IE 11 在使用 iOS 8.1.3 的 Ipad Air 上的 Citrix XenApp 7.6 中的 html5-audio 上崩溃

IE11 crashs on html5-audio in Citrix XenApp7.6 on Ipad Air with iOS 8.1.3

我正在调查一个与 IE11 崩溃有关的奇怪问题。

我们的环境是 IE11 中的网站 运行,通过 Citrix Xenapp 部署到带有 Citrix Receiver 的 iPad。

大约。 10%打开网站的情况发生IE崩溃

用例是,我们想要在按下按钮时播放声音。

调查

我们将其确定为导致问题的 html5 音频标签。 因此,我们构建了两个最小示例来重现此故障行为。 一个是普通的 html5 音频标签,另一个是脚本化的音频元素:

<!-- audio1.html -->
<!DOCTYPE html>
<html>
<head>
    <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">
</head>
<body>
    <audio id="player" controls preload="auto">
      <source src="img/sound/beep.mp3" type="audio/mpeg" />
      <source src="img/sound/beep.ogg" type="audio/ogg" />
      <source src="img/sound/beep.wav" type="audio/wav" />
    </audio>
    <audio id="player2" controls preload="auto">
      <source src="img/sound/beep2.mp3" type="audio/mpeg" />
    </audio>
    <audio id="player3" controls preload="auto">
      <source src="img/sound/beep3.mp3" type="audio/mpeg" />
    </audio>
    <audio id="player4" controls preload="auto">
      <source src="img/sound/beep4.mp3" type="audio/mpeg" />
    </audio>
</body>
</html>
<!-- audio2.html -->
<!DOCTYPE html>
<html>
<head>
    <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">
</head>
<body>
    <script src="https://ajax.googleapis.com/ajax/libs/jquery/1.11.1/jquery.min.js"></script>
    <script>
      jQuery(document).ready(function() {
        function createAudio(url) {
          var audio = document.createElement("audio");
          audio.setAttribute('preload', 'auto');
          audio.setAttribute('controls', 'controls');
          audio.setAttribute('type', 'audio/mpeg');
          if (audio != null && audio.canPlayType && audio.canPlayType("audio/mpeg")) {
            audio.src = url;
          }
          document.body.appendChild(audio);
          return audio;
        }
        var audio1 = createAudio("img/sound/beep.mp3");
        var audio2 = createAudio("img/sound/beep2.mp3");
        var audio3 = createAudio("img/sound/beep3.mp3");
        var audio4 = createAudio("img/sound/beep4.mp3");
      });
    </script>
</body>
</html>

结果

有了这个例子,我们可以更频繁地重现失败

故障转储

Windows 事件日志

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Application Error" />
    <EventID Qualifiers="0">1000</EventID>
    <Level>2</Level>
    <Task>100</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2015-03-05T15:39:00.000000000Z" />
    <EventRecordID>9994</EventRecordID>
    <Channel>Application</Channel>
    <Computer>T02.ADL.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data>IEXPLORE.EXE</Data>
    <Data>11.0.9600.17416</Data>
    <Data>5452eed9</Data>
    <Data>ntdll.dll</Data>
    <Data>6.3.9600.17630</Data>
    <Data>54b0d74f</Data>
    <Data>c0000005</Data>
    <Data>000411d2</Data>
    <Data>19d4</Data>
    <Data>01d0575a7d7ee406</Data>
    <Data>C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE</Data>
    <Data>C:\Windows\SYSTEM32\ntdll.dll</Data>
    <Data>bdb9a4d8-c34d-11e4-80e9-f246be8a9fe6</Data> 
    <Data />
    <Data />
  </EventData>
</Event>

使用 windbg.exe!analye -v 我得到以下故障转储:

************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*C:\crashdebug\Symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*C:\crashdebug\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 8 Version 9600 MP (4 procs) Free x86 compatible
Product: Server, suite: TerminalServer
Built by: 6.3.9600.17031 (winblue_gdr.140221-1952)
Machine Name:
Debug session time: Fri Feb 27 12:37:14.000 2015 (UTC + 1:00)
System Uptime: 0 days 11:35:11.637
Process Uptime: 0 days 0:01:08.000
................................................................
................................................................
......
Loading unloaded module list
..
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(d20.1b10): Access violation - code c0000005 (first/second chance not available)
eax=00000000 ebx=00000000 ecx=43f23b31 edx=7e78d000 esi=00000003 edi=00000003
eip=7756cc2c esp=0d78e78c ebp=0d78e914 iopl=0         nv up ei pl nz na po nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000202
ntdll!NtWaitForMultipleObjects+0xc:
7756cc2c c21400          ret     14h
0:024> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ScriptSn.20140828074232.dll -
GetUrlPageData2 (WinHttp) failed: 12007.

FAULTING_IP:
ntdll!RtlEnterCriticalSection+12
775711d2 f00fba3000      lock btr dword ptr [eax],0

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 775711d2 (ntdll!RtlEnterCriticalSection+0x00000012)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000001
   Parameter[1]: 43f23b35
Attempt to write to address 43f23b35

CONTEXT:  00000000 -- (.cxr 0x0;r)
eax=00000000 ebx=00000000 ecx=43f23b31 edx=7e78d000 esi=00000003 edi=00000003
eip=7756cc2c esp=0d78e78c ebp=0d78e914 iopl=0         nv up ei pl nz na po nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000202
ntdll!NtWaitForMultipleObjects+0xc:
7756cc2c c21400          ret     14h

DEFAULT_BUCKET_ID:  INVALID_POINTER_WRITE
PROCESS_NAME:  iexplore.exe
ERROR_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.
EXCEPTION_PARAMETER1:  00000001
EXCEPTION_PARAMETER2:  43f23b35
WRITE_ADDRESS:  43f23b35
FOLLOWUP_IP:    mfcore!CSampleQueue::Flush+1b
7481999c 68ffffff7f      push    7FFFFFFFh
NTGLOBALFLAG:  400
APPLICATION_VERIFIER_FLAGS:  0
APP:  iexplore.exe
ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre
FAULTING_THREAD:  00001b10
PRIMARY_PROBLEM_CLASS:  INVALID_POINTER_WRITE
BUGCHECK_STR:  APPLICATION_FAULT_INVALID_POINTER_WRITE
LAST_CONTROL_TRANSFER:  from 7481999c to 775711d2

STACK_TEXT:
0d78f2e4 7481999c 43f23b31 0c2a80d0 43f23939 ntdll!RtlEnterCriticalSection+0x12
0d78f304 7481acd6 00000001 0c2a80d0 43f23939 mfcore!CSampleQueue::Flush+0x1b
0d78f328 747f6c7a 0c2a80d0 0c2a80d0 00000000 mfcore!CSampleQueue::~CSampleQueue+0x17
0d78f364 7483de0d 7483de00 0d78f38c 7481a61e mfcore!CAudStreamSink::~CAudStreamSink+0x120
0d78f370 7481a61e 00000001 0c2a806c 80004005 mfcore!CAudStreamSink::`vector deleting destructor'+0xd
0d78f38c 748cc0ef 0c2a80d0 0c2a7f08 0c2a7f50 mfcore!CAudStreamSink::Release+0x4e
0d78f3ac 747eec7d 00000000 0d78f448 0d78f3d0 mfcore!CAudioMediaSink::InternalCreateStreamSink+0xdd3a8
0d78f3d8 747eeba0 0d78f3f4 0d78f448 00000000 mfcore!CAudioMediaSink::CAudioMediaSink+0xb1
0d78f3f8 747eeafe 0c2b7380 00000000 0c2b73b8 mfcore!CAudioMediaSink::CreateInstance+0x30
0d78f4a8 747ee809 0c2b7380 0c2b73b8 0d78f520 mfcore!MFCreateAudioRenderer+0x2be
0d78f4c0 7483a03d 0c2b7380 7483a000 0c2dfa60 mfcore!CMFAudioRendererActivate::InstantiateMediaObject+0x29
0d78f4d8 74839fdf 747c4a80 0d78f520 0c2dfb98 mfcore!CMFActivate::DoActivate+0x3d
0d78f4f4 747f205a 0c2b7380 747c4a80 0d78f520 mfcore!CMFActivate::ActivateObject+0x2f
0d78f52c 747f1f91 05a0d670 0c2b7380 00000000 mfcore!CMediaSession::BindOutputNode+0x75
0d78f56c 74938512 0c2a6ab8 00000000 748c3320 mfcore!CMediaSession::BindOutputNodes+0x10e
0d78f5b4 747efaa1 05a0fd08 05a0fd08 747efa30 mfcore!CMediaSession::OpQueueTopology+0x32b
0d78f5d8 74819621 05a0fd08 0c2b74e8 74819580 mfcore!CMediaSession::DispatchOperation+0x71
0d78f5f8 74819591 74819580 0d78f63c 74c02459 mfcore!COpQueue::ProcessMarshalledOperations+0x85
0d78f604 74c02459 0c2dfa7c 0c2b74e8 0c211f40 mfcore!COpQueue::ProcessMarshalledOperationsAsyncCallback::Invoke+0x11
0d78f63c 74bf72e9 0c26c788 031cef88 74bf7240 RTWorkQ!CSerialWorkQueue::QueueItem::ExecuteWorkItem+0x1b2
0d78f674 77553cc7 0d78f6f8 0c211f40 031cef88 RTWorkQ!ThreadPoolWorkCallback+0xa9
0d78f6b4 775514b1 0d78f6f8 031cefe8 035d296c ntdll!TppWorkpExecuteCallback+0x137
0d78f84c 76de7c04 085b1e48 76de7be0 02dce3d3 ntdll!TppWorkerThread+0x48e
0d78f860 7758b5af 085b1e48 035d2988 00000000 kernel32!BaseThreadInitThunk+0x24
0d78f8a8 7758b57a ffffffff 77570411 00000000 ntdll!__RtlUserThreadStart+0x2f
0d78f8b8 00000000 77544b50 085b1e48 00000000 ntdll!_RtlUserThreadStart+0x1b

SYMBOL_STACK_INDEX:  1
SYMBOL_NAME:  mfcore!CSampleQueue::Flush+1b
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: mfcore
IMAGE_NAME:  mfcore.dll
DEBUG_FLR_IMAGE_TIMESTAMP:  545036e9
STACK_COMMAND:  ~24s; .ecxr ; kb
FAILURE_BUCKET_ID:  INVALID_POINTER_WRITE_c0000005_mfcore.dll!CSampleQueue::Flush
BUCKET_ID:  APPLICATION_FAULT_INVALID_POINTER_WRITE_mfcore!CSampleQueue::Flush+1b
ANALYSIS_SOURCE:  UM
FAILURE_ID_HASH_STRING:  um:invalid_pointer_write_c0000005_mfcore.dll!csamplequeue::flush
FAILURE_ID_HASH:  {0351a28f-6605-92a0-dcfc-74117e20afcb}
Followup: MachineOwner

据我所知,故障转储 IE 通过注册音频设备而崩溃。适用于 citrix。?

解决此问题的其他尝试

其他已经考虑过的来自 SO 的问题没有适合我们问题的解决方案

终于

我现在的问题是,我不知道该怎么做才能解决这个问题。 是 windows 问题、citrix 问题还是 iOS 问题?或者它是所有的组合 其中

有人知道解决方法吗?

或者我可以从另一点开始另一次调试尝试吗?

如果您需要更多数据,请告诉我。

更新2015-03-10

XenApp 服务器是否配置为启用 Windows 媒体重定向,参考:http://support.citrix.com/proddocs/topic/xenapp65-admin/ps-sf-media-speed-screen-acceleration-config-all-v2.html. If so, does disabling it fix the issue? The current documentation for Citrix Receiver for IOS has information about settings on this page for media redirection too, ref: http://support.citrix.com/proddocs/topic/receiver-ios-59/receivers-ios-about.html 建议免费 space。

为了完整起见,这是我的解决方法:

  • 将音频的使用减少到最低限度
  • 每晚重新启动 windows 服务器(足够每台服务器每天 20 个会话,每个会话 8 小时的活动使用)

我们的最终解决方案是升级到 Windows Server 2016 和 Citrix Xenapp 7.15,并且不会出现此问题。


我们在 Microsoft 和 Citrix 开的票是 closed/rejected 和 "No problem with our software, it must be the other vendors."