IE crashing on MSHTML dump

Hi all,

I am new to this and have a dump that I need help with. Can some one point me in the right direction on what is casuing the issue.

FAULTING_IP:
mshtml!CRecalcProperty::~CRecalcProperty+3
6374eca4 f6462d04 test byte ptr [esi+2Dh],4

EXCEPTION_RECORD: ffffffff -- (.exr ffffffffffffffff)
ExceptionAddress: 6374eca4 (mshtml!CRecalcProperty::~CRecalcProperty+0x00000003)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 8bf18b83
Attempt to read from address 8bf18b83

DEFAULT_BUCKET_ID: APPLICATION_FAULT

PROCESS_NAME: iexplore.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx ". The memory could not be "%s ".

READ_ADDRESS: 8bf18b83

BUGCHECK_STR: ACCESS_VIOLATION

LAST_CONTROL_TRANSFER: from 6374f04a to 6374eca4

STACK_TEXT:
0012e674 6374f04a 635bf2c8 6374f380 00000001 mshtml!CRecalcProperty::~CRecalcProperty+0x3
0012e67c 6374f380 00000001 025b31b0 025b4edc mshtml!CRecalcProperty::`scalar deleting destructor'+0x8
0012e698 6374f42a 00000000 0012e70c 025b4ee0 mshtml!CRecalcObject:etach+0x44
0012e6b0 6374f48a 025ba7e0 63666ccc 025b4ee0 mshtml!CRecalcEngine:etach+0x20
0012e6b8 63666ccc 025b4ee0 6351a30e 0020cd90 mshtml!CRecalcEngine::SetSite+0x15
0012e6d0 6360c3ba 025ba7a0 6360c660 025ba7a0 mshtml!CScriptDebugDocument::UpdateDocumentSize+0x21
0012e6d8 6360c660 025ba7a0 025c4840 025c4304 mshtml!CScriptCollection::CDebugDocumentStack::~CDebugDocumentStack+0x11
0012e70c 637b860c 025c48b0 025aa790 00000000 mshtml!CScriptCollection:arseScriptText+0x187
0012e7c4 637b8b45 00000000 00000000 00000000 mshtml!CScriptElement::CommitCode+0x1c0
0012e7fc 6378ce91 025ba9e0 2e27005e 00000000 mshtml!CScriptElement::Execute+0xa2
0012e848 63782fdb 025baaa0 025ba9e0 63783d9f mshtml!CHtmParse::Execute+0x41
0012e854 63783d9f 6378ce50 2e27005e 025ba9e0 mshtml!CHtmPost::Broadcast+0xb
0012e910 63783f23 2e27005e 025ba9e0 024b02d0 mshtml!CHtmPost::Exec+0x32f
0012e928 63783faf 2e27005e 024b02d0 025ba9e0 mshtml!CHtmPost::Run+0x53
0012e938 6378430f 024b02d0 2e27005e 025ba9e0 mshtml!PostManExecute+0x4f
0012e950 6378434c 025ba9e0 00000001 63781606 mshtml!PostManResume+0x6f
0012e95c 63781606 025baa30 025ba9e0 636ae835 mshtml!CHtmPost::OnDwnChanCallback+0xc
0012e968 636ae835 025baa30 00000000 00000000 mshtml!CDwnChan::OnMethodCall+0x15
0012e99c 636aea50 0012edb0 0012edb8 c0000000 mshtml!GlobalWndOnMethodCall+0x64
0012eac0 77e3a3d0 00aa03ba 000003ed 00000000 mshtml!GlobalWndProc+0x11f
0012eae0 77e14605 636ae931 00aa03ba 00008002 USER32!UserCallWinProc+0x18
0012eb6c 77e1a7ba 0012edb0 00000000 71519abe USER32!DispatchMessageWorker+0x2e4
0012eb78 71519abe 0012edb0 00000000 0013a7f0 USER32!DispatchMessageW+0xb
0012eb90 71520513 0012edb0 0012fee8 0013a578 BROWSEUI!TimedDispatchMessage+0x35
0012ede8 71520612 00000000 0012fee8 0013a578 BROWSEUI!BrowserThreadProc+0x2d5
0012ee74 715208a9 0013a578 0013a578 00000000 BROWSEUI!BrowserProtectedThreadProc+0x44
0012fef0 717627a6 0013a578 00401350 70a7d257 BROWSEUI!SHOpenFolderWindow+0x1ec
0012ff10 00401ecd 00132c8a 000209f4 00300030 SHDOCVW!IEWinMain+0x108
0012ff60 00401f7d 00000004 00000000 00132c8a iexplore!WinMainT+0x2dc
0012ffc0 7c59893d 00300030 00300030 7ffdf000 iexplore!ModuleEntry+0x97
0012fff0 00000000 00401ee6 00000000 00000000 KERNEL32!BaseProcessStart+0x3d


STACK_COMMAND: ~0s; .ecxr ; kb

FAULTING_THREAD: 00000810

FOLLOWUP_IP:
mshtml!CRecalcProperty::~CRecalcProperty+3
6374eca4 f6462d04 test byte ptr [esi+2Dh],4

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: mshtml!CRecalcProperty::~CRecalcProperty+3

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: mshtml

IMAGE_NAME: mshtml.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 446e4afe

FAILURE_BUCKET_ID: ACCESS_VIOLATION_mshtml!CRecalcProperty::~CRecalcProperty+3

BUCKET_ID: ACCESS_VIOLATION_mshtml!CRecalcProperty::~CRecalcProperty+3

Followup: MachineOwner
---------

0:000> k
ChildEBP RetAddr
0012d47c 7c599fe4 ntdll!ZwWaitForSingleObject+0xb
0012d4a4 7c57b3db KERNEL32!WaitForSingleObjectEx+0x71
0012d4b4 00401b3a KERNEL32!WaitForSingleObject+0xf
0012df78 7c35f0c3 iexplore!DwExceptionFilter+0x28f
0012df84 5167e141 MSVCR71!__CxxUnhandledExceptionFilter+0x46
WARNING: Stack unwind information not available. Following frames may be wrong.
0012e298 71520632 PDM!DllUnregisterServer+0x8b80
0012ee74 715208a9 BROWSEUI!BrowserProtectedThreadProc+0x64
0012fef0 717627a6 BROWSEUI!SHOpenFolderWindow+0x1ec
0012ff10 00401ecd SHDOCVW!IEWinMain+0x108
0012ff60 00401f7d iexplore!WinMainT+0x2dc
0012ffc0 7c59893d iexplore!ModuleEntry+0x97
0012fff0 00000000 KERNEL32!BaseProcessStart+0x3d
0:000> lmvm mshtml
start end module name
63580000 63821000 mshtml (pdb symbols) c:\winnt\symbols\mshtml.pdb\446E4AFD1\mshtml.pdb
Loaded symbol image file: mshtml.dll
Mapped memory image file: C:\WINNT\system32\mshtml.dll
Image path: C:\WINNT\system32\mshtml.dll
Image name: mshtml.dll
Timestamp: Fri May 19 18:47:26 2006 (446E4AFE)
CheckSum: 0029F036
ImageSize: 002A1000
File version: 6.0.2800.1556
Product version: 6.0.2800.1556
File flags: 8 (Mask 3F) Private
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: MSHTML
OriginalFilename: MSHTML.DLL
ProductVersion: 6.00.2800.1556
FileVersion: 6.00.2800.1556
FileDescription: Microsoft (R) HTML Viewer
LegalCopyright: © Microsoft Corporation. All rights reserved.
0:000> .excr
^ Syntax error in '.excr'
0:000> .ecxr
eax=18dd89c9 ebx=635bf2d4 ecx=8bf18b56 edx=0020cd90 esi=8bf18b56 edi=63761257
eip=6374eca4 esp=0012e674 ebp=0012e698 iopl=0 nv up ei ng nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010286
mshtml!CRecalcProperty::~CRecalcProperty+0x3:
6374eca4 f6462d04 test byte ptr [esi+2Dh],4 ds:0023:8bf18b83=??
0:000> kb
*** Stack trace for last set context - .thread/.cxr resets it
ChildEBP RetAddr Args to Child
0012e674 6374f04a 635bf2c8 6374f380 00000001 mshtml!CRecalcProperty::~CRecalcProperty+0x3
0012e67c 6374f380 00000001 025b31b0 025b4edc mshtml!CRecalcProperty::`scalar deleting destructor'+0x8
0012e698 6374f42a 00000000 0012e70c 025b4ee0 mshtml!CRecalcObject:etach+0x44
0012e6b0 6374f48a 025ba7e0 63666ccc 025b4ee0 mshtml!CRecalcEngine:etach+0x20
0012e6b8 63666ccc 025b4ee0 6351a30e 0020cd90 mshtml!CRecalcEngine::SetSite+0x15
0012e6d0 6360c3ba 025ba7a0 6360c660 025ba7a0 mshtml!CScriptDebugDocument::UpdateDocumentSize+0x21
0012e6d8 6360c660 025ba7a0 025c4840 025c4304 mshtml!CScriptCollection::CDebugDocumentStack::~CDebugDocumentStack+0x11
0012e70c 637b860c 025c48b0 025aa790 00000000 mshtml!CScriptCollection:arseScriptText+0x187
0012e7c4 637b8b45 00000000 00000000 00000000 mshtml!CScriptElement::CommitCode+0x1c0
0012e7fc 6378ce91 025ba9e0 2e27005e 00000000 mshtml!CScriptElement::Execute+0xa2
0012e848 63782fdb 025baaa0 025ba9e0 63783d9f mshtml!CHtmParse::Execute+0x41
0012e854 63783d9f 6378ce50 2e27005e 025ba9e0 mshtml!CHtmPost::Broadcast+0xb
0012e910 63783f23 2e27005e 025ba9e0 024b02d0 mshtml!CHtmPost::Exec+0x32f
0012e928 63783faf 2e27005e 024b02d0 025ba9e0 mshtml!CHtmPost::Run+0x53
0012e938 6378430f 024b02d0 2e27005e 025ba9e0 mshtml!PostManExecute+0x4f
0012e950 6378434c 025ba9e0 00000001 63781606 mshtml!PostManResume+0x6f
0012e95c 63781606 025baa30 025ba9e0 636ae835 mshtml!CHtmPost::OnDwnChanCallback+0xc
0012e968 636ae835 025baa30 00000000 00000000 mshtml!CDwnChan::OnMethodCall+0x15
0012e99c 636aea50 0012edb0 0012edb8 c0000000 mshtml!GlobalWndOnMethodCall+0x64
0012eac0 77e3a3d0 00aa03ba 000003ed 00000000 mshtml!GlobalWndProc+0x11f
0:000> .r
^ Syntax error in '.r'
0:000>
0:000> r
Last set context:
eax=18dd89c9 ebx=635bf2d4 ecx=8bf18b56 edx=0020cd90 esi=8bf18b56 edi=63761257
eip=6374eca4 esp=0012e674 ebp=0012e698 iopl=0 nv up ei ng nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010286
mshtml!CRecalcProperty::~CRecalcProperty+0x3:
6374eca4 f6462d04 test byte ptr [esi+2Dh],4 ds:0023:8bf18b83=??

 

THanks,

we are currently QA'ing that patch, so I will try this and let you know.