Question: Is this the location to report Application error explorer.exe , Faulting module name Windows.UI.Xaml.dll exception error 0xc000027b ?

[ninmonkey]

Apologies if this is the wrong location. I am not sure if I'm in the correct project to report to. I started filing a crash report, but the questions didn't seem to match my situation. If yes, I can re-submit this.

I landed here from google onto a similar error on a closed issue that @jevansaks was diagnosing. #259

As suggested I uploaded the events to: https://aka.ms/AA5ufoq

The main error is Application error explorer.exe , Faulting module name: Windows.UI.Xaml.dll exception error 0xc000027b

Normally my system is very stable.

• My guess is it is related to installing WindowsTerminal (preview)
• WindowsTerminal sometimes crashes. But when Explorer crashes, WindowsTerminal is usually still okay.
• Otherwise, it might be around the time apple/itunes pops up a dialog to login.

Windows.UI.XAML.dll error 0xc000027b crashes explorer.exe.zip

Edition: Windows10 Pro
Version: 1903
OS Build: 18362.295
Installed On: 8/7/2019

WindowsTerminal (Preview): installed on 8/12/2019

Events are attached.

Thanks.

[jevansaks]

@DHowett-MSFT does this ring any bells?

[DHowett-MSFT]

I’ve only seen this in insider builds when DWM also goes down; other than that, no bells rung.

[ninmonkey]

I’ve only seen this in insider builds when DWM also goes down; other than that, no bells rung.

@DHowett-MSFT DWM might be going down. ProcessExplorer says DWM's parent is winlogon.exe, which keeps giving errors.

In event viewer it shows this error of source: winlogon

The shell stopped unexpectedly and explorer.exe was restarted.

Which seems to happen every time I get the Windows.UI.Xaml.dll error, which is:

Faulting application name: explorer.exe, version: 10.0.18362.267, time stamp: 0x25dd80ad
Faulting module name: Windows.UI.Xaml.dll, version: 10.0.18362.295, time stamp: 0x1a3ccf7c
Exception code: 0xc000027b
Fault offset: 0x00000000007126f0
Faulting process id: 0x1594
Faulting application start time: 0x01d5552158ea7b1f
Faulting application path: C:\WINDOWS\explorer.exe
Faulting module path: C:\Windows\System32\Windows.UI.Xaml.dll
Report Id: 26fac70c-67ee-4dd2-8df9-7236b6bc52d6

(I believe they are in the attached captured events)

Are there any tests or info that would be useful to catch? I was going to try a rollback option, but held off I so I might be able to report this issue.

I am suspicious of

1. the recent WindowsTerminal (Preview) install
2. the recent NVIDIA driver update.

I'm going to try running GPU-Z to catch NVIDIA logging while recreating the issue.

[codendone]

Thanks for the additional information. Using the "Report Id" mentioned, I was able to find the bucket which Windows Error Reporting assigned your crash to. The hits in that bucket are a crash in the Windows Timeline view, which shows when using Win+Tab. Is it possible used Win+Tab around the time of the crash?

I suspect the issue is a bug in the 1903 update you recently got, and isn't related to Windows Terminal or the NVIDIA driver. I've added comments on the internal bug (#20772287) for this crash.

[ninmonkey]

It has happened close to the time I used win10's new win+tab key, so it's very possible it's timeline related. I tried a new nvidia driver. I think I'm still getting a timeline crash.

How you found out it was Windows Timeline view related by using buckets? That way I can filter information to minimize work from unrelated errors, before sending any reports in.

Is the bucket just an ini file? For example "C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_DllHost.exe_940f765cdd37689c8e58abc8e4d7b22ac99e7f_c5bae951_28cb3be8-a52e-45de-9f97-eae507c687e2\Report.wer"

If not, how can I learn to view the bucket or trace? I'm having no luck trying to google information. If it involves setting up an environment, I do have experience programming.

ESET log fixed

Some of the attached errors were from ESET logging:

svchost (10664,R,98) TILEREPOSITORYS-1-5-18: Error -1023 (0xfffffc01)
occurred while opening logfile
C:\WINDOWS\system32\config\systemprofile\AppData\Local\TileDataLayer\Database\EDB.log

This was fixed by creating the directory C:\WINDOWS\system32\config\systemprofile\AppData\Local\TileDataLayer

If I inspect the directory after existing and after an error, all files appear to be byte strings. (i.e. not encoded as one of the unicode codecs.) The majority of bytes are zeros, so maybe it's a memory dump.

The files created are named: EDB.chk, EDB.log, EDB00001.log, EDBres00001.jrs, EDBres00002.jrs, EDBtmp.log.

Thanks for your help!

[codendone]

The 0xc000027b error means this is a stowed exception crash, and you need to look at the stowed exceptions to find the real error code and callstack. There can be multiple stowed exceptions, but the first usually is the fatal error. You can find more information on stowed exceptions at https://channel9.msdn.com/Shows/Inside/C000027B.

To keep crash dumps on your machine so you can look at the cause of an error, you'll probably want to set some regkeys to keep some crash dumps locally (see https://docs.microsoft.com/en-us/windows/win32/wer/collecting-user-mode-dumps).

(I believe the crash bucket information I found isn't something you can do. But that approach is also imprecise, since it only pointed me a somewhat generic bucket with no way for me to confirm the specific issue you hit; I got lucky that this bucket happened to be concentrated on Timeline crashes. Looking at the stowed exceptions in a crash dump, as described above, is required to confirm the blame of a stowed exception crash.)