Fix TerminalControl crash on exit #10031
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ghost
added
Area-TerminalControl
This comment has been minimized.
This comment has been minimized.
zadjii-msft
approved these changes
May 4, 2021
ControlCore's _renderer (IRenderTarget) is allocated as std::unique_ptr, but is given to Terminal::CreateFromSettings as a reference. ControlCore::Close deallocates the `_renderer`, but if ThrottledFuncs are still scheduled to call ControlCore::UpdatePatternLocations it'll cause Terminal::UpdatePatterns to be called, which in turn ends up accessing the deallocated IRenderTarget reference and lead to a crash. A proper solution with shared pointers is nontrivial and should be attempted at a later point in time. This solution moves the teardown of the _renderer into ControlCore::~ControlCore, where we can be certain that no further strong references are held by ThrottledFuncs.
lhecker
force-pushed
the
dev/lhecker/fix-exit-crash
branch
from
564743a to
86439da
Compare
DHowett
approved these changes
May 4, 2021
DHowett
added
the
AutoMerge
|
Hello @DHowett! Because this pull request has the Do note that I've been instructed to only help merge pull requests of this repository that have been opened for at least 8 hours, a condition that will be fulfilled in about 3 hours 47 minutes. No worries though, I will be back when the time is right! 😉 p.s. you can customize the way I help with merging this pull request, such as holding this pull request until a specific person approves. Simply @mention me (
|
|
@msftbot merge this in 1 minute |
|
Hello @DHowett! Because you've given me some instructions on how to help merge this pull request, I'll be modifying my merge approach. Here's how I understand your requirements for merging this pull request:
If this doesn't seem right to you, you can tell me to cancel these instructions and use the auto-merge policy that has been configured for this repository. Try telling me "forget everything I just told you". |
ghost
merged commit
2 tasks
ghost
pushed a commit
that referenced
this pull request
May 11, 2021
## Summary of the Pull Request ControlCore::AttachUiaEngine receives a IRenderEngine as a raw pointer, which TermControl owns. We must ensure that we first destroy the ControlCore before the UiaEngine instance (both owned by TermControl). Otherwise a deallocated IRenderEngine is accessed when ControlCore calls Renderer::TriggerTeardown. ## References This crash was introduced in #10031. ## PR Checklist * [x] I work here * [x] Tests added/passed ## Validation Steps Performed * Run accevent.exe to cause a UiaEngine to be attached to a TermControl. * Close the current tab * Ensured no crashes occur
DHowett
pushed a commit
that referenced
this pull request
May 14, 2021
ControlCore::AttachUiaEngine receives a IRenderEngine as a raw pointer, which TermControl owns. We must ensure that we first destroy the ControlCore before the UiaEngine instance (both owned by TermControl). Otherwise a deallocated IRenderEngine is accessed when ControlCore calls Renderer::TriggerTeardown. This crash was introduced in #10031. * [x] I work here * [x] Tests added/passed * Run accevent.exe to cause a UiaEngine to be attached to a TermControl. * Close the current tab * Ensured no crashes occur (cherry picked from commit 43040ef)
DHowett
pushed a commit
that referenced
this pull request
May 14, 2021
ControlCore::AttachUiaEngine receives a IRenderEngine as a raw pointer, which TermControl owns. We must ensure that we first destroy the ControlCore before the UiaEngine instance (both owned by TermControl). Otherwise a deallocated IRenderEngine is accessed when ControlCore calls Renderer::TriggerTeardown. This crash was introduced in #10031. * [x] I work here * [x] Tests added/passed * Run accevent.exe to cause a UiaEngine to be attached to a TermControl. * Close the current tab * Ensured no crashes occur (cherry picked from commit 43040ef) (cherry picked from commit ad45139)
|
🎉 Handy links: |
ghost
mentioned this pull request
|
🎉 Handy links: |
This pull request was closed.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary of the Pull Request
ControlCore's _renderer (IRenderTarget) is allocated as std::unique_ptr,
but is given to Terminal::CreateFromSettings as a reference.
ControlCore::Close deallocates the _renderer, but if ThrottledFuncs
are still scheduled to call ControlCore::UpdatePatternLocations
it'll cause Terminal::UpdatePatterns to be called, which in turn ends up
accessing the deallocated IRenderTarget reference and lead to a crash.
A proper solution with shared pointers is nontrivial and should be
attempted at a later point in time. This solution moves the teardown of
the _renderer into ControlCore::~ControlCore, where we can be certain
that no further strong references are held by ThrottledFuncs.
PR Checklist
exit, 2021 edition #9910Validation Steps Performed
The crash is a race condition and inherently hard to reproduce.
During validation this PR didn't appear to introduce new crashes.