Debugging, References, Sysinternals, Windows
comments 2

The case of Internet Explorer crash

This is yet another post in the “case of ..” series of articles. This is about an IE7 crash I was facing when I tried to open a time sheet application. Every time I open IE and log in to the time sheet application, IE will close with no error message. Now, this can be hard to even troubleshoot when there is no error message. But not on Windows — We have the help of Sysinternals tools. So, I opened Sysinternal’s ProcMon and filtered out for events from iexplorer.exe. At this point, I just tried to reproduce the issue of IE crash.

After I had the repro, I saved the ProcMon capture and started looking at the events. There was nothing really suspicious in the capture mostly because there was nothing wrong with iexplorer.exe. Now, I wanted to find out if there is any thing interesting just before the iexplorer.exe process exit. For this pupose, I created another filter on the operation “Process Exit”.

ProcMon Filter

ProcMon Filter

 Now this will filter out all events except the process exit event. All I needed to do was check the last process exit event in that list.

After I found out the last process exit event, I opened the properties window to find out more information about that particular event.

There was nothing special under the stacks tab. There were just ntkernel calls at that point in time. All of them just pointing to process exit or termination function calls.

Loaded Modules
Loaded Modules

On the Process tab, I could see all the different modules loaded by iexplorer.exe. Most of these modules are Java related. I started suspecting these modules as the time sheet application I was trying to access also uses Java. My immediate action was to check IE add-ons and disable some of these Java plug-ins. For doing that — in Internet Exploer, I went in to Tools -> Internet Options -> Programs -> Manage add-ons and disabled SSVHelper and a few other plug-ins. This requires a restart of IE and the problem disappeared after IE restart. I did not bother to find out why any of those disabled plugins were crashing as that would require some more in-depth debugging using WinDBG, etc. However, I cannot keep these Java plugins disabled forever. It may impact some of the Java applications I use regurarly. So, I Bing-ed around to see if I could find pointers to any known issues around these Java plugins. This is what I found. As it is menioned in the bug description, the issue I was facing is due to a memory corruption issue with the Java Plugins and they also suggest uninstalling and installing the latest JRE version.

I downloaded JRE 6.0 Update 16 and the problem disappeared without disabling any IE add-ons. Simple…isn’t it. With Sysinternals’ tools, you just need to know how to use them. You will reach — most of the times — a root cause without even looking at single line of assembly or source code.

Filed under: Debugging, References, Sysinternals, Windows

by

Ravikanth is a principal engineer and the lead architect for Microsoft and VMware virtualized and hybrid cloud solutions within the Infrastructure Solutions Group at Dell EMC. He is a multi-year recipient of Microsoft Most Valuable Professional (MVP) award in Windows PowerShell (CDM) and Microsoft Azure. Ravikanth is the author of Windows PowerShell Desired State Configuration Revealed (Apress) and leads Bangalore PowerShell and Bangalore IT Pro user groups. He can be seen speaking regularly at local user group events and conferences in India and abroad.