Jump to content

Application Error Event 1000 DllHost.exe caused by acrobat_compat.dll

Stephen Fason

By Stephen Fason
in Crashing/Freezing

 Share

Recommended Posts

Stephen Fason

Stephen Fason

Posted
Posted

I have been getting several application error event id 1000 on DllHost.exe. I enabled user mode dumps for DllHost.exe. I then ran Windbg on the dmp file to find out what module is causing the error.  It found that acrobat_compat.dll is the culprit. It seems others have had the same issue from what I have read in these forums. I did find I have two acrobat_compat.dll files on my system. They both are version 13.58.0.1180 but have different file sizes. See attached image. My versions are as follows:

Computer: ideapad 330
OS: Windows 10 Home 21H2
Nitro Pro: 13.58.0.1180

acrobat-c.png

Here is the Windbg output:

Quote


Microsoft (R) Windows Debugger Version 10.0.22549.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\sfason\AppData\Local\CrashDumps\dllhost.exe.22112.dmp]
User Mini Dump File: Only registers, stack and portions of memory are available


************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*
Symbol search path is: srv*
Executable search path is: 
Windows 10 Version 19044 MP (8 procs) Free x64
Product: WinNt, suite: SingleUserTS Personal
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Debug session time: Sun Mar 27 18:47:47.000 2022 (UTC - 7:00)
System Uptime: not available
Process Uptime: 0 days 0:00:07.000
................................................
Loading unloaded module list
...
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(5660.5684): Access violation - code c0000005 (first/second chance not available)
For analysis of this file, run !analyze -v
ntdll!NtWaitForMultipleObjects+0x14:
00007fff`d230d8c4 c3              ret
NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2202.7001.0_neutral__8wekyb3d8bbwe\amd64\Visualizers\atlmfc.natvis'
NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2202.7001.0_neutral__8wekyb3d8bbwe\amd64\Visualizers\ObjectiveC.natvis'
NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2202.7001.0_neutral__8wekyb3d8bbwe\amd64\Visualizers\concurrency.natvis'
NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2202.7001.0_neutral__8wekyb3d8bbwe\amd64\Visualizers\cpp_rest.natvis'
NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2202.7001.0_neutral__8wekyb3d8bbwe\amd64\Visualizers\stl.natvis'
NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2202.7001.0_neutral__8wekyb3d8bbwe\amd64\Visualizers\Windows.Data.Json.natvis'
NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2202.7001.0_neutral__8wekyb3d8bbwe\amd64\Visualizers\Windows.Devices.Geolocation.natvis'
NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2202.7001.0_neutral__8wekyb3d8bbwe\amd64\Visualizers\Windows.Devices.Sensors.natvis'
NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2202.7001.0_neutral__8wekyb3d8bbwe\amd64\Visualizers\Windows.Media.natvis'
NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2202.7001.0_neutral__8wekyb3d8bbwe\amd64\Visualizers\windows.natvis'
NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2202.7001.0_neutral__8wekyb3d8bbwe\amd64\Visualizers\winrt.natvis'

Microsoft (R) Windows Debugger Version 10.0.22549.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\sfason\AppData\Local\CrashDumps\dllhost.exe.22112.dmp]
User Mini Dump File: Only registers, stack and portions of memory are available


************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*
Symbol search path is: srv*
Executable search path is: 
Windows 10 Version 19044 MP (8 procs) Free x64
Product: WinNt, suite: SingleUserTS Personal
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Debug session time: Sun Mar 27 18:47:47.000 2022 (UTC - 7:00)
System Uptime: not available
Process Uptime: 0 days 0:00:07.000
................................................
Loading unloaded module list
...
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(5660.5684): Access violation - code c0000005 (first/second chance not available)
For analysis of this file, run !analyze -v
ntdll!NtWaitForMultipleObjects+0x14:
00007fff`d230d8c4 c3              ret
0:006> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************


KEY_VALUES_STRING: 1

    Key  : AV.Dereference
    Value: NullClassPtr

    Key  : AV.Fault
    Value: Write

    Key  : Analysis.CPU.mSec
    Value: 3421

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 5155

    Key  : Analysis.Init.CPU.mSec
    Value: 546

    Key  : Analysis.Init.Elapsed.mSec
    Value: 29597

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 155

    Key  : Timeline.Process.Start.DeltaSec
    Value: 7

    Key  : WER.OS.Branch
    Value: vb_release

    Key  : WER.OS.Timestamp
    Value: 2019-12-06T14:06:00Z

    Key  : WER.OS.Version
    Value: 10.0.19041.1

    Key  : WER.Process.Version
    Value: 10.0.19041.546


FILE_IN_CAB:  dllhost.exe.22112.dmp

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

CONTEXT:  (.ecxr)
rax=0000000000000000 rbx=00007fff79b8a330 rcx=00007fff79b8a330
rdx=00000000fffffffa rsi=0000000000000000 rdi=0000000000000000
rip=00007fffd22d3416 rsp=000000ee856ff0f0 rbp=00000222c8582700
 r8=0000000000000000  r9=00007fff79b8a300 r10=00000fffef36db82
r11=ffffffffffffffff r12=0000000000000000 r13=000000ee84ec5000
r14=0000000000000001 r15=0000000000000000
iopl=0         nv up ei pl nz ac pe cy
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010213
ntdll!RtlpWaitOnCriticalSection+0xa6:
00007fff`d22d3416 ff4024          inc     dword ptr [rax+24h] ds:00000000`00000024=????????
Resetting default scope

EXCEPTION_RECORD:  (.exr -1)
ExceptionAddress: 00007fffd22d3416 (ntdll!RtlpWaitOnCriticalSection+0x00000000000000a6)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000001
   Parameter[1]: 0000000000000024
Attempt to write to address 0000000000000024

PROCESS_NAME:  dllhost.exe

WRITE_ADDRESS:  0000000000000024 

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

EXCEPTION_CODE_STR:  c0000005

EXCEPTION_PARAMETER1:  0000000000000001

EXCEPTION_PARAMETER2:  0000000000000024

STACK_TEXT:  
000000ee`856ff0f0 00007fff`d229fcb4     : 00000222`c8565230 00007fff`d228688c 00000000`fffffffa 00007fff`d2295ba1 : ntdll!RtlpWaitOnCriticalSection+0xa6
000000ee`856ff1d0 00007fff`d229fae2     : 00007fff`8d50b038 00000222`c8564da0 00007fff`79b8a330 00007fff`d22c07b0 : ntdll!RtlpEnterCriticalSectionContended+0x1c4
000000ee`856ff230 00007fff`79b31c66     : 00007fff`00000000 00007fff`cfbc986b 00000000`00190018 00007fff`8d50b038 : ntdll!RtlEnterCriticalSection+0x42
000000ee`856ff260 00007fff`79b31a98     : 00000222`c8582708 00007fff`79b8a330 0000dd8e`7ab368d5 000000ee`856ff3c8 : acrobat_compat!ASGetErrorString+0xb96
000000ee`856ff2c0 00007fff`d01e42d6     : 00000529`97ace512 0000dd8e`7ab368d5 00000000`000003f0 00007fff`d01e60ae : acrobat_compat!ASGetErrorString+0x9c8
000000ee`856ff300 00007fff`d01e41fb     : 00000000`00000000 000000ee`856ff3c8 00000000`00000000 00007fff`d02c0e40 : ucrtbase!<lambda_f03950bc5685219e0bcd2087efbe011e>::operator()+0xa6
000000ee`856ff350 00007fff`d01e41b4     : 00000000`00000000 00000000`00000000 00007fff`0020001e 000000ee`856ff3b8 : ucrtbase!__crt_seh_guarded_call<int>::operator()<<lambda_7777bce6b2f8c936911f934f8298dc43>,<lambda_f03950bc5685219e0bcd2087efbe011e> &,<lambda_3883c3dff614d5e0c5f61bb1ac94921c> >+0x3b
000000ee`856ff380 00007fff`79b6adbe     : 00007fff`79b8a688 000000ee`00000002 00000000`00000002 000000ee`856ff3b0 : ucrtbase!execute_onexit_table+0x34
000000ee`856ff3b0 00007fff`79b6aee4     : 00000000`00000001 00007fff`d2289800 00000000`00000000 00007fff`82a033d5 : acrobat_compat!ASFileSysLegacyNameFromPathAsASText+0x321ee
000000ee`856ff3e0 00007fff`d2289a1d     : 00007fff`79b30000 00000000`00000000 00000000`00000000 00000000`7ffe0385 : acrobat_compat!ASFileSysLegacyNameFromPathAsASText+0x32314
000000ee`856ff440 00007fff`d22da9cb     : 00000222`c8564570 00007fff`79b30000 00007fff`00000000 00000000`00000000 : ntdll!LdrpCallInitRoutine+0x61
000000ee`856ff4b0 00007fff`d22da427     : 00000222`c8576390 00000222`c8564610 00000222`c8558160 00000222`c8576390 : ntdll!LdrpProcessDetachNode+0x107
000000ee`856ff580 00007fff`d22da678     : 00000222`00000000 00000222`c8558160 00007fff`d23db240 00000222`c8552270 : ntdll!LdrpUnloadNode+0x3f
000000ee`856ff5d0 00007fff`d227fd0a     : 00000222`00000001 00000222`c8552270 000000ee`856ff850 00000222`c85c76e0 : ntdll!LdrpUnloadNode+0x290
000000ee`856ff620 00007fff`d227fc84     : 00000000`00000000 000000ee`00000001 00000000`00000000 00007fff`d145ef98 : ntdll!LdrpDecrementModuleLoadCountEx+0x72
000000ee`856ff650 00007fff`cfb95d3e     : 00007fff`829d0000 00000000`00000009 00000222`c8563ac0 000000ee`856ff858 : ntdll!LdrUnloadDll+0x94
000000ee`856ff680 00007fff`d145f018     : 000000ee`856ff858 000000ee`856ff858 000000ee`856ff730 00007fff`d14c38a9 : KERNELBASE!FreeLibrary+0x1e
000000ee`856ff6b0 00007fff`d1443ec8     : 00000000`00000001 00000000`00000000 00000000`00000000 00007fff`d22947b1 : combase!CClassCache::CDllPathEntry::CFinishObject::Finish+0x28
000000ee`856ff6e0 00007fff`d14437e5     : 000000ee`856ff730 00000000`00000001 000000ee`856ff730 00000000`00000001 : combase!CClassCache::CFinishComposite::Finish+0x4c
000000ee`856ff710 00007fff`d14433d6     : 00000000`00005684 00000000`00000001 00000000`00000080 00000000`00000080 : combase!CClassCache::CleanUpDllsForApartment+0xbd
000000ee`856ff8b0 00007fff`d144124c     : 00000000`00005684 00000000`00000001 00000222`c8562200 00007fff`d1444378 : combase!ObjectMethodExceptionHandlingAction<<lambda_55058d312c708f4255097b73c0aa9bdd> >+0x12
000000ee`856ff900 00007fff`d1443fc6     : 00000000`00000001 000000ee`856ff990 00000000`00000001 00000000`0001069a : combase!FinishShutdown+0xa4
000000ee`856ff950 00007fff`d143b397     : 00000222`c8561d90 00000000`000001a0 00007fff`d16e5690 00000222`c8562200 : combase!ApartmentUninitialize+0xca
000000ee`856ff9d0 00007fff`d1478d7a     : 00000222`c8561d90 00007fff`d16e5690 00000000`000001a0 00007fff`d16e5690 : combase!wCoUninitialize+0x1bb
000000ee`856ffa30 00007fff`d14aa9f0     : 00000222`c8561d90 00000222`c8550c40 00000000`00000000 00000000`00000000 : combase!CDllHost::WorkerThread+0xee
000000ee`856ffa70 00007fff`d14aa979     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : combase!CRpcThread::WorkerLoop+0x4c
000000ee`856ffad0 00007fff`d1337034     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : combase!CRpcThreadCache::RpcWorkerThreadEntry+0x29
000000ee`856ffb00 00007fff`d22c2651     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0x14
000000ee`856ffb30 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x21


STACK_COMMAND:  ~6s; .ecxr ; kb

SYMBOL_NAME:  acrobat_compat+b96

MODULE_NAME: acrobat_compat

IMAGE_NAME:  acrobat_compat.dll

FAILURE_BUCKET_ID:  NULL_CLASS_PTR_WRITE_c0000005_acrobat_compat.dll!Unknown

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

IMAGE_VERSION:  13.58.0.1180

FAILURE_ID_HASH:  {7bf50c68-11cf-e806-9352-ab3720ba6180}

Followup:     MachineOwner
---------

 

Link to comment
Share on other sites
  • Official Nitronaut
Allain Umailin

Allain Umailin

Posted
  • Official Nitronaut
Posted

Hello @Stephen Fason,

Thank you for reaching out to us through our Community Forums and for providing the Windbg output.

Did you notice that the Windows Explorer is crashing in the system? If yes, we have seen this rare behavior so please perform the tasks listed below in order to narrow down the issue: 

- Open a CMD window as an Administrator

- Navigate to the folder where Nitro PDF Pro is installed by entering the following CMD syntax: cd "c:\Program Files\Nitro\Pro\13" and pressing Enter

- Disable the Thumbnail provider by entering in: regsvr32 /u NitroPDFThumbnailProvider.dll and pressing Enter

- A prompt saying “DllUnregisterServer in NitroPDFThumbnailProvider.dll succeeded” should appear, click Okay.

Thank you for your patience and please let us know how it goes on your end.

Link to comment
Share on other sites
Stephen Fason

Stephen Fason

Posted
  • Author
Posted

Update: I followed your instructions and got the succeeded message as expected. I decided to check the event log and found that running the command caused an Application Error 1000 for regsvr32.exe. When I ran Windbg on the dump file, acrobat_compat.dll was again listed. 

Link to comment
Share on other sites
  • 3 weeks later...
OP System

OP System

Posted
Posted

Hello,


I had the exact same issue on a brand new Lenovo PC with Win 10 Pro 21H2, with Nitro Pro 13.58 installed.

Explorer.exe and DllHost.exe crashing every few minutes, running windbg on .dump files show acrobat_compat.dll causing unhandled exception:


ERROR_CODE: (NTSTATUS) 0xc0000005 (memory could not be read)
FAILURE_BUCKET_ID:  NULL_CLASS_PTR_WRITE_c0000005_acrobat_compat.dll!ASGetErrorString
IMAGE_VERSION:  13.40.0.811

Unregistering NitroPDFThumbnailProvider.dll as explained by @Allain Umailin seems to have fixed the problem after a reboot.

I'll keep updating this thread if other episodes happen.

Thanks
Gabriele

Link to comment
Share on other sites
  • 1 year later...
Michael Ryan

Michael Ryan

Posted
Posted

Hi All,

Sorry to resurrect an old thread, chasing some feedback on this.

Seeing this same issue currently with a WS2022 RDS environment, however its following a single user and affecting no other person in the infra even after a full reprofile for them. I've shuffled the user into a test environment, and things look stable whilst using Allian's workaround, does anyone have the details to the impact/functionality loss of unregistering the DLL? 

Pro support advised that this is an issue that is known and expected to be resolved in a updating coming out very soon. However, i havent been able to confirm with a response around the workarounds impact (Is it even still applicable from a year ago running the latest build?)/if its seen in similar shared environments - a bleeding edge upgrade on the farm is unlikely straight away. 

Thanks!

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing

© 2021 Nitro Software, Inc. All rights reserved. Nitro, the Nitro logo, Nitro Pro, and Nitro Sign are trademarks and/or registered trademarks, of Nitro Software, Inc. or its affiliates in the United States and/or other countries.

×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.

  I accept