贴的dump上来？

Windbg 加载dmp 后,  执行 !analyze -v    再执行 r 后显示的结果.  是不是看不出来? 还需要我提供什么吗? 谢谢了.

wow64exts.sw切换到32位，把调用栈打出来看看

0:000> !wow64exts.sw
Switched to 32bit mode
0:000:x86> r
eax=2aa65a90 ebx=0087a974 ecx=00000000 edx=0000029b esi=00000000 edi=00154016
eip=1f45a83f esp=0195f530 ebp=0195f550 iopl=0         ov up ei pl nz na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010a06
1f45a83f 6c              ins     byte ptr es:[edi],dx       es:002b:00154016=??

是不是这样?

GetPageUrlData failed, server returned HTTP status 404
URL requested: http://watson.microsoft.com/StageOne/Server_exe/2011_9_1_0/2a425e19/unknown/0_0_0_0/bbbbbbb4/80000003/00000000.htm?Retriage=1

FAULTING_IP:
+6a922faf0248db64
00000000 ??              ???

EXCEPTION_RECORD:  ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 0000000000000000
   ExceptionCode: 80000003 (Break instruction exception)
  ExceptionFlags: 00000000
NumberParameters: 0

FAULTING_THREAD:  00000000000007c0

DEFAULT_BUCKET_ID:  WRONG_SYMBOLS

PROCESS_NAME:  Server.exe

ADDITIONAL_DEBUG_TEXT:  
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

FAULTING_MODULE: 0000000076af0000 kernel32

DEBUG_FLR_IMAGE_TIMESTAMP:  2a425e19

MODULE_NAME: Server

ERROR_CODE: (NTSTATUS) 0x80000003 - {

EXCEPTION_CODE: (NTSTATUS) 0x80000003 (2147483651) - {

MOD_LIST: <ANALYSIS/>

PRIMARY_PROBLEM_CLASS:  WRONG_SYMBOLS

BUGCHECK_STR:  APPLICATION_FAULT_WRONG_SYMBOLS_ZEROED_STACK

IP_ON_HEAP:  000000001f45a83f
The fault address in not in any loaded module, please check your build's rebase
log at <releasedir>\bin\build_logs\timebuild\ntrebase.log for module which may
contain the address if it were loaded.

LAST_CONTROL_TRANSFER:  from 00000000007d4116 to 000000001f45a83f

STACK_TEXT:  
WARNING: Frame IP not in any known module. Following frames may be wrong.
0195f52c 007d4116 00000000 00000000 00000000 0x1f45a83f
0195f550 0069a3cc 0195fcd4 0069a3f8 0195f584 Server+0x3d4116
0195f584 0069ac7c 00000000 1f45a830 1bc5d6c0 Server+0x29a3cc
0195fcf8 007133fe 0195fd0c 00713408 0195fd54 Server+0x29ac7c
0195fd54 0085f09a 0195fd98 0085f19d 0195fd70 Server+0x3133fe
0195fd70 0085cfc9 03326b10 0323fb20 0195fd90 Server+0x45f09a
0195fd80 004464ca 00000000 03326b10 0195fdb8 Server+0x45cfc9
0195fd90 00446338 0195fe64 00446342 0195fdb8 Server+0x464ca
0195fdb8 0043228a 00000113 00000001 00000000 Server+0x46338
0195fdd0 76c162fa 0030097c 00000113 00000001 Server+0x3228a
0195fdfc 76c16d3a 00160f39 0030097c 00000113 user32!gapfnScSendMessage+0x332
0195fe74 76c177c4 00000000 00160f39 0030097c user32!GetThreadDesktop+0xd7
0195fed4 76c17bca 00160f39 00000001 0195ff00 user32!CharPrevW+0x138
0195fee4 004a2c85 0195ff08 7efde000 0100ffff user32!DispatchMessageA+0xf
0195ff00 004a2ccc 0030097c 00000113 00000001 Server+0xa2c85
0195ff28 004a2f67 0195ff3c 004a2f71 0195ff58 Server+0xa2ccc
0195ff58 00860edc 0195ff7c 00860ef2 0195ff70 Server+0xa2f67
0195ff70 008619e9 00000000 0195ffc4 004047c0 Server+0x460edc
0195ff88 76b0338a 7efde000 0195ffd4 77319f72 Server+0x4619e9
0195ff94 77319f72 7efde000 4606a618 00000000 kernel32!BaseThreadInitThunk+0x12
0195ffd4 77319f45 008619cc 7efde000 ffffffff ntdll_772e0000!RtlInitializeExceptionChain+0x63
0195ffec 00000000 008619cc 7efde000 00000000 ntdll_772e0000!RtlInitializeExceptionChain+0x36

STACK_COMMAND:  ~0s; .ecxr ; kb

FOLLOWUP_IP:
Server+3d4116
007d4116 8a45fb          mov     al,byte ptr [ebp-5]

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  Server+3d4116

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  Server.exe

BUCKET_ID:  WRONG_SYMBOLS

FAILURE_BUCKET_ID:  WRONG_SYMBOLS_80000003_Server.exe!Unknown

WATSON_STAGEONE_URL:  http://watson.microsoft.com/StageOne/Server_exe/2011_9_1_0/2a425e19/unknown/0_0_0_0/bbbbbbb4/80000003/00000000.htm?Retriage=1

Followup: MachineOwner
---------

谁能帮我分析一下, 我对这个实在不懂. 根据上面的信息我能根据MAP文件 定位到程序里面的具体的代码行,但里面没有 分配 内存 释放内存, 指针操作这些. 就是对一个类全局变量的加减函数. 实在不明白为什么会影响到程序崩溃.

帮我看一下, RMB酬谢都行. 真的很急.

多线程？

rechine　太感谢了．
是多线程, 但不会同时操作这个函数.
会不会是线程里面出错了, 而主线程刚好执行到这儿. 所以DUMP 文件 里面的错误定位到这儿?
如果是线程里面出错,怎么根据DUMP文件来查找错误?

帮下我吧...实在不知道怎么下手了. 快疯了.. 谢谢大家了.