsock!WSPSelect+0x25f (FPO: [Non-Fpo])
04 035cfc54 420a60ed 00000001 035cfe84 035cfc7c ws2_32!select+0xb8 (FPO: [Non-Fpo])
05 035cffac 420a2a68 035cffec 7c80b713 001e95a8 wininet!ICAsyncThread::SelectThread+0x242 (FPO: [Non-Fpo])
06 035cffb4 7c80b713 001e95a8 01facca4 00160000 wininet!ICAsyncThread::SelectThreadWrapper+0xd (FPO: [Non-Fpo])
07 035cffec 00000000 420a2a5b 001e95a8 00000000 kernel32!BaseThreadStart+0x37 (FPO: [Non-Fpo])

  18  Id: 15f8.1334 Suspend: 1 Teb: 7ff8a000 Unfrozen
 # ChildEBP RetAddr  Args to Child              
00 084cf760 7c92df3c 7c8025db 00000e4c 00000000 ntdll!KiFastSystemCallRet (FPO: [0,0,0])
01 084cf764 7c8025db 00000e4c 00000000 00000000 ntdll!NtWaitForSingleObject+0xc (FPO: [3,0,0])
02 084cf7c8 7c802542 00000e4c ffffffff 00000000 kernel32!WaitForSingleObjectEx+0xa8 (FPO: [Non-Fpo])
03 084cf7dc 07a8a40a 00000e4c ffffffff 07a8a284 kernel32!WaitForSingleObject+0x12 (FPO: [Non-Fpo])
WARNING: Stack unwind information not available. Following frames may be wrong.
04 084cf840 07ab2374 00000000 00000000 00000001 jvm!jmm_GetLastGCStat+0xb09f
05 084cf85c 07a4d625 06c5ff8c 00000000 00000000 jvm!JVM_RegisterPerfMethods+0x1e97f
06 084cf890 098382ff 06cc0e90 084cf8dc 00000000 jvm!JVM_MonitorWait+0x80
07 084cf9b4 07a373ed 084cf9e8 084cfb8c 0000000a 0x98382ff
08 084cfa30 07a8fb96 0000000a 00000000 084cfae4 jvm!AsyncGetCallTrace+0x1d048
09 084cfa74 07a372be 07a372c2 084cfb84 084cfa98 jvm!jmm_GetLastGCStat+0x1082b
0a 084cfac4 07a3701b 084cfb84 06c5ff7c 07b34594 jvm!AsyncGetCallTrace+0x1cf19
0b 084cfb40 07a51e95 084cfb84 06c5ff78 06c5ff7c jvm!AsyncGetCallTrace+0x1cc76
0c 084cfb94 07ac1325 06cc0dd0 06cc0dd0 06cc0dd0 jvm!JVM_StartThread+0x186
0d 084cfbc0 07ac12f3 06cc1010 07a8d261 50db0000 jvm!JVM_RegisterPerfMethods+0x2d930
0e 084cff80 77c0a3b0 06cc0dd0 05ac34e8 05ac36f8 jvm!JVM_RegisterPerfMethods+0x2d8fe
0f 084cffb4 7c80b713 06c9a500 05ac34e8 05ac36f8 msvcrt!_endthreadex+0xa9 (FPO: [Non-Fpo])
10 084cffec 00000000 77c0a341 06c9a500 00000000 kernel32!BaseThreadStart+0x37 (FPO: [Non-Fpo])

  28  Id: 15f8.1004 Suspend: 1 Teb: 7ff82000 Unfrozen
 # ChildEBP RetAddr  Args to Child              
00 0927ed94 7c92df2c 7c809574 00000002 0927edc0 ntdll!KiFastSystemCallRet (FPO: [0,0,0])
01 0927ed98 7c809574 00000002 0927edc0 00000001 ntdll!NtWaitForMultipleObjects+0xc (FPO: [5,0,0])
02 0927ee34 77d195f9 00000002 0927ee5c 00000000 kernel32!WaitForMultipleObjectsEx+0x12c (FPO: [Non-Fpo])
03 0927ee90 5dff6029 00000001 0927eec4 ffffffff user32!RealMsgWaitForMultipleObjectsEx+0x13e (FPO: [Non-Fpo])
04 0927eeb0 5dff632d [color="#FF0000"]000004ff [/color]ffffffff 00000000 ieui!CoreSC::Wait+0x49 (FPO: [Non-Fpo])
05 0927eed8 5dff60d8 000004ff 00000000 424198bd ieui!CoreSC::WaitMessage+0x54 (FPO: [Non-Fpo])
06 0927eee4 424198bd 039c9970 051c9650 00000000 ieui!WaitMessageEx+0x33 (FPO: [Non-Fpo])
07 0927ef14 4240ab4c 052739b8 0927ef44 4240bbbb ieframe!CBrowserFrame::FrameMessagePump+0x199 (FPO: [Non-Fpo])
08 0927ef20 4240bbbb 00000000 00000000 039c9970 ieframe!BrowserThreadProc+0x3f (FPO: [Non-Fpo])
09 0927ef44 4240bb09 10040001 02240006 00203138 ieframe!BrowserNewThreadProc+0x7b (FPO: [Non-Fpo])
0a 0927ffb4 7c80b713 039c9970 02240006 00203138 ieframe!SHOpenFolderWindow+0x188 (FPO: [Non-Fpo])
0b 0927ffec 00000000 4240ba53 039c9970 00000000 kernel32!BaseThreadStart+0x37 (FPO: [Non-Fpo])

1. There are 61 threads in the IE process and most of threads were waiting unknown events.

2. Then I checked if there is any Critical Section deadlock by !locks command, but unfortunately no deadlock found, gosh....

3. I found the ieframe!BrowserNewThreadProc was waiting, and so I guessed that's why the IE window stopped response becuase the UI thread was waiting multiple objects.

4. There are two UI threads (thread 1 and 28). So there might be two pop-up IE windows when the problem occurred.

5. I also noticed the call stack ieui!CoreSC::Wait, so I checked the related object and I got the following result (It's a Key, but I'm not sure if it's related to the hang problem):

0:000> !handle 000004ff ff
Handle 000004ff
  Type         	Key
  Attributes   	0
  GrantedAccess	0x20019:
         ReadControl
         QueryValue,EnumSubKey,Notify
  HandleCount  	2
  PointerCount 	3
  Name         	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NetBT\Parameters\Interfaces
  No object specific information available

If someone needs the dump file, please let me know.

Thank you in advance.

Simon

[cluberti]

Yes, the dmp file would be quite helpful - the wait you see in threads 0 and 1 are actually quite normal, and not the cause of your hang likely.

[shuenmin@gmail.com]

Yes, the dmp file would be quite helpful - the wait you see in threads 0 and 1 are actually quite normal, and not the cause of your hang likely.

hi cluberti, you can download the compressed dump file (approximate file size is 68 MB) from the following link:

https://rcpt.yousendit.com/627587789/7b4e78...3ec364e38dc1600

thanks for ur help.

[cluberti]

// The worker thread to spin up a new window:
0:010> ~61kb
ChildEBP RetAddr  Args to Child			  
107aff6c 7c92da2c 7c93026d 00000410 107affac ntdll!KiFastSystemCallRet
107aff70 7c93026d 00000410 107affac 107affb0 ntdll!NtRemoveIoCompletion+0xc
107affb4 7c80b713 00000000 00000002 096ee994 ntdll!RtlpWorkerThread+0x3d
107affec 00000000 7c930230 00000000 00000000 kernel32!BaseThreadStart+0x37

// The OLE call to start the RPC thread:
0:010> ~60kb
ChildEBP RetAddr  Args to Child			  
1676ff1c 7c92d1fc 7c8023f1 00000000 1676ff50 ntdll!KiFastSystemCallRet
1676ff20 7c8023f1 00000000 1676ff50 7c802550 ntdll!NtDelayExecution+0xc
1676ff78 7c802455 0000ea60 00000000 1676ffb4 kernel32!SleepEx+0x61
1676ff88 769ae32f 0000ea60 0d3f6c40 769ae3ee kernel32!Sleep+0xf
1676ff94 769ae3ee 00000000 044efa18 0d3f6c40 ole32!CROIDTable::WorkerThreadLoop+0x14
1676ffa8 769ae456 76ab6f74 1676ffec 7c80b713 ole32!CRpcThread::WorkerLoop+0x1e
1676ffb4 7c80b713 0d3f6c40 044efa18 76ab6f74 ole32!CRpcThreadCache::RpcWorkerThreadEntry+0x1b
1676ffec 00000000 769ae43b 0d3f6c40 00000000 kernel32!BaseThreadStart+0x37

// Creating the DirectDraw thread to actually draw the window itself:
0:010> ~59kb
ChildEBP RetAddr  Args to Child			  
0469ff54 77d191be 77d191f1 0469ff98 00000000 ntdll!KiFastSystemCallRet
0469ff74 7cfceabc 0469ff98 00000000 00000000 user32!NtUserGetMessage+0xc
0469ffb4 7c80b713 00000000 7c932d58 00000000 quartz!ObjectThread+0x47
0469ffec 00000000 7cfcea75 000019e0 00000000 kernel32!BaseThreadStart+0x37

// The RPC call to create the new window:
0:010> ~58kb
ChildEBP RetAddr  Args to Child			  
0efafe14 7c92da8c 77e565e3 00000258 0efaff74 ntdll!KiFastSystemCallRet
0efafe18 77e565e3 00000258 0efaff74 00000000 ntdll!NtReplyWaitReceivePortEx+0xc
0efaff80 77e56caf 0efaffa8 77e56ad1 0018fef8 rpcrt4!LRPC_ADDRESS::ReceiveLotsaCalls+0x12a
0efaff88 77e56ad1 0018fef8 0ebff9bc 05033d40 rpcrt4!RecvLotsaCallsWrapper+0xd
0efaffa8 77e56c97 00171df8 0efaffec 7c80b713 rpcrt4!BaseCachedThreadRoutine+0x79
0efaffb4 7c80b713 149bcbf0 0ebff9bc 05033d40 rpcrt4!ThreadStartRoutine+0x1a
0efaffec 00000000 77e56c7d 149bcbf0 00000000 kernel32!BaseThreadStart+0x37

// IEFrame's message pump, which takes the new window call:
0:010> ~28kb
ChildEBP RetAddr  Args to Child			  
0927ed94 7c92df2c 7c809574 00000002 0927edc0 ntdll!KiFastSystemCallRet
0927ed98 7c809574 00000002 0927edc0 00000001 ntdll!NtWaitForMultipleObjects+0xc
0927ee34 77d195f9 00000002 0927ee5c 00000000 kernel32!WaitForMultipleObjectsEx+0x12c
0927ee90 5dff6029 00000001 0927eec4 ffffffff user32!RealMsgWaitForMultipleObjectsEx+0x13e
0927eeb0 5dff632d 000004ff ffffffff 00000000 ieui!CoreSC::Wait+0x49
0927eed8 5dff60d8 000004ff 00000000 424198bd ieui!CoreSC::WaitMessage+0x54
0927eee4 424198bd 039c9970 051c9650 00000000 ieui!WaitMessageEx+0x33
0927ef14 4240ab4c 052739b8 0927ef44 4240bbbb ieframe!CBrowserFrame::FrameMessagePump+0x199
0927ef20 4240bbbb 00000000 00000000 039c9970 ieframe!BrowserThreadProc+0x3f
0927ef44 4240bb09 10040001 02240006 00203138 ieframe!BrowserNewThreadProc+0x7b
0927ffb4 7c80b713 039c9970 02240006 00203138 ieframe!SHOpenFolderWindow+0x188
0927ffec 00000000 4240ba53 039c9970 00000000 kernel32!BaseThreadStart+0x37

// The mshtml thread to draw the innards of the new window:
0:010> ~56kb
ChildEBP RetAddr  Args to Child			  
106aff0c 7c92df3c 7c8025db 00002320 00000000 ntdll!KiFastSystemCallRet
106aff10 7c8025db 00002320 00000000 106aff44 ntdll!ZwWaitForSingleObject+0xc
106aff74 7c802542 00002320 000927c0 00000000 kernel32!WaitForSingleObjectEx+0xa8
106aff88 42adf4c5 00002320 000927c0 42a40000 kernel32!WaitForSingleObject+0x12
106affa0 42ad6bba 001a0348 0019f290 42a5d9ac mshtml!CDwnTaskExec::ThreadExec+0x127
106affac 42a5d9ac 106affec 7c80b713 1518b480 mshtml!CExecFT::ThreadProc+0x3c
106affb4 7c80b713 1518b480 001a0348 0019f290 mshtml!CExecFT::StaticThreadProc+0xd
106affec 00000000 42a5d99f 1518b480 00000000 kernel32!BaseThreadStart+0x37

// The network call for the contents of the new window:
0:010> ~52kb
ChildEBP RetAddr  Args to Child			  
0f5af118 7c92df3c 719b402b 000017d8 00000001 ntdll!KiFastSystemCallRet
0f5af11c 719b402b 000017d8 00000001 0f5af144 ntdll!ZwWaitForSingleObject+0xc
0f5af158 719b57c1 000017d8 0000179c 00000000 mswsock!SockWaitForSingleObject+0x1a0
0f5af1d0 71a167de 0000179c 0f5af208 00000001 mswsock!WSPRecv+0x1dd
0f5af218 6d4d6a10 0000179c 08e8a3a0 00004000 ws2_32!recv+0x83
WARNING: Stack unwind information not available. Following frames may be wrong.
0f5afa40 098382ff 08e8a3a0 0f5afaa4 0f5afaa0 net!Java_java_net_SocketInputStream_socketRead0+0x140
0f5afa80 09832a8f 00000000 09836509 00000000 0x98382ff
0f5afbb4 07a373ed 0f5afbe8 0f5afd8c 0000000a 0x9832a8f
0f5afc30 07a8fb96 0000000a 00000000 0f5afce4 jvm!AsyncGetCallTrace+0x1d048
0f5afc74 07a372be 07a372c2 0f5afd84 0f5afc98 jvm!jmm_GetLastGCStat+0x1082b
0f5afcc4 07a3701b 0f5afd84 08e7cfe4 07b34594 jvm!AsyncGetCallTrace+0x1cf19
0f5afd40 07a51e95 0f5afd84 08e7cfe0 08e7cfe4 jvm!AsyncGetCallTrace+0x1cc76
0f5afd94 07ac1325 08e78408 08e78408 08e78408 jvm!JVM_StartThread+0x186
0f5afdc0 07ac12f3 08e7e210 07a8d261 00000000 jvm!JVM_RegisterPerfMethods+0x2d930
0f5aff80 77c0a3b0 08e78408 00000000 00000000 jvm!JVM_RegisterPerfMethods+0x2d8fe
0f5affb4 7c80b713 08e68dc8 00000000 00000000 msvcrt!_threadstartex+0x6f
0f5affec 00000000 77c0a341 08e68dc8 00000000 kernel32!BaseThreadStart+0x37

// The URL we're waiting on data from:
0:000> da 0x14546bb8  
14546bb8  "http://www.macaodaily.com/html/2"
14546bd8  "008-11/page.xml"

I can't tell you why the socket is in a wait state (this all happens down in kernel once we get here), but I can tell you that IE isn't "hung", it's waiting on data. That means that there's either a problem going across the network itself, or there's a problem from the network card driver up through the IP stack into the kernel and back to IE. Since Java is reading from the socket buffer in a stream, any delay will cause what will appear to be a "hang" until the buffer is full and net.dll (the java component responsible for interfacing with the network components) releases the socket.

You should probably take a closer look at what is installed on the network stack on this box, including any antivirus and firewall products, and also make sure your network drivers are the latest available versions as well. It's not IE (and probably not java either), but something deeper down into the kernel causing the delay.

[shuenmin@gmail.com]

Hello cluberti,

Could you please show me how did u find the address 0x14546bb8 which was the URL?

The URL was not supposed to be linked at the IE related to the hanging web application.

I want to determine if there is any strange URL from other dump files.

If u can teach me how to find it out, that would be VERY great.

Another question is the the hang problem is always happened on IE7, not really on IE6.

Because u mention the network issue, I know there are two IE parameters, MaxConnectionsPer1_0Server and MaxConnectionsPerServer, in the Windows registry, and the default value is 1 for IE7.

In addition to, the problematic web app includes several IFrames that will request different URLs.

Do u think the small value for the two parameters could cause the network stuck issue?

Thanks in advance,

Simon

[cluberti]

Hello cluberti,

Could you please show me how did u find the address 0x14546bb8 which was the URL?

The URL was not supposed to be linked at the IE related to the hanging web application.

I want to determine if there is any strange URL from other dump files.

If u can teach me how to find it out, that would be VERY great.

Another question is the the hang problem is always happened on IE7, not really on IE6.

Because u mention the network issue, I know there are two IE parameters, MaxConnectionsPer1_0Server and MaxConnectionsPerServer, in the Windows registry, and the default value is 1 for IE7.

In addition to, the problematic web app includes several IFrames that will request different URLs.

Do u think the small value for the two parameters could cause the network stuck issue?

Thanks in advance,

Simon

First, I can't really answer that first question without posting pages and pages of debug notes. It involves an intimate knowledge of wininet, which I have. Second, the value for MaxConnectionsPerServer isn't 1, it's 2 (MaxConnectionsPer1_0Server is 4) - and your system has 2 according to the wininet globals in the dump you provided, but only was using 1 connection (again, wininet innards). You could try upping the MaxConnectionsPerServer to something larger, like 6 (IE8's default) to see if it helps, but I don't see a real indication this is your problem.

[shuenmin@gmail.com]

First, I can't really answer that first question without posting pages and pages of debug notes. It involves an intimate knowledge of wininet, which I have. Second, the value for MaxConnectionsPerServer isn't 1, it's 2 (MaxConnectionsPer1_0Server is 4) - and your system has 2 according to the wininet globals in the dump you provided, but only was using 1 connection (again, wininet innards). You could try upping the MaxConnectionsPerServer to something larger, like 6 (IE8's default) to see if it helps, but I don't see a real indication this is your problem.

OK, we are checking out the strange URL and will try to see if there is any network problem in the environment.

I would update the result if we determine what really caused the problem.

Again, many thanks.