Crash in 32-bit shell extension on Windows x64

[Francis Gagné]

I have debugged an application crash that seems to be caused by TortoiseSVN's 32-bit shell extension. Here are the details:

Steps to reproduce:

1. Make sure TortoiseSVN is installed.
2. Download SonED2 from this page: http://stealth.hapisan.com/SonED/ (click "Download SonED2"). Extract the contents from the archive in some folder.
3. Start SonED2.exe.
4. Click File > Open Project.

Expected results:
An open file common dialog opens.

Actual results:
The application crashes; either Windows Error Reporting starts ("The application has stopped working") or the application terminates without any messages.

System information:
OS: Windows 7 x64 SP1
SonED2 version: v11.05.19
TortoiseSVN version: TortoiseSVN 1.7.99, Build 24240 - 64 Bit -dev, 2013/05/28 02:21:04

Other information:
I ran SonED2 in WinDbg to see if I could figure out why the application crashes. WinDbg signals an access violation (exception C0000005) in crshhndl.dll:

crshhndl!InitCrashHandler+0x4d2:
095c2282 ff15a0fe0000 call dword ptr ds:[0FEA0h] ds:002b:0000fea0=????????

By the way, there is no symbol file for crshhndl.dll in debugsymbols64.zip...

I know of at least one other person with the same issue on Windows 8 x64.

I can work around the issue by renaming the 32-bit shell extension DLLs so that they are not loaded by the open file dialog in SonED2.

------------------------------------------------------
http://tortoisesvn.tigris.org/ds/viewMessage.do?dsForumId=4061&dsMessageId=3056561

To unsubscribe from this discussion, e-mail: [users-un...@tortoisesvn.tigris.org].

[Francis Gagné]

Uh, I just realized that crshhndl.dll is a 64-bit DLL, and that it is loaded into a 32-bit process. That's not supposed to happen... unless TortoiseSVN uses some dark magic tricks I'm not aware of? In Process Hacker (http://processhacker.sourceforge.net/), I can see that crshhndl.dll is loaded as a "WOW64 DLL" (whereas some 64-bit system DLLs like ntdll.dll and wow64.dll are shown as "DLL").

------------------------------------------------------
http://tortoisesvn.tigris.org/ds/viewMessage.do?dsForumId=4061&dsMessageId=3058871

[Stefan Küng]

On 24.06.2013 02:16, Francis Gagné wrote:
> Uh, I just realized that crshhndl.dll is a 64-bit DLL, and that it is
> loaded into a 32-bit process. That's not supposed to happen... unless
> TortoiseSVN uses some dark magic tricks I'm not aware of? In Process

That's not possible, not with any tricks, not at all.

> Hacker (http://processhacker.sourceforge.net/), I can see that
> crshhndl.dll is loaded as a "WOW64 DLL" (whereas some 64-bit system
> DLLs like ntdll.dll and wow64.dll are shown as "DLL").

I've attached a debugger to SonED2. While trying to open the file-open
dialog it throws exceptions. And it throws them a *lot*.
First-chance exception at 0x087E21D2 in SonED2.exe: 0xC0000005: Access
violation reading location 0x0000FF40.

As you can see, these are "first-chance exceptions", which usually are
not a problem. But in this number (while I'm writing this, the number of
exceptions exceeds 1 million(!!) and the file-open dialog isn't even
visible yet) and the fact that it's a 32-bit process on x64 OS indicates
that these are not normal first-chance exceptions but ones caught by the
WOW64 system and would cause a real exception on win32 OS.

My best guess: SonED2 has set its stack size smaller than normal, and
when the file-open dialog is shown a stack overflow happens because of
all the dlls that are loaded together with that file-open dialog.

Stefan

--
___
oo // \\ "De Chelonian Mobile"
(_,\/ \_/ \ TortoiseSVN
\ \_/_\_/> The coolest interface to (Sub)version control
/_/ \_\ http://tortoisesvn.net

------------------------------------------------------
http://tortoisesvn.tigris.org/ds/viewMessage.do?dsForumId=4061&dsMessageId=3058953

[Francis Gagné]

> On 24.06.2013 02:16, Francis Gagné wrote:
> > Uh, I just realized that crshhndl.dll is a 64-bit DLL, and that it is
> > loaded into a 32-bit process. That's not supposed to happen... unless
> > TortoiseSVN uses some dark magic tricks I'm not aware of? In Process
>
> That's not possible, not with any tricks, not at all.
>

According to WinDbg, it *is* loaded and it's running code.

> > Hacker (http://processhacker.sourceforge.net/), I can see that
> > crshhndl.dll is loaded as a "WOW64 DLL" (whereas some 64-bit system
> > DLLs like ntdll.dll and wow64.dll are shown as "DLL").
>
> I've attached a debugger to SonED2. While trying to open the file-open
> dialog it throws exceptions. And it throws them a *lot*.
> First-chance exception at 0x087E21D2 in SonED2.exe: 0xC0000005: Access
> violation reading location 0x0000FF40.

If you look in Process Hacker (open the process's properties after it gets an access violation, then select the Modules or Memory tab), or in a 64-bit debugger such as WinDbg (Visual Studio won't tell you), you'll see that 0x087E21D2 is mapped from crshhndl.dll, and these exceptions are coming from that DLL. What causes that DLL to be loaded?

I've debugged another 32-bit application and WinDbg never says that crshhndl.dll is loaded.

If I rename crshhndl.dll, the file open dialog opens in SonED2 and the TortoiseSVN features are available.

>
> As you can see, these are "first-chance exceptions", which usually are
> not a problem. But in this number (while I'm writing this, the number of
> exceptions exceeds 1 million(!!) and the file-open dialog isn't even
> visible yet) and the fact that it's a 32-bit process on x64 OS indicates
> that these are not normal first-chance exceptions but ones caught by the
> WOW64 system and would cause a real exception on win32 OS.
>
> My best guess: SonED2 has set its stack size smaller than normal, and
> when the file-open dialog is shown a stack overflow happens because of
> all the dlls that are loaded together with that file-open dialog.
>

Then I would have expected to see a stack overflow exception (C00000FD)...

Thanks for your time,

Francis

------------------------------------------------------
http://tortoisesvn.tigris.org/ds/viewMessage.do?dsForumId=4061&dsMessageId=3058975