search

Taritsyn / JavaScriptEngineSwitcher

JavaScript Engine Switcher determines unified interface for access to the basic features of popular JavaScript engines. This library allows you to quickly and easily switch to using of another JavaScript engine.
Apache License 2.0
440 stars 49 forks source link

Worker process crash with JavascriptEngineSwitcher.Msie + BundleTransformer.Less on Windows Server 2012 Standard #52

Closed jeremyZX closed 6 years ago

jeremyZX commented 6 years ago

Starting with the April 2018 security rollup patch, there is a hard crash of the IIS worker process when using JavascriptEngineSwitcher.Msie and BundleTransformer.Less. This crash is observed on Windows Server 2012 Standard. It is unknown at the moment whether the crash occurs on later versions of Windows Server.

It's unknown whether this issue originates in JavascriptEngineSwitcher.Msie (unlikely), or in MsieJavascriptEngine (more likely). It's also unknown whether this issue is .less specific, or if it may be observed with other file types as well. I'm adding it here because a simple repro case does not require a direct dependency to MsieJavascriptEngine.

We've been able to work around this issue both by uninstalling the patch (kb4093123), as well as switching from MSIE to another engine (e.g. ChakraCore.)

A simple repro project is attached.

BundleTransformerMsieTest-src.zip

Requests to any .less file via the LessAssetHandler cause the IIS worker process to crash with the following events written to the Windows Event log:

Log Name: Application Source: .NET Runtime Date: 4/24/2018 12:26:36 PM Event ID: 1026 Task Category: None Level: Error Keywords: Classic User: N/A Description: Application: w3wp.exe Framework Version: v4.0.30319 Description: The process was terminated due to an unhandled exception. Exception Info: System.AccessViolationException Stack: at MsieJavaScriptEngine.ActiveScript.IActiveScriptParse64.ParseScriptText(System.String, System.String, System.Object, System.String, UIntPtr, UInt32, MsieJavaScriptEngine.ActiveScript.ScriptTextFlags, System.Object ByRef, System.Runtime.InteropServices.ComTypes.EXCEPINFO ByRef) at MsieJavaScriptEngine.ActiveScript.IActiveScriptParse64.ParseScriptText(System.String, System.String, System.Object, System.String, UIntPtr, UInt32, MsieJavaScriptEngine.ActiveScript.ScriptTextFlags, System.Object ByRef, System.Runtime.InteropServices.ComTypes.EXCEPINFO ByRef) at MsieJavaScriptEngine.ActiveScript.ActiveScriptWrapper64.ParseScriptText(System.String, System.String, System.Object, System.String, UIntPtr, UInt32, MsieJavaScriptEngine.ActiveScript.ScriptTextFlags) at MsieJavaScriptEngine.ActiveScript.ActiveScriptJsEngineBase.InnerExecute(System.String, System.String, Boolean) at MsieJavaScriptEngine.ActiveScript.ActiveScriptJsEngineBase+<>cDisplayClass34_0.<Evaluate>b0() at MsieJavaScriptEngine.ScriptDispatcher+<>cDisplayClass12_0`1[[System.Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]].<Invoke>b__0() at MsieJavaScriptEngine.ScriptDispatcher.StartThread() at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object) at System.Threading.ThreadHelper.ThreadStart()

Event Xml: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"&gt; <System> <Provider Name=".NET Runtime" /> <EventID Qualifiers="0">1026</EventID> <Level>2</Level> <Task>0</Task> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2018-04-24T16:26:36.000000000Z" /> <EventRecordID>19019</EventRecordID> <Channel>Application</Channel> <Security /> </System> <EventData> <Data>Application: w3wp.exe Framework Version: v4.0.30319 Description: The process was terminated due to an unhandled exception. Exception Info: System.AccessViolationException Stack: at MsieJavaScriptEngine.ActiveScript.IActiveScriptParse64.ParseScriptText(System.String, System.String, System.Object, System.String, UIntPtr, UInt32, MsieJavaScriptEngine.ActiveScript.ScriptTextFlags, System.Object ByRef, System.Runtime.InteropServices.ComTypes.EXCEPINFO ByRef) at MsieJavaScriptEngine.ActiveScript.IActiveScriptParse64.ParseScriptText(System.String, System.String, System.Object, System.String, UIntPtr, UInt32, MsieJavaScriptEngine.ActiveScript.ScriptTextFlags, System.Object ByRef, System.Runtime.InteropServices.ComTypes.EXCEPINFO ByRef) at MsieJavaScriptEngine.ActiveScript.ActiveScriptWrapper64.ParseScriptText(System.String, System.String, System.Object, System.String, UIntPtr, UInt32, MsieJavaScriptEngine.ActiveScript.ScriptTextFlags) at MsieJavaScriptEngine.ActiveScript.ActiveScriptJsEngineBase.InnerExecute(System.String, System.String, Boolean) at MsieJavaScriptEngine.ActiveScript.ActiveScriptJsEngineBase+<>cDisplayClass34_0.<Evaluate>b0() at MsieJavaScriptEngine.ScriptDispatcher+<>cDisplayClass12_0`1[[System.Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]].<Invoke>b__0() at MsieJavaScriptEngine.ScriptDispatcher.StartThread() at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object) at System.Threading.ThreadHelper.ThreadStart() </Data> </EventData> </Event>

Log Name: Application Source: Application Error Date: 4/24/2018 12:26:36 PM Event ID: 1000 Task Category: (100) Level: Error Keywords: Classic User: N/A Description: Faulting application name: w3wp.exe, version: 8.0.9200.16384, time stamp: 0x50108835 Faulting module name: jscript9.dll, version: 10.0.9200.22411, time stamp: 0x5ab67156 Exception code: 0xc0000005 Fault offset: 0x000000000009de9b Faulting process id: 0x18b4 Faulting application start time: 0x01d3dbe902db98e6 Faulting application path: c:\windows\system32\inetsrv\w3wp.exe Faulting module path: C:\Windows\SYSTEM32\jscript9.dll Report Id: 41d7c693-47dc-11e8-941b-001422091778 Faulting package full name: Faulting package-relative application ID: Event Xml: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"&gt; <System> <Provider Name="Application Error" /> <EventID Qualifiers="0">1000</EventID> <Level>2</Level> <Task>100</Task> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2018-04-24T16:26:36.000000000Z" /> <EventRecordID>19020</EventRecordID> <Channel>Application</Channel> <Security /> </System> <EventData> <Data>w3wp.exe</Data> <Data>8.0.9200.16384</Data> <Data>50108835</Data> <Data>jscript9.dll</Data> <Data>10.0.9200.22411</Data> <Data>5ab67156</Data> <Data>c0000005</Data> <Data>000000000009de9b</Data> <Data>18b4</Data> <Data>01d3dbe902db98e6</Data> <Data>c:\windows\system32\inetsrv\w3wp.exe</Data> <Data>C:\Windows\SYSTEM32\jscript9.dll</Data> <Data>41d7c693-47dc-11e8-941b-001422091778</Data> <Data> </Data> <Data> </Data> </EventData> </Event>

Taritsyn commented 6 years ago

Hello, Jeremy!

What version of Internet Explorer is installed on the server?

jeremyZX commented 6 years ago

IE 10, which (I believe) is the latest available for Windows Server 2012 Standard

Taritsyn commented 6 years ago

Hello, Jeremy!

We've been able to work around this issue both by uninstalling the patch (kb4093123), ...

If problem was solved by uninstalling the patch, then most likely this error is in the jscript9.dll assembly. Such error can not be fixed in .NET wrapper (MSIE JavaScript Engine for .NET). Unfortunately, Microsoft has recently made similar errors: “Control stack size for ChakraCore engine” and “Process is terminating due to StackOverflowException”.

At the moment, JavaScriptEngineSwitcher.ChakraCore is more preferable for use on the server, than the JavaScriptEngineSwitcher.Msie. The main advantage of the JavaScriptEngineSwitcher.Msie is ability to debug scripts by using Visual Studio.