Crash after creating a new tab and then closing it

[davepdx]

First, I must say that I really like the release version 1.0.0.0! Thanks for the hard work.

I found that I could reproducibly crash Explorer++ when I create a new tab by double clicking in the blank space to the right of the last tab and then after just a very few seconds continue on to click on the "X" close icon to close the tab that I've just created. If I wait 10 seconds or longer to click on the "X" close icon after creating the tab there is no crash and it works as designed. I found this out by accident when I unintentionally double clicked in the white area and then closed the new tab. It appears the crash has a timing component as if I wait a while there is no crash when closing the tab.

This crash occurs if I double click on the white space to the right of the last tab, go file->new tab, or Ctrl-T.

I'm using the 64-bit version in Windows 7 Pro (x64). Please let me know if there is any additional info you need to help track this down.

[David Erceg]

Hi davepdx,

Could you email me the crash dump that's produced when Explorer++ crashes? It's located in %TEMP% (just type this straight into Windows Explorer or Explorer++), and will have be named something like Explorer++1.0.0.0-24112009-213128.dmp.

In the meantime, I'll take a look through the code to see if I can find the cause.

Thanks

[davepdx]

Hi David,

I just sent the crash dump via email.

Thanks for looking into it.

Dave Lewis

[twinsen]

Was this bug solved?
I've got similar behaviour in 1.2.
Whats happening is when the tab opens, this gets called to run SetAllColumnDataAPC on another thread "QueueUserAPC(SetAllColumnDataAPC,m_hThread,(ULONG_PTR)this);"
Closing the tab destroys CFolderView (setting its members to 0xfeeefeee in debug mode), and the thread then calls "CFolderView::SetAllColumnData" sometime later on this deleted class. It crashes at this line here, trying to dereference 0xfeeefeee:
pActiveColumnList = *m_pActiveColumnList;
Timing is important and its tricky to debug until you have a reproducible way to catch it. I opened lots of folders then quickly closed them in reverse order.

[twinsen]

Fixed it. I simply made queue calls increment the reference count, to keep it alive for when the thread accesses its data, which then decrements it and deletes it if no references are left.
I'm glad the fix was so simple. This crash was really annoying me.

[ajs]

Fixed it. I simply made queue calls increment the reference count, to keep it alive for when the thread accesses its data, which then decrements it and deletes it if no references are left.
I'm glad the fix was so simple. This crash was really annoying me.

Thanks ryan. Can you make up a patch for it?

[twinsen]

Patch for revision 204:

ColumnManagerAccessDeletedFolderView_Fix_v204.7z

(865 Bytes) Downloaded 550 times