Crash while saving track preset from multiple instrument tracks.

c2d · September 5, 2019, 3:16pm

I’ve encountered a crash while saving a track preset from multiple instrument tracks. For this, I cannot create multitrack presets.
I’ve collected some information and sent it to the support. Have not received a reply yet, and haven’t seen it fixed in 10.0.40.
So to share this, posting it here.

Product: Cubase 10 Pro (confirmed repro with 10.0.30 and 10.0.40)
OS: Windows 7 x64 SP1
PC: i7 3770K, 32GB RAM, >1TB SSD, RME UCX

How to repro:

Open a new empty project.
Insert many new instrument tracks with no instrument. I inserted 10 instrument tracks.
(for repro, no need to actually load the VI)
Select all 10 tracks.
From the menu, save these tracks as track preset.
Observe the “Save Track Preset” dialog pops up.
Try editing the preset name (insert text, delete characters, etc.).
Cubase crashes. Observe a popup that says Cubase has stopped working.

Here’s some information collected from the debugger - which I thought was one way or another related to the failure.
Hope this helps.

<snip>
00000001`272d1fd0 00000001`41ead774 Cubase10+0x1eac660
00000001`272d2010 00000001`41d57824 Cubase10+0x1ead774
00000001`272d2040 00000001`422a6088 Cubase10+0x1d57824
00000001`272d2070 000007fe`eae9c2e0 Cubase10+0x22a6088
00000001`272d20b0 000007fe`eae9278a VCRUNTIME140!_CallSettingFrame(void)+0x20
00000001`272d20e0 000007fe`eae91a6a VCRUNTIME140!__FrameUnwindToState(
                        unsigned int64 * pRN = 0x00000001`272d21e0,
                        struct _xDISPATCHER_CONTEXT * pDC = 0x00000000`025e871c,
                        struct _s_FuncInfo * pFuncInfo = 0x00000001`42e1ef90,
                        int targetState = 0n-1)+0x136
(Inline Function) --------`-------- VCRUNTIME140!__FrameUnwindToEmptyState+0x7e
00000001`272d2150 000007fe`eae9ba10 VCRUNTIME140!__InternalCxxFrameHandler(
                        struct EHExceptionRecord * pExcept = <Value unavailable error>,
                        unsigned int64 * pRN = 0x00000001`272d2208,
                        struct _CONTEXT * pContext = 0x00000001`272d23b0,
                        struct _xDISPATCHER_CONTEXT * pDC = 0x00000001`272d22c0,
                        struct _s_FuncInfo * pFuncInfo = 0x00000001`42e1ef90,
                        unsigned char recursive = 0x00 '')+0x1a2
00000001`272d21b0 00000000`76f2bffd VCRUNTIME140!__CxxFrameHandler(
                        struct EHExceptionRecord * pExcept = 0x00000001`272d2940,
                        unsigned int64 RN = <Value unavailable error>,
                        struct _CONTEXT * pContext = 0x00000001`272d23b0,
                        struct _xDISPATCHER_CONTEXT * pDC = 0x00000001`272d22c0)+0x90
00000001`272d2200 00000000`76efca49 ntdll!RtlpExecuteHandlerForUnwind+0xd
00000001`272d2230 00000000`76cd052e ntdll!RtlUnwindEx+0x539
00000001`272d28d0 000007fe`eae9bdd9 kernel32!RtlUnwindExStub+0x1e
00000001`272d2910 000007fe`eae928d9 VCRUNTIME140!_UnwindNestedFrames(
                        unsigned int64 * pFrame = <Value unavailable error>,
                        struct EHExceptionRecord * pExcept = <Value unavailable error>,
                        struct _CONTEXT * pContext = <Value unavailable error>,
                        unsigned int64 * pEstablisher = <Value unavailable error>,
                        void * Handler = 0x00000001`425007ae,
                        int TargetUnwindState = 0n17,
                        struct _s_FuncInfo * pFuncInfo = 0x00000001`42ce8f38,
                        struct _xDISPATCHER_CONTEXT * pDC = 0x00000001`272d3230,
                        unsigned char recursive = 0x00 '')+0x109
00000001`272d2ed0 000007fe`eae923d3 VCRUNTIME140!CatchIt(
                        struct EHExceptionRecord * pExcept = 0x00000001`272d3d70,
                        unsigned int64 * pRN = 0x00000001`272d3178,
                        struct _CONTEXT * pContext = 0x00000001`272d3880,
                        struct _xDISPATCHER_CONTEXT * pDC = 0x00000001`272d3230,
                        struct _s_FuncInfo * pFuncInfo = 0x00000001`42ce8f38,
                        struct _s_HandlerType * pCatch = 0x00000001`43815328,
                        struct _s_CatchableType * pConv = 0x00000000`00000000,
                        struct _s_TryBlockMapEntry * pEntry = 0x00000001`43815314,
                        unsigned char recursive = 0x00 '')+0xb5
00000001`272d2f50 000007fe`eae920d3 VCRUNTIME140!FindHandlerForForeignException(
                        struct EHExceptionRecord * pExcept = 0x00000001`272d3d70,
                        unsigned int64 * pRN = 0x00000001`272d3178,
                        struct _CONTEXT * pContext = 0x00000001`272d3880,
                        struct _xDISPATCHER_CONTEXT * pDC = 0x00000001`272d3230,
                        struct _s_FuncInfo * pFuncInfo = 0x00000001`42ce8f38,
                        int curState = 0n19)+0x287
00000001`272d2ff0 000007fe`eae91b66 VCRUNTIME140!FindHandler(
                        struct EHExceptionRecord * pExcept = 0x00000001`272d3d70,
                        unsigned int64 * pRN = 0x00000001`272d3178,
                        struct _CONTEXT * pContext = 0x00000001`272d3880,
                        struct _xDISPATCHER_CONTEXT * pDC = 0x00000001`272d3230,
                        struct _s_FuncInfo * pFuncInfo = 0x00000001`42ce8f38,
                        unsigned char recursive = 0x00 '')+0x54b
00000001`272d30c0 000007fe`eae9ba10 VCRUNTIME140!__InternalCxxFrameHandler(
                        struct EHExceptionRecord * pExcept = 0x00000001`272d3d70,
                        unsigned int64 * pRN = 0x00000001`272d3178,
                        struct _CONTEXT * pContext = 0x00000001`272d3880,
                        struct _xDISPATCHER_CONTEXT * pDC = 0x00000001`272d3230,
                        struct _s_FuncInfo * pFuncInfo = 0x00000001`42ce8f38,
                        unsigned char recursive = 0x00 '')+0x29e
00000001`272d3120 00000000`76f2bf7d VCRUNTIME140!__CxxFrameHandler(
                        struct EHExceptionRecord * pExcept = 0x00000001`272d3d70,
                        unsigned int64 RN = <Value unavailable error>,
                        struct _CONTEXT * pContext = 0x00000001`272d3880,
                        struct _xDISPATCHER_CONTEXT * pDC = 0x00000001`272d3230)+0x90
00000001`272d3170 00000000`76f0043a ntdll!RtlpExecuteHandlerForException+0xd
00000001`272d31a0 00000000`76f2b61e ntdll!RtlDispatchException+0x45a
00000001`272d3880 00000000`76ee7c1a ntdll!KiUserExceptionDispatch+0x2e
00000001`272d3f80 00000000`76ee7b14 ntdll!RtlpLowFragHeapAllocFromContext+0x1a
00000001`272d4060 000007fe`e62905d6 ntdll!RtlAllocateHeap+0xe4
00000001`272d4170 00000001`41d60ea9 ucrtbase!malloc_base+0x36
00000001`272d41a0 00000001`41d5ce7d Cubase10+0x1d60ea9
00000001`272d41d0 00000001`41d5c5bc Cubase10+0x1d5ce7d
00000001`272d4200 00000001`422a2e47 Cubase10+0x1d5c5bc
00000001`272d4230 00000001`422a2ff3 Cubase10+0x22a2e47
00000001`272d42f0 00000001`422a2ff3 Cubase10+0x22a2ff3
00000001`272d43b0 00000001`422a314a Cubase10+0x22a2ff3
00000001`272d4470 00000001`422a2ff3 Cubase10+0x22a314a
00000001`272d4530 00000001`422a2ff3 Cubase10+0x22a2ff3
00000001`272d45f0 00000001`422a2ff3 Cubase10+0x22a2ff3
00000001`272d46b0 00000001`422a2ff3 Cubase10+0x22a2ff3
<snip>


0:313> .cxr 0x00000001`272d3880
rax=0000000000280278 rbx=0000000000280298 rcx=0000000000289274
rdx=0000000000000013 rsi=0000000000000013 rdi=0000000000289274
rip=0000000076ee7c1a rsp=00000001272d3f80 rbp=0000000000000000
r8=000000000000007f  r9=0000000000000001 r10=0000000000000000
r11=0000000000000001 r12=0000000000280000 r13=0000000000000020
r14=0000000000000000 r15=0000000076ec3128
iopl=0         nv up ei pl nz na pe nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
ntdll!RtlpLowFragHeapAllocFromContext+0x1a:
00000000`76ee7c1a 48894c2468      mov     qword ptr [rsp+68h],rcx ss:00000001`272d3fe8=0000000000000000
0:313> .exr 0x00000001`272d3d70
ExceptionAddress: 0000000076ee7c1a (ntdll!RtlpLowFragHeapAllocFromContext+0x000000000000001a)
   ExceptionCode: [color=#FF0000]c00000fd (Stack overflow)[/color]
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000001
   Parameter[1]: 00000001272d3fe8
0:313> r
Last set context:
rax=0000000000280278 rbx=0000000000280298 rcx=0000000000289274
rdx=0000000000000013 rsi=0000000000000013 rdi=0000000000289274
rip=0000000076ee7c1a rsp=[color=#FF0000]00000001272d3f80 [/color]rbp=0000000000000000
r8=000000000000007f  r9=0000000000000001 r10=0000000000000000
r11=0000000000000001 r12=0000000000280000 r13=0000000000000020
r14=0000000000000000 r15=0000000076ec3128
iopl=0         nv up ei pl nz na pe nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
ntdll!RtlpLowFragHeapAllocFromContext+0x1a:
00000000`76ee7c1a 48894c2468      mov     qword ptr [rsp+68h],rcx ss:00000001`272d3fe8=0000000000000000
0:313> !teb
TEB at 000007ffffca0000
    ExceptionList:        0000000000000000
    StackBase:            00000001273d0000
    StackLimit:           [color=#FF0000]00000001272d1000[/color]
    SubSystemTib:         0000000000000000
    FiberData:            0000000000001e00
    ArbitraryUserPointer: 0000000000000000
    Self:                 000007ffffca0000
    EnvironmentPointer:   0000000000000000
    ClientId:             00000000000021b8 . 0000000000001c1c
    RpcHandle:            0000000000000000
    Tls Storage:          0000000034febd30
    PEB Address:          000007fffffdd000
    LastErrorValue:       0
    LastStatusValue:      c000000d
    Count Owned Locks:    0
    HardErrorMode:        0

0:313> !error c00000fd
Error code: (NTSTATUS) 0xc00000fd (3221225725) - A new guard page for the stack cannot be created.

0:313> ?00000001272d3f80-00000001272d1000
Evaluate expression: 12160 = 00000000`00002f80

0:313> !peb
PEB at 000007fffffdd000
    InheritedAddressSpace:    No
    ReadImageFileExecOptions: No
    BeingDebugged:            Yes
    ImageBaseAddress:         0000000140000000
    Ldr                       0000000076ff2e40
    Ldr.Initialized:          Yes
    Ldr.InInitializationOrderModuleList: 0000000000283320 . 0000000124a8ac10
    Ldr.InLoadOrderModuleList:           0000000000283210 . 0000000124a8abf0
    Ldr.InMemoryOrderModuleList:         0000000000283220 . 0000000124a8ac00
            Base TimeStamp                     Module
       140000000 5c935e03 Mar 21 02:48:51 2019 C:\Program Files\Steinberg\Cubase 10\Cubase10.exe
<snip>

The error is stack overflow, apparently due to recursive calls way too deep.

0:313> .cxr 0x00000001272d3880 rax=0000000000280278 rbx=0000000000280298 rcx=0000000000289274 rdx=0000000000000013 rsi=0000000000000013 rdi=0000000000289274 rip=0000000076ee7c1a rsp=00000001272d3f80 rbp=0000000000000000 r8=000000000000007f r9=0000000000000001 r10=0000000000000000 r11=0000000000000001 r12=0000000000280000 r13=0000000000000020 r14=0000000000000000 r15=0000000076ec3128 iopl=0 nv up ei pl nz na pe nc cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010202 ntdll!RtlpLowFragHeapAllocFromContext+0x1a: 0000000076ee7c1a 48894c2468 mov qword ptr [rsp+68h],rcx ss:00000001272d3fe8=0000000000000000 0:313> .exr 0x00000001272d3d70
ExceptionAddress: 0000000076ee7c1a (ntdll!RtlpLowFragHeapAllocFromContext+0x000000000000001a)
ExceptionCode: c00000fd (Stack overflow)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000001
Parameter[1]: 00000001272d3fe8
0:313> !teb
TEB at 000007ffffca0000
ExceptionList: 0000000000000000
StackBase: 00000001273d0000
StackLimit: 00000001272d1000
SubSystemTib: 0000000000000000

0:313> !error c00000fd
Error code: (NTSTATUS) 0xc00000fd (3221225725) - A new guard page for the stack cannot be created.

Martin.Jirsak · September 5, 2019, 6:41pm

Hi,

Could you attach the source *.dmp file, please?

c2d · September 6, 2019, 1:46pm

Hi Martin,

Sorry there’s no crash dump, the debug log came from a live debugging.

Did you not succeed to repro this issue? The precise repro step is in the first post. Thanks!

Martin.Jirsak · September 10, 2019, 1:56pm

Hi,

I have tried heavily to reproduce it here and it works to me. Could you attach the *.dmp file, please?