Troubleshooting memory access violation in external module acroPDF.dll

Jarle Pahr 0 Reputation points
2025-01-26T15:17:52.3766667+00:00

Hello. I am experiencing apparently "random" crashes in a program, where the crash dump logs (analyed with WindDbg) indicate an memory access violation occuring in AcroPDF.dll. The last four function calls in the call stack are always identical:

 

WARNING: Stack unwind information not available. Following frames may be wrong.

0019ec4c 760cd2d3     003604ec 0000001a 00000014 AcroPDF+0x11c90

0019ec4c 760ad30a     66211c90 003604ec 0000001a user32!_InternalCallWinProc+0x2b

0019ed34 760acf30     66211c90 00000000 0000001a user32!UserCallWinProcCheckWow+0x30a

0019ed94 760b9f1a     01798190 00000000 0000001a user32!DispatchClientMessage+0xf0

 

Exception code is: c0000005 (Access violation)

 

Typical values for ExceptionAddress and Failure Bucket are:

Exception address: 66211c90 (AcroPDF+0x00011c90) (Module is always AcroPDF and offset is always 0x00011c90)

Failure bucket: A few different variations. E.g:

BAD_INSTRUCTION_PTR_c0000005_AcroPDF.dll!Unloaded
BAD_INSTRUCTION_PTR_c0000005_wpdshext.dll !Unloaded
BAD_INSTRUCTION_PTR_c0000005_msado15.dll !Unloaded

 

How should I use sysinternals to troubleshoot this issue? As a first step for example, I would like to use the offset information to identify exactly which function is being called - is there a way to do that?

Edit: Clarified that offset is always the same, and provided additional failure bucket examples.

Sysinternals
Sysinternals
Advanced system utilities to manage, troubleshoot, and diagnose Windows and Linux systems and applications.
1,195 questions
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.