Application crash

[Double_D]

I have been experiencing occasional crashes with a CVI application that has been in use for several years.  The application is now running under Windows Server 2008 on a server computer (this is a recent change).  I captured the following data from the most recent crash:

Problem signature:
  Problem Event Name:    APPCRASH
  Application Name:    AIMS.exe
  Application Version:    1.0.0.0
  Application Timestamp:    4acb75a3
  Fault Module Name:    cvirte.dll
  Fault Module Version:    9.0.1.375
  Fault Module Timestamp:    49dd0822
  Exception Code:    c0000005
  Exception Offset:    0038e11a
  OS Version:    6.0.6002.2.2.0.272.7
  Locale ID:    1033
  Additional Information 1:    48a0
  Additional Information 2:    5e3723be168af10b7ded8b660deb29c8
  Additional Information 3:    568b
  Additional Information 4:    01a71621ecf5ba201cbaef6b841e6017

The previous crash produced the following in the event log:

Faulting application AIMS.exe, version 1.0.0.0, time stamp 0x4ab2615b,
faulting module cvirte.dll, version 9.0.1.375, time stamp 0x49dd0822,
exception code 0xc0000005, fault offset 0x0038e11a, process id 0xdf8,
application start time 0x01ca4067ec760e6e.

In addition, the event log showed two instances of the following error message (no crash or obvious issues noted corresponding to the times of these events):

 The description for Event ID 0 from source CVI cannot be found. Either the
component that raises this event is not installed on your local computer or
the installation is corrupted. You can install or repair the component on the
local computer.  If the event originated on another computer, the display
information had to be saved with the event.

The following information was included with the event:

[22:32:06.859] [FATAL] [LRemoveItem] [..\james\list.c:543] Assertion failed: 0
(itemPosition >= kEndOfList && itemPosition <= (*theList)->numItems)

The variable references are apparently to CVI library code, as I have no variables by these names.

Any help in resolving these issues would be greatly appreciated.

[nickb]

Hello - 

There's a couple things that would be very helpful here.  Most of the steps can be found here, but perhaps the most helpful file you could upload to our ftp site would be the .dmp file that is generated when this crash occurs (you will most likely need to follow the Vista instructions in the first link to get this file).  Also, if you could include your project that's crashing, or at the very least a map file that corresponds to the build of your application that crashed, we would be very grateful.

Do you know what's happening in your program when the crash occurs?  Is there anyway you can simply recreate the crash? 

NickB

National Instruments  

[Double_D]

I don't know how to re-create a crash.  It happens intermittently (twice in 3-4 weeks) with the program running continuously.  As far as what is going on when a crash occurs, the program reads data from a scanner/picoammeter combination every 10 seconds.  Data is written to a file at 5-minute intervals and at other times, depending on user interaction and sample status.  By comparing the time of the crash recorded in the event log and the time stamp of the data file, it looks like the program was not writing to disk when the crash occurred.  I have attached the map file that CVI generated.  I don't have a debug output yet.  I will install the Windows debug utility on Monday (that's when the system gets shut down next) and see if I can capture some useful information.

[menchar]

I believe that exception code, c0000005, is associated with the Windows service that detects data being executed as code.

It's called the "Data Execution Prevention" (DEP) service, and you can turn it off if you like - it's on by default I believe on XP systems.

You may have an error in your application that has been benign (a buffer overrun for example) that didn't cause a crash in and of itself, but now you may be running on a system that  has DEP activated and it's detecting the (otherwise benign) error and giving you the crash.

Menchar

[menchar]

http://support.microsoft.com/kb/875352/EN-US/

Has info on DEP.

It looks to me like it's turned on by default for all programs and services on Windows Server 2003.  You can selectively disable it.

But, the root cause is likely some buffer overrun that's causing the access violation exception - if it's not DEP finding it, then it could be the app only occasionally corrupts memory in such a way that it's detected as an access violation.  I've seen quite a bit of variation in problems like these - the violation may depend on a whole host of secondary factors that you can't easily detect and reason about.  You might try running a debug build of the app and see if it eventually catches the problem and give you a popup localizing it.

C can't do structured exception handling so it's a challeng to localize these types of prolems.

Menchar

[menchar]

Woops  -  you're using Windows Server 2008, not XP or Serve 2003.

The info on DEP still applies, DEP is used on this OS and I suspect is activated by default for all programs and services.

Menchar

[Double_D]

OK, I have installed Windbg and also turned off DPE for the application that has been crashing.  We'll see what happens.  Do you have any thoughts on the error that is not causing a crash (The description for Event ID 0 from source CVI cannot be found...)?  This one shows up a few times in the event log every week, but I haven't noticed any problems that have been associated with the application at any of the times that this occurs.

[dummy_decoy]

i think the error message is misleading.

there are many ways of putting an error into the Event Log. one way is to register a binary (executable or dll) as an "event source", so that, when an error occurs, the offending application only signals the error number and the parameters, and the Event Log takes care of retrieving message text from the binary, formatting it, etc. 

the error message you observe shows that an error occured but the message has not been found in the "Event Source", which is CVI. this may be due to a corruption in the registry, a problem with permissions, or anything else...

of course, this does not deny the fact that an error occured. the only problem is that we don't really know which error occured...

[menchar]

When an application records into the event log it's supposed to also provide a "messaging DLL" which provides the explanatory text for a given event type/code from your source.  Sounds like something's logging an event from or about CVI but there's no messaging DLL available to provide an explanation of the event. 

An event isn't necessarily an error:  some events are simply information.

Menchar

[Double_D]

Turning off DEP has reduced the frequency of crashes.  The program did crash today, however.  I have posted the .dmp file and the map file to the NI ftp site (the files are zipped as map_AIMS.zip).  Please let me know if any clues are found from this info.