ios11xen html,internet explorer 11 - IE11 crashs on html5-audio in Citrix XenApp7.6 on Ipad Air with...

I'm investigating a curious problem with crashing IE11.

Our Environment is a website running in IE11 deployed via Citrix Xenapp to iPads with Citrix Receiver.

IE11 11.0.9600.17631

XenApp 7.6

Windows 2012 R2

Citrix Receiver 5.9.4

iOS 8.1.3

In approx. 10% the cases of opening the website the crash of IE occurs.

The use case is, that we want to play a sound when buttons are pushed.

Investigation

We nailed it down to the html5 audio tag which causes the trouble.

So we built two minimal examples for reproducing this failure behaviour.

On with plain html5 audio tags and the other with scripted audio elements:

jQuery(document).ready(function() {

function createAudio(url) {

var audio = document.createElement("audio");

audio.setAttribute('preload', 'auto');

audio.setAttribute('controls', 'controls');

audio.setAttribute('type', 'audio/mpeg');

if (audio != null && audio.canPlayType && audio.canPlayType("audio/mpeg")) {

audio.src = url;

}

document.body.appendChild(audio);

return audio;

}

var audio1 = createAudio("img/sound/beep.mp3");

var audio2 = createAudio("img/sound/beep2.mp3");

var audio3 = createAudio("img/sound/beep3.mp3");

var audio4 = createAudio("img/sound/beep4.mp3");

});

Result

With this examples we could reproduce the failure more often

In 20% the website is working normal.

In 10% the audio-players show Ungültige Quelle or Invalid Source.

In 70% the IE crashs.

Crash Dumps

Windows Event Log

1000

2

100

0x80000000000000

9994

Application

T02.ADL.local

IEXPLORE.EXE

11.0.9600.17416

5452eed9

ntdll.dll

6.3.9600.17630

54b0d74f

c0000005

000411d2

19d4

01d0575a7d7ee406

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

C:\Windows\SYSTEM32\ntdll.dll

bdb9a4d8-c34d-11e4-80e9-f246be8a9fe6

With windbg.exe and !analye -v i got the following crash dump:

************* Symbol Path validation summary **************

Response Time (ms) Location

Deferred SRV*C:\crashdebug\Symbols*http://msdl.microsoft.com/download/symbols

Symbol search path is: SRV*C:\crashdebug\Symbols*http://msdl.microsoft.com/download/symbols

Executable search path is:

Windows 8 Version 9600 MP (4 procs) Free x86 compatible

Product: Server, suite: TerminalServer

Built by: 6.3.9600.17031 (winblue_gdr.140221-1952)

Machine Name:

Debug session time: Fri Feb 27 12:37:14.000 2015 (UTC + 1:00)

System Uptime: 0 days 11:35:11.637

Process Uptime: 0 days 0:01:08.000

................................................................

................................................................

......

Loading unloaded module list

..

This dump file has an exception of interest stored in it.

The stored exception information can be accessed via .ecxr.

(d20.1b10): Access violation - code c0000005 (first/second chance not available)

eax=00000000 ebx=00000000 ecx=43f23b31 edx=7e78d000 esi=00000003 edi=00000003

eip=7756cc2c esp=0d78e78c ebp=0d78e914 iopl=0 nv up ei pl nz na po nc

cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000202

ntdll!NtWaitForMultipleObjects+0xc:

7756cc2c c21400 ret 14h

0:024> !analyze -v

*******************************************************************************

* *

* Exception Analysis *

* *

*******************************************************************************

*** ERROR: Symbol file could not be found. Defaulted to export symbols for ScriptSn.20140828074232.dll -

GetUrlPageData2 (WinHttp) failed: 12007.

FAULTING_IP:

ntdll!RtlEnterCriticalSection+12

775711d2 f00fba3000 lock btr dword ptr [eax],0

EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)

ExceptionAddress: 775711d2 (ntdll!RtlEnterCriticalSection+0x00000012)

ExceptionCode: c0000005 (Access violation)

ExceptionFlags: 00000000

NumberParameters: 2

Parameter[0]: 00000001

Parameter[1]: 43f23b35

Attempt to write to address 43f23b35

CONTEXT: 00000000 -- (.cxr 0x0;r)

eax=00000000 ebx=00000000 ecx=43f23b31 edx=7e78d000 esi=00000003 edi=00000003

eip=7756cc2c esp=0d78e78c ebp=0d78e914 iopl=0 nv up ei pl nz na po nc

cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000202

ntdll!NtWaitForMultipleObjects+0xc:

7756cc2c c21400 ret 14h

DEFAULT_BUCKET_ID: INVALID_POINTER_WRITE

PROCESS_NAME: iexplore.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.

EXCEPTION_PARAMETER1: 00000001

EXCEPTION_PARAMETER2: 43f23b35

WRITE_ADDRESS: 43f23b35

FOLLOWUP_IP: mfcore!CSampleQueue::Flush+1b

7481999c 68ffffff7f push 7FFFFFFFh

NTGLOBALFLAG: 400

APPLICATION_VERIFIER_FLAGS: 0

APP: iexplore.exe

ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre

FAULTING_THREAD: 00001b10

PRIMARY_PROBLEM_CLASS: INVALID_POINTER_WRITE

BUGCHECK_STR: APPLICATION_FAULT_INVALID_POINTER_WRITE

LAST_CONTROL_TRANSFER: from 7481999c to 775711d2

STACK_TEXT:

0d78f2e4 7481999c 43f23b31 0c2a80d0 43f23939 ntdll!RtlEnterCriticalSection+0x12

0d78f304 7481acd6 00000001 0c2a80d0 43f23939 mfcore!CSampleQueue::Flush+0x1b

0d78f328 747f6c7a 0c2a80d0 0c2a80d0 00000000 mfcore!CSampleQueue::~CSampleQueue+0x17

0d78f364 7483de0d 7483de00 0d78f38c 7481a61e mfcore!CAudStreamSink::~CAudStreamSink+0x120

0d78f370 7481a61e 00000001 0c2a806c 80004005 mfcore!CAudStreamSink::`vector deleting destructor'+0xd

0d78f38c 748cc0ef 0c2a80d0 0c2a7f08 0c2a7f50 mfcore!CAudStreamSink::Release+0x4e

0d78f3ac 747eec7d 00000000 0d78f448 0d78f3d0 mfcore!CAudioMediaSink::InternalCreateStreamSink+0xdd3a8

0d78f3d8 747eeba0 0d78f3f4 0d78f448 00000000 mfcore!CAudioMediaSink::CAudioMediaSink+0xb1

0d78f3f8 747eeafe 0c2b7380 00000000 0c2b73b8 mfcore!CAudioMediaSink::CreateInstance+0x30

0d78f4a8 747ee809 0c2b7380 0c2b73b8 0d78f520 mfcore!MFCreateAudioRenderer+0x2be

0d78f4c0 7483a03d 0c2b7380 7483a000 0c2dfa60 mfcore!CMFAudioRendererActivate::InstantiateMediaObject+0x29

0d78f4d8 74839fdf 747c4a80 0d78f520 0c2dfb98 mfcore!CMFActivate::DoActivate+0x3d

0d78f4f4 747f205a 0c2b7380 747c4a80 0d78f520 mfcore!CMFActivate::ActivateObject+0x2f

0d78f52c 747f1f91 05a0d670 0c2b7380 00000000 mfcore!CMediaSession::BindOutputNode+0x75

0d78f56c 74938512 0c2a6ab8 00000000 748c3320 mfcore!CMediaSession::BindOutputNodes+0x10e

0d78f5b4 747efaa1 05a0fd08 05a0fd08 747efa30 mfcore!CMediaSession::OpQueueTopology+0x32b

0d78f5d8 74819621 05a0fd08 0c2b74e8 74819580 mfcore!CMediaSession::DispatchOperation+0x71

0d78f5f8 74819591 74819580 0d78f63c 74c02459 mfcore!COpQueue::ProcessMarshalledOperations+0x85

0d78f604 74c02459 0c2dfa7c 0c2b74e8 0c211f40 mfcore!COpQueue::ProcessMarshalledOperationsAsyncCallback::Invoke+0x11

0d78f63c 74bf72e9 0c26c788 031cef88 74bf7240 RTWorkQ!CSerialWorkQueue::QueueItem::ExecuteWorkItem+0x1b2

0d78f674 77553cc7 0d78f6f8 0c211f40 031cef88 RTWorkQ!ThreadPoolWorkCallback+0xa9

0d78f6b4 775514b1 0d78f6f8 031cefe8 035d296c ntdll!TppWorkpExecuteCallback+0x137

0d78f84c 76de7c04 085b1e48 76de7be0 02dce3d3 ntdll!TppWorkerThread+0x48e

0d78f860 7758b5af 085b1e48 035d2988 00000000 kernel32!BaseThreadInitThunk+0x24

0d78f8a8 7758b57a ffffffff 77570411 00000000 ntdll!__RtlUserThreadStart+0x2f

0d78f8b8 00000000 77544b50 085b1e48 00000000 ntdll!_RtlUserThreadStart+0x1b

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: mfcore!CSampleQueue::Flush+1b

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: mfcore

IMAGE_NAME: mfcore.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 545036e9

STACK_COMMAND: ~24s; .ecxr ; kb

FAILURE_BUCKET_ID: INVALID_POINTER_WRITE_c0000005_mfcore.dll!CSampleQueue::Flush

BUCKET_ID: APPLICATION_FAULT_INVALID_POINTER_WRITE_mfcore!CSampleQueue::Flush+1b

ANALYSIS_SOURCE: UM

FAILURE_ID_HASH_STRING: um:invalid_pointer_write_c0000005_mfcore.dll!csamplequeue::flush

FAILURE_ID_HASH: {0351a28f-6605-92a0-dcfc-74117e20afcb}

Followup: MachineOwner

As I understand the crash dump IE crashs by registering an audio device. propably for citrix.?

Other attemps for solving this issue

The mp3-files are on the same server

The problem occurs wether the site is deployed via PHP and Apache or NodeJS

Latest Firefox and Chrome (40.0.2214.93) are showing the sites correctly.

Opening the site via Console as Admin IE11 doesn't crashs but shows Invalid Source in most times

Citrix HdxMediaStreamForFlash registry-keys were set.

Server does not compress the mp3s and sends them with MIME audio/mpeg.

Other already regarded Questions from SO with no suitable solution for our problem

Finally

My problem is now, that i have no idea, what to do to solve this problem.

Is it windows problem, a citrix problem, an iOS problem? Or is it a combination of all

of them.

Does anybody knows a workaround for it?

Or is there another point from which i can start another debugging attempt?

If you need more data, please let me know.

Update 2015-03-10

It is not a problem with iOS or Citrix Receiver, because the crash crash also appeard on a Samsung Galaxy Tab.

The crash occurs for the first time about three and a half hours after a server reboot