Flash9b.ocx gets 0xC0000005 (AV) in IE7

[amclaren]

Hi all,

Is there any solution to this widespread problem?

I'm running IE7 on Windows Vista. IE crashes about once a day with a
0xC0000005 exception. So I took the option to debug the program, and found
Flash9b.ocx at the top of the call satck (see below).

There doesn't appear to be any support avenue via Adobe - Player support is
limited to installation. The Flash Player installs fine (in fact, I'd rather
*stop* it from getting installed!). This crash is obviously a runtime issue and
an invalid memory reference.

In some other forum posts, it was suggested the culprit may be bad sites/URLs,
which run bad code. That may be; but I sure wish Flash Player was just a little
bit more resilient, against unstable input code. After all, you're already
watching out for buffer overruns, etc - right??

I'm incredibley annoyed and frustrated by this problem. Based on forum posts,
it appears to be quite widespread, too - not isolated to one or two unusual
configurations. Has a solution been found yet? If not, what is Adobe doing to
find a solution and what is the ETA?

Personally I have no interest in using Flash, or paying for support - I only
run the Flash Player, because some websites erronrously believe Flash is
useful, and I need the Player to view the sites. If Flash had some kind of
reporting tool so I could automatically send crash data back to Adobe, that
would be a workaround.

Thanks
Andrew McLaren

The call stack:

> Flash9b.ocx!30099589()

[Frames below may be incorrect and/or missing, no symbols loaded for
Flash9b.ocx]
Flash9b.ocx!30099a5f()
Flash9b.ocx!30113ce9()
Flash9b.ocx!30001263()
Flash9b.ocx!300925d5()
mshtml.dll!PlainRelease() + 0x780b bytes
Flash9b.ocx!300b299b()
Flash9b.ocx!300b5a01()
mshtml.dll!CTimer::GetTime() + 0x2b bytes
mshtml.dll!CTimer::ProcessAdvise() - 0x16f89 bytes
mshtml.dll!CTimerSink::OnTimer() + 0x14 bytes
mshtml.dll!CTimerCtx::ProcessAdvise() + 0xe3 bytes
mshtml.dll!CTimerCtx::OnMethodCall() + 0x17 bytes
mshtml.dll!GlobalWndOnMethodCall() + 0xd4 bytes
mshtml.dll!GlobalWndProc() + 0xb1 bytes
user32.dll!_InternalCallWinProc@20() + 0x23 bytes
user32.dll!_UserCallWinProcCheckWow@32() + 0xb7 bytes
user32.dll!_DispatchMessageWorker@8() + 0xee bytes
user32.dll!_DispatchMessageW@4() + 0xf bytes
ieframe.dll!CTabWindow::_TabWindowThreadProc() + 0x237 bytes
kernel32.dll!@BaseThreadInitThunk@12() + 0xe bytes
ntdll.dll!__RtlUserThreadStart@8() + 0x23 bytes

The file:
Directory of C:\Windows\SysWOW64\Macromed\Flash

09/11/2006 02:46 PM 2,262,648 Flash9b.ocx
1 File(s) 2,262,648 bytes

File version is 9.0.28.0

Because of Side-by-Side, I have several Mshtml.dll files installed:

C:\Windows>dir mshtml.dll /s
Volume in drive C is System
Volume Serial Number is 7846-1538

Directory of C:\Windows\System32

29/03/2007 04:42 PM 5,663,232 mshtml.dll
1 File(s) 5,663,232 bytes

Directory of C:\Windows\SysWOW64

29/03/2007 04:42 PM 3,580,416 mshtml.dll
1 File(s) 3,580,416 bytes

Directory of
C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_6.0.
60
00.16386_none_6d2aec23dd9bdb7e

02/11/2006 09:18 PM 5,664,768 mshtml.dll
1 File(s) 5,664,768 bytes

Directory of
C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_6.0.
60
00.16397_none_6d211c81dda310c6

29/03/2007 04:42 PM 5,663,232 mshtml.dll
1 File(s) 5,663,232 bytes

Directory of
C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_6.0.
60
00.20491_none_6da4b790f6c61886

29/03/2007 04:42 PM 5,663,232 mshtml.dll
1 File(s) 5,663,232 bytes

Directory of
C:\Windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_6.0.60
00
.16386_none_110c50a0253e6a48

02/11/2006 07:46 PM 3,580,416 mshtml.dll
1 File(s) 3,580,416 bytes

Directory of
C:\Windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_6.0.60
00
.16397_none_110280fe25459f90

29/03/2007 04:42 PM 3,580,416 mshtml.dll
1 File(s) 3,580,416 bytes

Directory of
C:\Windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_6.0.60
00
.20491_none_11861c0d3e68a750

29/03/2007 04:42 PM 3,580,416 mshtml.dll
1 File(s) 3,580,416 bytes

Total Files Listed:
8 File(s) 36,976,128 bytes
0 Dir(s) 9,085,542,400 bytes free

C:\Windows>

Video Card is an nVidia 7900GS, using the Microsoft-supplied drivers from
Vista.

[Darren McNally - Adobe]

Hi amclaren,

I see that you are using Flash Player version 9.0.28.0. Can you please test
this with the latest release of Flash Player 9.0.45.0?

Instructions for uninstalling and reinstalling the latest Flash Player:

1. First download the uninstaller to your desktop from here
[url]http://www.adobe.com/go/tn_14157[/url]
2. Before running this uninstaller be sure to read the instruction and close
all running programs.
3. Open the following folder C:\WINDOWS\system32\Macromed\Flash
4. Run the uninstaller
5. What files are left in this folder? C:\WINDOWS\system32\Macromed\Flash
6. If there are files left, delete the Flash folder.
7. Install the Flash Player from here: [url]http://www.adobe.com/go/getflashplayer[/url]


Please let me know the resluts.

[amclaren]

Hi Darren

Thanks for your reply, it's appreciated. I ran the uninstalller (logged in as
Administrator, no other desktop apps running). It completed okay; although, it
left a few files behind (see below). So I deleted the whole
System32\Macromed\Flash tree manually.

And I've installed 9.0.45.0 (I also cleared out Temporary Internet Files, and
all that general IE troubleshooting stuff).

I'll let you know what results I get - more news, as it comes to hand.

BTW, is there a public changelog, of the changes between 9.0.28 and 9.0.45?

Thanks again!
Regards
Andrew McLaren

Left-over files after running Uninstaller:

C:\Windows\System32\Macromed\Flash>dir /s
Volume in drive C is System
Volume Serial Number is 7846-1538

Directory of C:\Windows\System32\Macromed\Flash

01/04/2007 06:56 PM <DIR> .
01/04/2007 06:56 PM <DIR> ..
09/06/2004 03:59 PM 939,224 Flash.ocx
09/11/2006 02:46 PM 2,262,648 Flash9b.ocx
01/04/2007 06:56 PM <DIR> FlashPlayerTrust
09/11/2006 02:46 PM 190,072 FlashUtil9b.exe
09/06/2004 04:06 PM 99,544 GetFlash.exe
08/12/2003 01:57 PM 601 GetFlash.exe.manifest
5 File(s) 3,492,089 bytes

Directory of C:\Windows\System32\Macromed\Flash\FlashPlayerTrus t

01/04/2007 06:56 PM <DIR> .
01/04/2007 06:56 PM <DIR> ..
01/04/2007 06:03 PM 1,150 AdobeBridgeTrust.cfg
1 File(s) 1,150 bytes

Total Files Listed:
6 File(s) 3,493,239 bytes
5 Dir(s) 9,888,641,024 bytes free

C:\Windows\System32\Macromed\Flash>

[Darren McNally - Adobe]

Hi Andrew,

>?BTW, is there a public changelog, of the changes between 9.0.28 and 9.0.45??

Yes, Adobe does list fixes and improvements in the release notes.


[url]http://www.adobe.com/support/documentation/en/flashplayer/9/releasenotes.html#fi[/url]
xes_9045

For example, fixed in this version:

? A crash occurs when flash.net.URLRequest.requestHeaders is passed an array
that contains anything other than URLRequestHeader instances including null
values. (192166 )

Please let us know your results after testing with Flash Player 9.0.45.0

[speedy d]

A similar thread is on going here:


[url]http://www.adobe.com/cfusion/webforums/forum/messageview.cfm?forumid=44&catid=18[/url]
4&threadid=1225746&enterthread=y#4406527

I installed the new player and it did not fix my problem.

Now its flash9c.ocx.

I think i may have been getting it less, but then i did revise my whole code,
tried to cut down on the memory flahs player was using. but fail to spot what
can be calling this if it is something code related.

It still does happen. Very frustrating when you have 10's thousands of users
and not knowing what response to give the customer

[amclaren]

Hi Darren and Adobe guys,

I just had the same crash while using flash9c.ocx version 9.0 r45:

"Unhandled exception at 0x30099baf in iexplore.exe: 0xC0000005: Access
violation reading location 0x00000000."

The new r45 version has not fixed the problem. I included the call stack at
the bottom of this post. It very closely resembles the call stack I got from
flash9b.ocx; so, it's probably the same crash.

It seems like the crash tends to happen shortly after I have opened several
new Tabs in Internet Explorer, in quick succession - say, I'll have 5 or 6 Tabs
open at the same time. There's nothing special about the several URLs, except
they all point towards web pages that include a small amount of Flash. This is
just a subjective impression, but thats all I can tell about what sets it off.

So I 'm guessing there may be some kind of race condition? Some global
variable gets wiped inappropriately because it is accessed by multiple threads,
or the like.

This is a really frustrating issue, so if there's anything you'd like me to do
to collect more data, let me know. Are there any Flash Play diagnostics I can
turn on via the registry, or the like?

Regards
Andrew McLaren

Call stack for crashing flash9c.ocx:

> Flash9c.ocx!30099baf()

[Frames below may be incorrect and/or missing, no symbols loaded for
Flash9c.ocx]
Flash9c.ocx!3009a07f()
Flash9c.ocx!3010859c()
Flash9c.ocx!30001267()
Flash9c.ocx!30092bf7()
mshtml.dll!PlainRelease() + 0x780b bytes
Flash9c.ocx!300b2fac()
Flash9c.ocx!300b6012()
mshtml.dll!CTimer::GetTime() + 0x2b bytes
mshtml.dll!CTimer::ProcessAdvise() - 0x16f89 bytes
mshtml.dll!CTimerSink::OnTimer() + 0x14 bytes
mshtml.dll!CTimerCtx::ProcessAdvise() + 0xe3 bytes
mshtml.dll!CTimerCtx::OnMethodCall() + 0x17 bytes
mshtml.dll!GlobalWndOnMethodCall() + 0xd4 bytes
mshtml.dll!GlobalWndProc() + 0xb1 bytes
user32.dll!_InternalCallWinProc@20() + 0x23 bytes
user32.dll!_UserCallWinProcCheckWow@32() + 0xb7 bytes
user32.dll!_DispatchMessageWorker@8() + 0xee bytes
user32.dll!_DispatchMessageW@4() + 0xf bytes
ieframe.dll!CTabWindow::_TabWindowThreadProc() + 0x237 bytes
kernel32.dll!@BaseThreadInitThunk@12() + 0xe bytes
ntdll.dll!__RtlUserThreadStart@8() + 0x23 bytes

Instructions as displayed in Visual Studio debugger:

30099B7F call 30188DD0
30099B84 push dword ptr [esi+6Ch]
30099B87 mov dword ptr [esi+7Ch],ebx
30099B8A call 3019CC9D
30099B8F push dword ptr [esi+74h]
30099B92 mov dword ptr [esi+6Ch],ebx
30099B95 call 3019CC9D
30099B9A pop ecx
30099B9B lea edi,[esi+98h]
30099BA1 pop ecx
30099BA2 mov ecx,dword ptr [edi]
30099BA4 cmp ecx,ebx
30099BA6 mov dword ptr [esi+74h],ebx
30099BA9 je 30099BB1
30099BAB mov eax,dword ptr [ecx]
30099BAD push 1
-> 30099BAF call dword ptr [eax] ; <- here!
30099BB1 mov dword ptr [edi],ebx
30099BB3 pop edi
30099BB4 mov dword ptr [esi+2Ch],ebx
30099BB7 mov ecx,esi
30099BB9 pop esi
30099BBA pop ebx
30099BBB jmp 301881C0

[Darren McNally - Adobe]

Hi amclaren ,

Thanks for the info. Please send me an email [email]support_flash@hotmail.com[/email] and if
you include all the requested information, I?ll be able to open a case for you.

Here are some instructions to capture a crash log. We will have a better
chance in diagnosing the problem.

1. First open notepad or another text editor
2. Create a text file with one line: CrashLogEnable=1
3. Save the file as: c:\windows\system32\macromed\flash\mms.cfg
4. Generate a crash in the browser and record all URLs open at the time
(windows or tabs)
5. Open up a command line prompt. Select Start > Run and type cmd in the
dialog.
6. Type cd "Local Settings\Temp" at the command line prompt. Be sure that
Local Settings is in quotation marks.
7. Type dir *.mdmp at the command line prompt. These are the log files that
are to be sent to adobe.

Please include the following in the email:

1. crash log
2. dxdiag (machine specs ? instructions below)
3. URL (for all tabs)
4. web browser
5. OS
6. Flash Player version

How to get your dxdiag:

1. Select Start > Run
2. Type in ?dxdiag?
3. Save as a text file

[amclaren]

Hi Darren,

Just a quick ACK, for now - I've enabled the crash log as you described. I'll
email through the crash data as soon as I have the next crash (shouldn't take
more than a day, to get a good crash). Thanks for your help!

Regards
Andrew McLaren

[Darren McNally - Adobe]

Hi Andrew McLaren,

Thanks for the update. I'll keep my eye out for your email. Thank you for taking the time.

[amclaren]

Hi Darren

I have emailed the first dump; I'll send through more as they happen. If there
is anything else I can do to assist, please let me know.

(BTW I wasn't able to list all the URLs, since IE was completely hung at the
crash, a blank white window. I had several tabs open to pages at
[url]www.smh.com.au[/url], plus a couple of other sites)

Regards
Andrew McLaren