Windows 10 Explorer.exe crashing often while using Edge Browser

Nick 6

For months now my laptop has been having problems with Explorer.exe crashing at various times but seems to be mostly when I am using Edge (Version 96.0.1054.41 but also with earlier versions too). The OS is Win10 Pro 21H1 (Build 19043.1348).

Event Log shows these errors (Windows Log: Application, Source: Application Error, Event ID: 1000)

Faulting application name: explorer.exe, version: 10.0.19041.1348, time stamp: 0x4fe7e346
Faulting module name: KERNELBASE.dll, version: 10.0.19041.1348, time stamp: 0x76fcd692
Exception code: 0xc0000409
Fault offset: 0x000000000010b302
Faulting process id: 0x62ec
Faulting application start time: 0x01d7ebb70521388b
Faulting application path: C:\Windows\explorer.exe
Faulting module path: C:\WINDOWS\System32\KERNELBASE.dll
Report Id: ffb4a545-88fa-4f27-8dd4-215947efeb39
Faulting package full name:
Faulting package-relative application ID:

I have created a DMP file and uploaded to my onedrive. https://1drv.ms/u/s!AguxFzdVs4--v7EPpp0hvx8HtBAgeA?e=m1Vr1f

Perhaps someone can check the DMP file and determine what is causing Explorer to repeatedly crash or advise on items to check. Thanks

EckiS 821 Reputation points

2021-12-08T17:42:52.427+00:00

explorer!CTray::CheckGDIHandleLimit is on the call stack, so perhaps explorer has a GDI handle leak (maybe even related to a tray program?).
you could track the handles of the explorer process to see if they are increasing over time before the crash occurs.

did you enable writing dump files? The please enable writing a full dump: clr.dll is loaded in the process and a minidump is not enough to analyze managed code.

you could use ShellExView to disable all non-Microsoft shell extensions
Nick 6 Reputation points

2021-12-10T16:16:03.933+00:00

@EckiS Thank you for your input. I'm not terribly familiar with much of what you are describing (GDI, clr.dll) but am searching the web for some of the key items you mentioned and will see what I can figure out.

I loaded up ShellExView and it lists all the non-Microsoft extensions as disabled. (I must've already done this at some point in the past while troubleshooting off and on over the past x months and just left them disabled...)

On your advice I am looking at the handle count of explorer.exe and using PerfMon to track the number I have noticed that during normal behavior the count is around 2,500, but when explorer crashes the count will drop to zero or close to it (from the ~2,500 number) and quickly rise to around 5,500 handles for about a minute before sharply dropping back down to normal level of around 2,500. I'm not sure what this indicates yet, it could just be behavior related to Windows logging and reporting the explorer.exe crash event.

I will explore further into the GDI and system tray items and see where that leads... Task Manager shows GDI objects for explorer hanging around the 9,600 mark.
Nick 6 Reputation points

2021-12-10T17:04:06.067+00:00

@EckiS I think the GDI count thing is on the right track. Thanks for pointing me in that direction. Windows 10 has a 10k GDI object limit per process and I believe that my explorer.exe is hitting that and then crashing. After the crash it quickly goes right back up to just under 10k so I need to figure out why explorer is loading up so many GDI objects on this one laptop.

When I close Edge, the GDI objects drops down to just over 200. I do have a lot of tabs and browser windows open but when I open the browser task manager (Shift+Esc), it shows only 78 GDI handles while the explorer GDI objects explodes to near 10k.

To try to reduce (or eliminate) the frequency of explorer crashes I've increased the GDI limit to 12,500 in the registry (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota) for the time being while I continue to troubleshoot.
EckiS 821 Reputation points

2021-12-11T08:28:12.06+00:00

you could create a full dump file from explorer when the GDI object reach 10k .
in task manager: details-page, right click the explorer process with the high GDI object cound: "create dump file".
perhaps we can see more with this.
I still believe some 3rd party library responsible for the leak, but could not find something in your first dump.
Nick 6 Reputation points

2021-12-11T23:00:53.973+00:00

Uploaded mem dump of explorer.exe (https://1drv.ms/u/s!AguxFzdVs4--v7odKSGqU4Xq6K7lSA)

I haven't seen it go to or past 10k since I made the registry change yesterday, it has stayed around 9600 every time I've checked. It also has not crashed since I made the change whereas before it would crash dozens of times per hour. The times it goes past 10k must be in short-lived periods. Is there a way to track it with Perfmon? I didn't notice a way but perhaps I missed it. If there is a script I can run to watch the object count and perform a dump when it surpasses 10k it would be great.

Also, can you share how you are analyzing the file and what to look for? I have WinDbg but my knowledge of using it is limited.. not much hands-on experience using it for more than identifying BSOD causing drivers. (!analyze -v)
EckiS 821 Reputation points

2021-12-12T10:03:30.417+00:00

I did take a look the the dump file, took at look at it hoping it was a leak in managed code (aa clr.dll is loaded),
but this seems to not be the case.

there is no need to use a script: when you reduce the limit back to 10.000 explorer will creash and when you enable writing crash dumps this will be done automatically (thats what obviously happened on your first dump file you posted).

Problem is find what leaks the GDI objects: I can't help you with this.
When no 3rd party dll is loaded this seems to either be a bug explorer, or the onedrive integration: you could try to disable this with ShellExcview.

An other possibility would be the Intel GPU driver, but I am not even sure if a driver bug could manifest itself in a GDI object leak.
Here is an old post with no answer, so perhaps a red herring:
GDI leaks while using Intel graphics card

Does the problem also ocure when booted in safe mode?
Nick 6 Reputation points

2021-12-13T00:58:57.827+00:00

Yeah, you're right about the script not being warranted.. I guess I wasn't thinking about the crash dump was already capturing the state of things at time of crash...

This only happens when I open up Edge, and I have lots and lots of tabs across multiple windows at the moment. I'm not sure the relationship between the browser tabs and GDI in explorer.exe... particularly when most of tabs are "sleeping" I'm sure.

I've not tried to replicate this in safe mode. I may be able to try this a little later tonight.

I'm going to fiddle around with Edge a bit to see if I can identify any changes that will reduce the GDI objects in explorer.exe... maybe one of the extensions. (I only have 3 active)
benhzm82 1 Reputation point

2022-01-25T06:51:43.547+00:00

I had a similar issue occurs on my Laptop.
Firstly, I have to admit that I resolved it by 1st "clearing the File Explorer history" or 2nd "Closing the Drop box application".
I found out when I wanted to save or copy a new file in a destination folder in Drop Box the related folder would close and the log would be write in to the event Logs.

1st solution:
File Explorer > View > Options > Change Folder and search options > Privacy >Clear File Explorer History

2nd solution:
Close Boxcryptor and Drop Box desktop application.

In both situation the problem will be solved.

1 answer

Limitless Technology 39,361 Reputation points

2021-12-10T09:01:23.747+00:00
Hello

Thank you for your question and reaching out.

First, close all the programs and files that you have open.

Right-click on the Windows Start menu and select Control Panel. Then choose the category System and security. On the next screen, look for Administrative Tools on the right and click on that option.

One of those tools is the Windows memory diagnostic. Double click on it to open it.

The diagnosis gives two options to choose from. See what each one does and click on the one you prefer:

Restart now and check for problems.

Then check the hard drive. Enter the following command and replace the X with the drive letter you wish to scan: "chkdsk / f / r X:

Run below DISM command from elevated prompt.

DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth

--If the reply is helpful, please Upvote and Accept as answer--
Please sign in to rate this answer.

0 comments No comments
Sign in to comment