Strange crash reported from winQual. Is it caused by _endthreadex?

I have a thread that I launch as follows in C++:

 BOOL CMyThread::CreateThread()
 {
  unsigned threadid;
  m_hThread = (HANDLE) _beginthreadex(NULL, 0, CMyThread::BeginThread, this,
0, &threadid);
  return (m_hThread != (HANDLE) -1);
 }

 static unsigned __stdcall CMyThread::BeginThread(void *parg)
 {
  ((CMyThread *) parg)->InitInstance();
  int ret_val = ((CMyThread *) parg)->ExitInstance();
  _endthreadex(ret_val);
  return ret_val;
 }

{
....
CMyThread *pNewThread = new CMyThread();
pNewThread->CreateThread();
....
}

I'm calling _endthreadex because it suggests I should in some samples.
However, I'm starting to wonder if it's necessary or desirable.

My real problem is that I'm getting a strange crash dump on my WinQual
account.

Here's what I'm given:
Unhandled exception at 0x76e4a9bd (ntdll.dll) in minidump.mdmp: 0xC0000005:
Access violation reading location 0x00000000.

and here's the stack trace:


Now, unfortunatley, that's not a lot to go on. I had hoped that I would get
some more information.
The code around the crash address looks like this:
__RtlUserThreadStart@8:
76E4A996 push 14h
76E4A998 push 76E5F108h
76E4A99D call __SEH_prolog4 (76E547D8h)
76E4A9A2 and dword ptr [ebp-4],0
76E4A9A6 mov eax,dword ptr [_Kernel32ThreadInitThunkFunction
(76ED52A0h)]
76E4A9AB push dword ptr [ebp+0Ch]
76E4A9AE test eax,eax
76E4A9B0 je __RtlUserThreadStart@8+32h (76E26326h)
76E4A9B6 mov edx,dword ptr [ebp+8]
76E4A9B9 xor ecx,ecx
76E4A9BB call eax
76E4A9BD mov dword ptr [ebp-4],0FFFFFFFEh // FAULT ADDRESS!!!
76E4A9C4 call __SEH_epilog4 (76E5481Dh)
76E4A9C9 ret 8
76E4A9CC call _LdrpImageHasTls@0 (76E7A612h)

and the stack looks like this:
0x0012FFA8 ?? ?? ?? ?? ?? ?? ?? ?? bd a9 e4 76 00 .........??v.
0x0012FFB5 e0 fd 7f 3b 74 12 00 00 00 00 00 00 00 ??.;t........
0x0012FFC2 00 00 00 e0 fd 7f 05 00 00 c0 84 59 dc ...??....?.Y?
0x0012FFCF 76 84 59 dc 76 b8 ff 12 00 10 ec 12 00 v.Y?v??...?..
0x0012FFDC ff ff ff ff f2 8b e1 76 df 7a e5 76 00 ?????.?v?z?v.
0x0012FFE9 00 00 00 00 00 00 00 00 00 00 00 84 91 ............'
0x0012FFF6 41 00 00 e0 fd 7f 00 00 00 00 ?? ?? ?? A..??........

So it looks like somehow control has been returned from my thread, and I've
crashed in the clean up code for the thread. The value of the pointer being
loaded with -2 (0xfffffffe) is indeed NULL, so I can see what the crash is,
but I don't have any explanation of how this could end up in this state.

Now, I should point out that I have set my own UnhandledExceptionFilter,
which I use to generate crash dumps which are then emailed to me if the user
chooses to, and I notice that there's possibly a return address of
0x76dc5984 (_UnhandledExceptionFilter@4:) on the stack.
If that is really what's there, there's also a return to:
__except_handler4:
76E18BF2 mov edi,edi

So, I guess it's possible that there's some error in my crash dump
generation in some circumstances and that it would throw an exception, but
that doesn't really seem to explain what's going on here. I generated a gpf
myself in the thread, and that didn't end up with the same fault address.

I also tried using RaiseException, but that too ended up behaving in a
different way.

So, I'm stumped. Any ideas?

Anthony Wieser
Wieser Software Ltd