Minidump from crash (win32k!xxxAnimateCaption + Firefox)

[f3tus]

My PC reboots from time to time when it is under load. I looked at the minidump and there is a mention of win32k!xxxAnimateCaption as a probable problem as well as a mention of the firefox process. I'm not sure however what could be the problem here? Error 0x7F suggests possible RAM malfunction, but I'm curious as to what win32k!xxxAnimateCaption and firefox.exe have to do with the error. Perhaps somebody here can explain.

From event viewer:

The computer has rebooted from a bugcheck. The bugcheck was:

0x0000007f (0x00000000, 0x00000000, 0x00000000, 0x00000000).

A dump was saved in: C:\WINDOWS\Minidump\Mini020809-01.dmp.

Mini020809-01.dmp:

----- 32 bit Kernel Mini Dump Analysis

DUMP_HEADER32:

MajorVersion 0000000f

MinorVersion 00000a28

DirectoryTableBase 76fd6000

PfnDataBase 81b03000

PsLoadedModuleList 8054c150

PsActiveProcessHead 8054e1b8

MachineImageType 0000014c

NumberProcessors 00000002

BugCheckCode 0000007f

BugCheckParameter1 00000000

BugCheckParameter2 00000000

BugCheckParameter3 00000000

BugCheckParameter4 00000000

PaeEnabled 00000000

KdDebuggerDataBlock 8053c2e0

MiniDumpFields 00000dff

TRIAGE_DUMP32:

ServicePackBuild 00000100

SizeOfDump 00010000

ValidOffset 0000fffc

ContextOffset 00000320

ExceptionOffset 000007d0

MmOffset 00001068

UnloadedDriversOffset 000010a0

PrcbOffset 00001878

ProcessOffset 000024c8

ThreadOffset 00002720

CallStackOffset 00002978

SizeOfCallStack 00000a2c

DriverListOffset 00003638

DriverCount 00000090

StringPoolOffset 000060f8

StringPoolSize 000013f8

BrokenDriverOffset 00000000

TriageOptions 00000041

TopOfStack a9fed5d4

DebuggerDataOffset 000033a8

DebuggerDataSize 00000290

DataBlocksOffset 000074f0

DataBlocksCount 00000002

Windows XP Kernel Version 2600 (Service Pack 1) MP (2 procs) Free x86 compatible

Kernel base = 0x804d4000 PsLoadedModuleList = 0x8054c150

Debug session time: Sun Feb 08 10:41:35 2009

System Uptime: 0 days 0:36:05

start end module name

804d4000 806bb000 nt Checksum: 001DBB33 Timestamp: Wed Mar 02 01:36:33 2005 (42250A91)

Unloaded modules:

a9e95000 a9ebc000 kmixer.sys Timestamp: unavailable (00000000)

a9e95000 a9ebc000 kmixer.sys Timestamp: unavailable (00000000)

aa677000 aa69e000 kmixer.sys Timestamp: unavailable (00000000)

f7a67000 f7a68000 drmkaud.sys Timestamp: unavailable (00000000)

aae57000 aae64000 DMusic.sys Timestamp: unavailable (00000000)

aaa52000 aaa60000 swmidi.sys Timestamp: unavailable (00000000)

aa751000 aa774000 aec.sys Timestamp: unavailable (00000000)

f79f1000 f79f3000 splitter.sys Timestamp: unavailable (00000000)

f781f000 f7824000 Cdaudio.SYS Timestamp: unavailable (00000000)

b9a88000 b9a8b000 Sfloppy.SYS Timestamp: unavailable (00000000)

Finished dump check

And from WinDbg:

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7F, {0, 0, 0, 0}

Probably caused by : win32k.sys ( win32k!xxxAnimateCaption+215 )

Followup: MachineOwner

---------

1: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP (7f)

This means a trap occurred in kernel mode, and it's a trap of a kind

that the kernel isn't allowed to have/catch (bound trap) or that

is always instant death (double fault). The first number in the

bugcheck params is the number of the trap (8 = double fault, etc)

Consult an Intel x86 family manual to learn more about what these

traps are. Here is a *portion* of those codes:

If kv shows a taskGate

use .tss on the part before the colon, then kv.

Else if kv shows a trapframe

use .trap on that value

Else

.trap on the appropriate frame will show where the trap was taken

(on x86, this will be the ebp that goes with the procedure KiTrap)

Endif

kb will then show the corrected stack.

Arguments:

Arg1: 00000000, EXCEPTION_DIVIDED_BY_ZERO

Arg2: 00000000

Arg3: 00000000

Arg4: 00000000

Debugging Details:

------------------

OVERLAPPED_MODULE: Address regions for 'kmixer' and 'kmixer.sys' overlap

BUGCHECK_STR: 0x7f_0

TRAP_FRAME: a9fed654 -- (.trap 0xffffffffa9fed654)

ErrCode = 00000000

eax=fffd609d ebx=00000480 ecx=000000fa edx=7fffffff esi=00000000 edi=00cc0020

eip=bf8aa1c2 esp=a9fed6c8 ebp=a9fed720 iopl=0 nv up ei ng nz na po nc

cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282

win32k!xxxAnimateCaption+0x215:

bf8aa1c2 f7f9 idiv eax,ecx

Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: firefox.exe

LAST_CONTROL_TRANSFER: from 8058732f to 804f571e

STACK_TEXT:

a9fed5e8 8058732f 0000007f 00cc0020 00000000 nt!KeBugCheck+0x10

a9fed648 805323de a9fed654 000000ef 00000241 nt!Ki386CheckDivideByZeroTrap+0x41

a9fed648 bf8aa1c2 a9fed654 000000ef 00000241 nt!KiTrap00+0x6e

a9fed720 bf8aa340 000000ac 6b01189e 00000000 win32k!xxxAnimateCaption+0x215

a9fed774 bf8a2f05 bc66cd10 bc66cd10 6b01189e win32k!xxxDrawAnimatedRects+0xdf

a9fed84c bf83b0b3 e1908eb0 00000002 00010000 win32k!xxxMinMaximize+0x523

a9fed874 bf81bf26 00000010 00010002 0012f554 win32k!xxxShowWindow+0x150

a9fed894 80531814 000502a2 00000002 bf95c728 win32k!NtUserShowWindow+0x77

a9fed894 7ffe0304 000502a2 00000002 bf95c728 nt!KiSystemService+0xc9

0012f708 00000000 00000000 00000000 00000000 SharedUserData!SystemCallStub+0x4

STACK_COMMAND: kb

FOLLOWUP_IP:

win32k!xxxAnimateCaption+215

bf8aa1c2 f7f9 idiv eax,ecx

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: win32k!xxxAnimateCaption+215

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4341dcff

FAILURE_BUCKET_ID: 0x7f_0_win32k!xxxAnimateCaption+215

BUCKET_ID: 0x7f_0_win32k!xxxAnimateCaption+215

Followup: MachineOwner

---------

(.trap 0xffffffffa9fed654):

1: kd> .trap 0xffffffffa9fed654

ErrCode = 00000000

eax=fffd609d ebx=00000480 ecx=000000fa edx=7fffffff esi=00000000 edi=00cc0020

eip=bf8aa1c2 esp=a9fed6c8 ebp=a9fed720 iopl=0 nv up ei ng nz na po nc

cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282

win32k!xxxAnimateCaption+0x215:

bf8aa1c2 f7f9 idiv eax,ecx

Thank you.

[cluberti]

If you're getting a win32 crash (is it always in firefox?), it could be a video driver issue, it could be a problem with the application itself sending the GDI information down to Windows, etc - hard to say without something more than a minidump to look at. I would suggest configuring for a complete memory dump, and then uploading that .dmp file somewhere the next time the problem occurs.

[f3tus]

As a matter of fact, it is not always with Firefox. I was stressing my PC with only Prime95 running and after a few minutes, it rebooted. This is part of the dump:

BugCheck D1, {93e56a0, 2, 0, b9ad4666}

Unable to load image RtkHDAud.sys, Win32 error 0n2

*** WARNING: Unable to verify timestamp for RtkHDAud.sys

*** ERROR: Module load completed but symbols could not be loaded for RtkHDAud.sys

*** WARNING: Unable to verify timestamp for ks.sys

*** ERROR: Module load completed but symbols could not be loaded for ks.sys

Probably caused by : RtkHDAud.sys ( RtkHDAud+94666 )

Followup: MachineOwner

---------

0: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)

An attempt was made to access a pageable (or completely invalid) address at an

interrupt request level (IRQL) that is too high. This is usually

caused by drivers using improper addresses.

If kernel debugger is available get stack backtrace.

Arguments:

Arg1: 093e56a0, memory referenced

Arg2: 00000002, IRQL

Arg3: 00000000, value 0 = read operation, 1 = write operation

Arg4: b9ad4666, address which referenced memory

Debugging Details:

------------------

READ_ADDRESS: 093e56a0

CURRENT_IRQL: 2

FAULTING_IP:

RtkHDAud+94666

b9ad4666 0f2806 movaps xmm0,xmmword ptr [esi]

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

PROCESS_NAME: System

Then I played a little bit of Quake 1 and it rebooted again. This is part of the dump:

BugCheck 1000008E, {c0000005, bf8812b8, aa5a941c, 0}

Probably caused by : win32k.sys ( win32k!NtGdiModifyWorldTransform+20e )

Followup: MachineOwner

---------

0: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)

This is a very common bugcheck. Usually the exception address pinpoints

the driver/function that caused the problem. Always note this address

as well as the link date of the driver/image that contains this address.

Some common problems are exception code 0x80000003. This means a hard

coded breakpoint or assertion was hit, but this system was booted

/NODEBUG. This is not supposed to happen as developers should never have

hardcoded breakpoints in retail code, but ...

If this happens, make sure a debugger gets connected, and the

system is booted /DEBUG. This will let us see why this breakpoint is

happening.

Arguments:

Arg1: c0000005, The exception code that was not handled

Arg2: bf8812b8, The address that the exception occurred at

Arg3: aa5a941c, Trap Frame

Arg4: 00000000

Debugging Details:

------------------

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:

win32k!NtGdiModifyWorldTransform+20e

bf8812b8 8b10 mov edx,dword ptr [eax]

TRAP_FRAME: aa5a941c -- (.trap 0xffffffffaa5a941c)

ErrCode = 00000000

eax=627ea07c ebx=aa5a94d8 ecx=00000031 edx=ffffffce esi=00000059 edi=e2834b18

eip=bf8812b8 esp=aa5a9490 ebp=aa5a94a4 iopl=0 nv up ei pl nz na po nc

cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202

win32k!NtGdiModifyWorldTransform+0x20e:

bf8812b8 8b10 mov edx,dword ptr [eax] ds:0023:627ea07c=????????

Resetting default scope

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: explorer.exe

All three dumps have DRIVER_FAULT as a default bucket ID (whatever that is), so I'm guessing it's something to do with the drivers and I can scratch faulty RAM off the list? Or is that still a possibility? The first dump also says RtkHDAud.sys could be the problem, which is an audio driver, but the second one mentions win32k!NtGdiModifyWorldTransform as the problem. Now I'm confused. Is it both an audio and video issue? I'll try to see what a complete dump will show up.

Edit: I checked some more minidumps and most of the time (like 90%) the cause of the problem seems to be win32k!NtGdiModifyWorldTransform+20e so it could be a video driver issue like you said. I'll run memtest through the night to see if the memory is ok, though. If it's not, I suppose it would be a safe bet to point the finger at the RAM.

Edited February 8, 2009 by f3tus