Description
Hello,
When executing rosautotests under debugger I am observing the following bugcheck:
BugCheck 50, {e1992ffc, 0, f75b0ee8, 0}
|
|
Probably caused by : ftfd.dll ( ftfd!gray_convert_glyph+148 )
|
|
Followup: MachineOwner
|
---------
|
|
nt!RtlpBreakWithStatusInstruction:
|
8051f738 cc int 3
|
kd> !analyze -v
|
*******************************************************************************
|
* *
|
* Bugcheck Analysis *
|
* *
|
*******************************************************************************
|
|
PAGE_FAULT_IN_NONPAGED_AREA (50)
|
Invalid system memory was referenced. This cannot be protected by try-except,
|
it must be protected by a Probe. Typically the address is just plain bad or it
|
is pointing at freed memory.
|
Arguments:
|
Arg1: e1992ffc, memory referenced.
|
Arg2: 00000000, value 0 = read operation, 1 = write operation.
|
Arg3: f75b0ee8, If non-zero, the instruction address which referenced the bad memory
|
address.
|
Arg4: 00000000, (reserved)
|
|
Debugging Details:
|
------------------
|
|
|
READ_ADDRESS: e1992ffc
|
|
FAULTING_IP:
|
ftfd!gray_convert_glyph+148 [c:\users\volodymyr\reactos\sdk\lib\3rdparty\freetype\src\smooth\ftgrays.c @ 1953]
|
f75b0ee8 c7049100000000 mov dword ptr [ecx+edx*4],0
|
|
MM_INTERNAL_CODE: 0
|
|
IMAGE_NAME: ftfd.dll
|
|
DEBUG_FLR_IMAGE_TIMESTAMP: 57d4396e
|
|
MODULE_NAME: ftfd
|
|
FAULTING_MODULE: f7549000 ftfd
|
|
DEFAULT_BUCKET_ID: DRIVER_FAULT
|
|
BUGCHECK_STR: 0x50
|
|
PROCESS_NAME: gdiplus_winetes
|
|
CURRENT_IRQL: 1
|
|
TRAP_FRAME: 00000010 -- (.trap 0x10)
|
Unable to read trap frame at 00000010
|
|
LAST_CONTROL_TRANSFER: from 8047cbe8 to 8051f738
|
|
STACK_TEXT:
|
f6f6306c 8047cbe8 00000003 f6f6337c ffdff408 nt!RtlpBreakWithStatusInstruction
|
f6f6309c 8047c1af 00000003 f6f63d14 0012faf8 nt!KiBugCheckDebugBreak+0x38 [c:\users\volodymyr\reactos\ntoskrnl\ke\bug.c @ 538]
|
f6f6343c 8047bb80 00000050 e1992ffc 00000000 nt!KeBugCheckWithTf+0x58f [c:\users\volodymyr\reactos\ntoskrnl\ke\bug.c @ 1101]
|
f6f6345c 8049ec16 00000050 e1992ffc 00000000 nt!KeBugCheckEx+0x20 [c:\users\volodymyr\reactos\ntoskrnl\ke\bug.c @ 1462]
|
f6f635dc 804c1aad 00000000 e1992ffc 00000000 nt!MmArmAccessFault+0x7f6 [c:\users\volodymyr\reactos\ntoskrnl\mm\arm3\pagfault.c @ 2000]
|
f6f63600 805038ac 00000000 e1992ffc 00000000 nt!MmAccessFault+0xdd [c:\users\volodymyr\reactos\ntoskrnl\mm\mmfault.c @ 251]
|
f6f6364c 804036ff f6f63800 f75b0ee8 badb0d00 nt!KiTrap0EHandler+0x1ec [c:\users\volodymyr\reactos\ntoskrnl\ke\i386\traphdlr.c @ 1278]
|
f6f6364c f75b0ee8 f6f63800 f75b0ee8 badb0d00 nt!KiTrap0E+0x8f
|
f6f63800 f75b06ed f6f6380c f6f636bc 7ffde000 ftfd!gray_convert_glyph+0x148 [c:\users\volodymyr\reactos\sdk\lib\3rdparty\freetype\src\smooth\ftgrays.c @ 1953]
|
f6f639c4 f75b0bcd e1415354 f6f639d4 f6f63b24 ftfd!gray_raster_render+0x3dd [c:\users\volodymyr\reactos\sdk\lib\3rdparty\freetype\src\smooth\ftgrays.c @ 2115]
|
f6f63a80 f75b0839 e141537c f6f63ad8 00000000 ftfd!ft_smooth_render_generic+0x2fd [c:\users\volodymyr\reactos\sdk\lib\3rdparty\freetype\src\smooth\ftsmooth.c @ 308]
|
f6f63a9c f754ec92 e141537c f6f63ad8 00000000 ftfd!ft_smooth_render+0x29 [c:\users\volodymyr\reactos\sdk\lib\3rdparty\freetype\src\smooth\ftsmooth.c @ 390]
|
f6f63ac4 f75c69dc e1083594 f6f63ad8 00000000 ftfd!FT_Render_Glyph_Internal+0x92 [c:\users\volodymyr\reactos\sdk\lib\3rdparty\freetype\src\base\ftobjs.c @ 4167]
|
f6f63bc0 f76ae451 f6f63c00 00000000 00000000 ftfd!FT_Glyph_To_Bitmap+0x12c [c:\users\volodymyr\reactos\sdk\lib\3rdparty\freetype\src\base\ftglyph.c @ 568]
|
f6f63c0c f76a93a4 e145aa14 00000014 ffffb1e0 win32k!ftGdiGlyphCacheSet+0x71 [c:\documents and settings\volodymyr\reactos\win32ss\gdi\ntgdi\freetype.c @ 1468]
|
f6f63c9c f76c69ac e1640e70 00000007 7fffffff win32k!TextIntGetTextExtentPoint+0x304 [c:\documents and settings\volodymyr\reactos\win32ss\gdi\ntgdi\freetype.c @ 2350]
|
f6f63cec 8050468b 8e01038d 00134c98 00000007 win32k!NtGdiGetTextExtentExW+0x1cc [c:\documents and settings\volodymyr\reactos\win32ss\gdi\ntgdi\text.c @ 374]
|
f6f63d1c 80502a4f f76c67e0 0012fad8 00000020 nt!KiSystemCallTrampoline+0x1b [c:\users\volodymyr\reactos\ntoskrnl\include\internal\i386\ke.h @ 742]
|
f6f63d5c 80403e23 0012faf8 7c92c46e badb0d00 nt!KiSystemServiceHandler+0x22f [c:\users\volodymyr\reactos\ntoskrnl\ke\i386\traphdlr.c @ 1738]
|
f6f63d5c 7c92c46e 0012faf8 7c92c46e badb0d00 nt!KiFastCallEntry+0x8c
|
0012facc 7c6289ac 7c6118f8 8e01038d 00134c98 ntdll!KiFastSystemCallRet
|
0012fad0 7c6118f8 8e01038d 00134c98 00000007 gdi32!ZwGdiGetTextExtentExW+0xc
|
0012faf8 7a7cb0ed 8e01038d 00134c98 00000007 gdi32!GetTextExtentExPointW+0x28 [c:\users\volodymyr\reactos\win32ss\gdi\gdi32\objects\text.c @ 279]
|
0012fb9c 7a7c4c7b 8e01038d 00497f30 00000007 gdiplus!gdip_format_string+0x27d [c:\users\volodymyr\reactos\dll\win32\gdiplus\graphics.c @ 4562]
|
0012fc28 00424b20 001356c8 00497f30 ffffffff gdiplus!GdipMeasureString+0x42b [c:\users\volodymyr\reactos\dll\win32\gdiplus\graphics.c @ 4899]
|
0012fe30 00417ac7 00000003 0049565e 00000000 gdiplus_winetest!test_GdipMeasureString+0x490 [c:\users\volodymyr\reactos\modules\rostests\winetests\gdiplus\graphics.c @ 3585]
|
0012fe78 00493b4e 0012fe8c 00000004 00000000 gdiplus_winetest!func_graphics+0x137 [c:\users\volodymyr\reactos\modules\rostests\winetests\gdiplus\graphics.c @ 5882]
|
0012fe90 00493a7c 00134918 ffbadd11 00130fb0 gdiplus_winetest!run_test+0x8e [c:\users\volodymyr\reactos\sdk\include\reactos\wine\test.h @ 697]
|
0012ff1c 00495c3c 00000002 001348d0 00131af0 gdiplus_winetest!main+0x18c [c:\users\volodymyr\reactos\sdk\include\reactos\wine\test.h @ 748]
|
0012ffb4 00495e61 000000ff 0012fff0 7c76e2c2 gdiplus_winetest!__tmainCRTStartup+0x25c [c:\users\volodymyr\reactos\sdk\lib\crt\startup\crtexe.c @ 311]
|
0012ffc0 7c76e2c2 00000000 00000000 7ffde000 gdiplus_winetest!mainCRTStartup+0x21 [c:\users\volodymyr\reactos\sdk\lib\crt\startup\crtexe.c @ 196]
|
0012fff0 00000000 00495e40 00000000 ec0100ed kernel32!BaseProcessStartup+0x42 [c:\users\volodymyr\reactos\dll\win32\kernel32\client\proc.c @ 478]
|
|
|
STACK_COMMAND: kb
|
|
FOLLOWUP_IP:
|
ftfd!gray_convert_glyph+148 [c:\users\volodymyr\reactos\sdk\lib\3rdparty\freetype\src\smooth\ftgrays.c @ 1953]
|
f75b0ee8 c7049100000000 mov dword ptr [ecx+edx*4],0
|
|
FAULTING_SOURCE_CODE:
|
1949: ras.max_cells = (FT_PtrDist)( FT_MAX_GRAY_POOL - cell_start );
|
1950:
|
1951: ras.ycells = (PCell*)buffer;
|
1952: while ( ycount )
|
> 1953: ras.ycells[--ycount] = NULL;
|
1954: }
|
1955:
|
1956: ras.num_cells = 0;
|
1957: ras.invalid = 1;
|
1958: ras.min_ey = band->min;
|
|
|
SYMBOL_STACK_INDEX: 8
|
|
SYMBOL_NAME: ftfd!gray_convert_glyph+148
|
|
FOLLOWUP_NAME: MachineOwner
|
|
FAILURE_BUCKET_ID: 0x50_ftfd!gray_convert_glyph+148
|
|
BUCKET_ID: 0x50_ftfd!gray_convert_glyph+148
|
|
Followup: MachineOwner
|
---------
|
Looks consistent and I can repro it every time. Full debug log is attached to the ticket.
Attachments
Issue Links
- blocks
-
CORE-11474 Random failures and timeouts on testbot due to memory corruption
- Open