title: Decoding activation context error 0xC015000f
body: <p>I need to identify the root cause of</p>
  
  <blockquote>
    <p>EXCEPTION_CODE: (NTSTATUS) 0xc015000f - The activation context being deactivated is not the most recently activated one.</p>
  </blockquote>
  
  <p>using a user mode post mortem crash dump.</p>
  
  <p>Callstack:</p>
  
  <pre><code>#  ChildEBP RetAddr  Args to Child
  00 0d31f948 7535544c 096c59b0 *1fb2adc6* 0d31f9a4 ntdll!RtlDeactivateActivationContext+0x154
  01 0d31f958 74739882 00000000 *1fb2adc6* 221075b3 kernel32!DeactivateActCtx+0x31
  02 0d31f964 221075b3 856c9c2c 0e4827d4 0e482768 mfc100u!AFX_MAINTAIN_STATE2::~AFX_MAINTAIN_STATE2+0x1d
  04 0d31f9a4 221093ce 856c9c74 00000000 00000000 dd10shrd!ClsVDctNotifySink::XDgnVDctNotifySink::JITPause_+0x93
  </code></pre>
  
  <p>I'm pretty sure that <code>0x1fb2adc6</code> is the <code>ulCookie</code> value that's passed into the <code>DeleteActCtx</code> call (i.e. <code>DeactivateActCtx( 0, 0x1fb2adc6 )</code>), but I don't know where to go next to determine why it's being deactivated out of context.</p>
  
  <p>I can't re-run the program with special exception settings; this user mode crash dump we received from a customer installation is all I've got to work with.</p>
  
  <p>Output from <code>!PEB</code> shows the following about the environment:</p>
  
  <pre><code>NUMBER_OF_PROCESSORS=2
  OS=Windows_NT
  PROCESSOR_ARCHITECTURE=x86
  PROCESSOR_ARCHITEW6432=AMD64
  PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 37 Stepping 2, GenuineIntel
  PROCESSOR_LEVEL=6
  PROCESSOR_REVISION=2502
  </code></pre>