[Bug 18114] New: rpcrt4.NdrDllCanUnloadNow: COM proxy/stub factory reference count eval incorrect (crashes Visual Studio 2005 on exit)

http://bugs.winehq.org/show_bug.cgi?id=18114

Summary: rpcrt4.NdrDllCanUnloadNow: COM proxy/stub factory
                    reference count eval incorrect (crashes Visual Studio
                    2005 on exit)
           Product: Wine
           Version: 1.1.19
          Platform: Other
               URL: http://download.microsoft.com/download/3/f/4/3f435aaa-
                    49ce-44c3-a2cc-d40bca9af941/ENU/vcssetup.exe
        OS/Version: other
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: -unknown
        AssignedTo: [e-mail]
        ReportedBy: [e-mail]

Hello,

a user reported multiple issues in bug 18106
I picked out the interesting one because it's actually a long-timer - present
since the component exists - 2002 ;-)

--- quote ---
When exiting Visual C#, after the UI is
closed, an error dialog pops up telling me "Microsoft Visual C# has encountered
a problem and needs to close." I uncheck restart and click Don't Send. I've
also attached a screenshot.
--- quote ---

WINEDEBUG=+tid,+seh,+ole trace gives:

--- snip ---
0009:fixme:shell:DllCanUnloadNow stub
0009:trace:ole:COMPOBJ_DllList_ReleaseRef freeing 0x51bc0000
0009:trace:ole:OleUninitialize ()
0009:trace:ole:CoUninitialize ()
0009:trace:ole:OleUninitialize ()
0009:trace:ole:OleUninitialize () - Freeing the last reference count
0009:trace:ole:OLEClipbrd_UnInitialize ()
0009:trace:ole:CoUninitialize ()
0009:trace:ole:apartment_release 800000009: after = 0
0009:trace:ole:apartment_release destroying apartment 0x134d38, oxid 800000009
0009:trace:ole:stub_manager_int_release after 0
0009:trace:ole:stub_manager_delete destroying 0xd7ff20 (oid=2)
0009:trace:ole:stub_manager_delete_ifstub m=0xd7ff20, m->oid=2,
ipid={00000003-0009-0008-aca8-b13a1ed334ff}
0009:trace:ole:stub_manager_delete_ifstub  ifstub->stubbuffer = 0xf7f7e8
0009:trace:ole:NdrCStdStubBuffer_Release (0xf7f7e8)->Release()
0009:trace:ole:CStdStubBuffer_Disconnect (0xf7f7e8)->Disconnect()
0009:trace:ole:CStdPSFactory_Release (0x62510954)->Release()
0009:trace:ole:stub_manager_delete_ifstub  ifstub->iface = 0x8812d8
0009:trace:ole:stub_manager_delete_ifstub  ifstub->chan = 0xf7f848
0009:trace:ole:stub_manager_delete_ifstub  ifstub = 0xf7f808
0009:trace:ole:stub_manager_delete_ifstub m=0xd7ff20, m->oid=2,
ipid={00000001-0009-0008-a2a7-955c363af248}
0009:trace:ole:stub_manager_delete_ifstub  ifstub->stubbuffer = 0xd7ff00
0009:trace:seh:raise_exception code=c0000005 flags=0 addr=0x7075735f
ip=0x7075735f tid=0009
0009:trace:seh:raise_exception  info[0]=00000000
0009:trace:seh:raise_exception  info[1]=7075735f
0009:trace:seh:raise_exception  eax=00d7ff00 ebx=605dca7c ecx=00000000
edx=7075735f esi=7bcb81d9 edi=00000000
0009:trace:seh:raise_exception  ebp=0032fa18 esp=0032f9bc cs=0023 ds=002b
es=002b fs=0063 gs=006b flags=00010206
0009:trace:seh:call_vectored_handlers calling handler at 0x60a16e2a
code=c0000005 flags=0
0009:trace:seh:call_vectored_handlers handler at 0x60a16e2a returned 0
0009:trace:seh:call_vectored_handlers calling handler at 0x7b8408f7
code=c0000005 flags=0
0009:trace:seh:call_vectored_handlers handler at 0x7b8408f7 returned 0
0009:trace:seh:call_vectored_handlers calling handler at 0x40f744 code=c0000005
flags=0
0009:trace:seh:call_vectored_handlers handler at 0x40f744 returned 0
0009:trace:seh:call_stack_handlers calling handler at 0x412615 code=c0000005
flags=0
--- snip ---

Culprit:

--- snip ---
if (ifstub->stubbuffer) IUnknown_Release(ifstub->stubbuffer);
--- snip ---

Disassembly with annotations:

--- snip ---

0x60525f42 stub_manager_delete_ifstub+0x106
[/opt/wine/wine-git/dlls/ole32/stubmanager.c:562] in ole32: movl   
0xc(%ebp),%eax ; ifstub
0x60525f45 stub_manager_delete_ifstub+0x109
[/opt/wine/wine-git/dlls/ole32/stubmanager.c:562] in ole32: movl   
0x8(%eax),%eax ; ifstub->stubbuffer
0x60525f48 stub_manager_delete_ifstub+0x10c
[/opt/wine/wine-git/dlls/ole32/stubmanager.c:562] in ole32: movl   
0x0(%eax),%eax ; IRpcStubBufferVtbl* lpVtbl: eax = garbage
0x60525f4a stub_manager_delete_ifstub+0x10e
[/opt/wine/wine-git/dlls/ole32/stubmanager.c:562] in ole32: movl   
0x8(%eax),%edx
0x60525f4d stub_manager_delete_ifstub+0x111
[/opt/wine/wine-git/dlls/ole32/stubmanager.c:562] in ole32: movl   
0xc(%ebp),%eax
0x60525f50 stub_manager_delete_ifstub+0x114
[/opt/wine/wine-git/dlls/ole32/stubmanager.c:562] in ole32: movl   
0x8(%eax),%eax
0x60525f53 stub_manager_delete_ifstub+0x117
[/opt/wine/wine-git/dlls/ole32/stubmanager.c:562] in ole32: movl   
%eax,0x0(%esp)
0x60525f56 stub_manager_delete_ifstub+0x11a
[/opt/wine/wine-git/dlls/ole32/stubmanager.c:562] in ole32: call    *%edx
--- snip ---

The vtable address is actually invalid at this point (no backed by committed
memory/module).

By tracking all proxy stub (factory) creations one comes across this:

--- snip ---
...
0009:Call KERNEL32.LoadLibraryExW(00327f9e
L"C:\windows\system32\actxprxy.dll",00000000,00000008) ret=603a1373
0009:trace:loaddll:load_builtin_dll Loaded
L"C:\windows\system32\actxprxy.dll" at 0x60ba0000: builtin
0009:Call PE DLL (proc=0x60ba3824,module=0x60ba0000
L"actxprxy.dll",reason=PROCESS_ATTACH,res=(nil))
0009:Call KERNEL32.DisableThreadLibraryCalls(60ba0000) ret=60ba378f
0009:Ret  KERNEL32.DisableThreadLibraryCalls() retval=00000001 ret=60ba378f
0009:Ret  PE DLL (proc=0x60ba3824,module=0x60ba0000
L"actxprxy.dll",reason=PROCESS_ATTACH,res=(nil)) retval=1
0009:Ret  KERNEL32.LoadLibraryExW() retval=60ba0000 ret=603a1373
0009:Call KERNEL32.GetProcAddress(60ba0000,6046cc19 "DllCanUnloadNow")
ret=603a13f8
0009:Ret  KERNEL32.GetProcAddress() retval=60ba281c ret=603a13f8
0009:Call KERNEL32.GetProcAddress(60ba0000,6046cc29 "DllGetClassObject")
ret=603a1413
0009:Ret  KERNEL32.GetProcAddress() retval=60ba2834 ret=603a1413
0009:Call KERNEL32.GetProcessHeap() ret=603a14e3
0009:Ret  KERNEL32.GetProcessHeap() retval=00110000 ret=603a14e3
0009:Call ntdll.RtlAllocateHeap(00110000,00000000,0000001c) ret=603a14fb
0009:Ret  ntdll.RtlAllocateHeap() retval=00d93eb8 ret=603a14fb
0009:Call KERNEL32.GetProcessHeap() ret=603a1516
0009:Ret  KERNEL32.GetProcessHeap() retval=00110000 ret=603a1516
0009:Call ntdll.RtlAllocateHeap(00110000,00000000,00000042) ret=603a152a
0009:Ret  ntdll.RtlAllocateHeap() retval=00d93d78 ret=603a152a
0009:trace:ole:apartment_getclassobject added new loaded dll
L"C:\windows\system32\actxprxy.dll"
0009:trace:ole:apartment_getclassobject calling DllGetClassObject 0x60ba2834
0009:Call actxprxy.DllGetClassObject(0032829c,6047b9d4,003282dc) ret=603a10ad
0009:Call
rpcrt4.NdrDllGetClassObject(0032829c,6047b9d4,003282dc,60ba4944,60ba3af0,60ba4954)
ret=60ba3709
0009:trace:ole:NdrDllGetClassObject ({b8da6310-e19b-11d0-933c-00a0c90dcaa9},
{d5f569d0-593b-101a-b569-08002b2dbf7a}, 0x3282dc, 0x60ba4944,
{b8da6310-e19b-11d0-933c-00a0c90dcaa9}, 0x60ba4954)
0009:trace:ole:CStdPSFactory_QueryInterface
(0x60ba4954)->QueryInterface({d5f569d0-593b-101a-b569-08002b2dbf7a},0x3282dc)
0009:Call KERNEL32.InterlockedIncrement(60ba4958) ret=604a5e76
0009:Ret  KERNEL32.InterlockedIncrement() retval=00000001 ret=604a5e76
0009:Ret  rpcrt4.NdrDllGetClassObject() retval=00000000 ret=60ba3709
0009:Ret  actxprxy.DllGetClassObject() retval=00000000 ret=603a10ad 
...
0009:trace:ole:CStdPSFactory_CreateStub
(0x60ba4954)->CreateStub({6d5140c1-7436-11ce-8034-00aa006009fa},0x8812d8,0x3282e4)
0009:trace:ole:FindProxyInfo found: ProxyInfo 0x60ba4060 Index 0
0009:trace:ole:CStdStubBuffer_Construct
(0x8812d8,0x60ba40c0,0x60ba4954,0x3282e4) IServiceProvider
0009:trace:ole:CStdStubBuffer_Construct
iid={6d5140c1-7436-11ce-8034-00aa006009fa}
0009:trace:ole:CStdStubBuffer_Construct vtbl=0x60ba40d0 
...
0009:trace:ole:new_stub_manager Created new stub manager (oid=2) at 0xd93de8
for object with IUnknown 0x8812d8
0009:trace:ole:stub_manager_new_ifstub oid=2, stubbuffer=0xd93dc8,
iptr=0x8812d8, iid={6d5140c1-7436-11ce-8034-00aa006009fa} 
...
0009:trace:ole:stub_manager_new_ifstub ifstub 0xd94000 created with ipid
{00000001-0009-0008-86bb-a932497ebe65} 
--- snip ---

and then:

--- snip ---
0009:Call ole32.CoFreeUnusedLibraries() ret=501b8b3f 
...
0009:Call KERNEL32.FreeLibrary(54cf0000) ret=50f22b97
...
0009:trace:loaddll:free_modref Unloaded module L"C:\Program Files\Microsoft
Visual Studio 8\Common7\Packages\Debugger\encmgr.dll" : native
0009:Ret  KERNEL32.FreeLibrary() retval=00000001 ret=50f22b97 
...
0009:Call shell32.DllCanUnloadNow() ret=603a11df
0009:fixme:shell:DllCanUnloadNow stub
0009:Ret  shell32.DllCanUnloadNow() retval=00000001 ret=603a11df
0009:Call actxprxy.DllCanUnloadNow() ret=603a11df
0009:Call rpcrt4.NdrDllCanUnloadNow(60ba4954) ret=60ba3733
0009:Ret  rpcrt4.NdrDllCanUnloadNow() retval=00000000 ret=60ba3733
0009:Ret  actxprxy.DllCanUnloadNow() retval=00000000 ret=603a11df
0009:Call KERNEL32.InterlockedDecrement(00d93eb8) ret=603a16c2
0009:Ret  KERNEL32.InterlockedDecrement() retval=00000000 ret=603a16c2
0009:trace:ole:COMPOBJ_DllList_ReleaseRef freeing 0x60ba0000
0009:Call KERNEL32.FreeLibrary(60ba0000) ret=603a1768
0009:Call PE DLL (proc=0x60ba3824,module=0x60ba0000
L"actxprxy.dll",reason=PROCESS_DETACH,res=(nil))
0009:Ret  PE DLL (proc=0x60ba3824,module=0x60ba0000
L"actxprxy.dll",reason=PROCESS_DETACH,res=(nil)) retval=1
0009:trace:loaddll:free_modref Unloaded module
L"C:\windows\system32\actxprxy.dll" : builtin
0009:Ret  KERNEL32.FreeLibrary() retval=00000001 ret=603a1768
...
--- snip ---

The proxy stub dll which provides IServiceProvider was unloaded at some point
(CoFreeUnusedLibraries) - while the stub buffer iface was still in use.
When the application exited, the release of proxy stub buffer iface failed
because the vtable was no longer backed by a module.

By looking up default proxy stub dll reference count management one comes
across the following snippet:

--- snip ---
HRESULT WINAPI NdrDllCanUnloadNow(CStdPSFactoryBuffer *pPSFactoryBuffer)
{
  return !(pPSFactoryBuffer->RefCount);
}
--- snip ---

Can you spot the error? ;-)
Still perplexed that this one slipped through for so long time ...

After fixing the bug, Visual Studio 2005 cleanly exits (already verified).

Regards

[Bug 18114] rpcrt4.NdrDllCanUnloadNow: COM proxy/stub factory reference count eval incorrect (crashes Visual Studio 2005 on exit)

http://bugs.winehq.org/show_bug.cgi?id=18114

Nicholas Doyle  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

[Bug 18114] rpcrt4.NdrDllCanUnloadNow: COM proxy/stub factory reference count eval incorrect (crashes Visual Studio 2005 on exit)

http://bugs.winehq.org/show_bug.cgi?id=18114

Paul Vriens  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #1 from Paul Vriens   2009-04-20 05:01:44 ---
Sent patch:

http://www.winehq.org/pipermail/wine-patches/2009-April/072033.html

[Bug 18114] rpcrt4.NdrDllCanUnloadNow: COM proxy/stub factory reference count eval incorrect (crashes Visual Studio 2005 on exit)

http://bugs.winehq.org/show_bug.cgi?id=18114

Anastasius Focht  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|                            |FIXED

--- Comment #2 from Anastasius Focht   2009-04-20 13:22:27 ---
Hello,

thanks, fixed by commit 90d3163aba26936d5dfa4801659e744a0134916f

Regards

[Bug 18114] rpcrt4.NdrDllCanUnloadNow: COM proxy/stub factory reference count eval incorrect (crashes Visual Studio 2005 on exit)

http://bugs.winehq.org/show_bug.cgi?id=18114

Alexandre Julliard  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #3 from Alexandre Julliard   2009-04-24 12:23:28 ---
Closing bugs fixed in 1.1.20.

[Bug 18114] rpcrt4.NdrDllCanUnloadNow: COM proxy/stub factory reference count eval incorrect (crashes Visual Studio 2005 on exit)

http://bugs.winehq.org/show_bug.cgi?id=18114

Anastasius Focht  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |download
      Fixed by SHA1|                            |90d3163aba26936d5dfa4801659
                   |                            |e744a0134916f
          Component|-unknown                    |rpc

--- Comment #4 from Anastasius Focht  2011-10-11 15:31:52 CDT ---
Hello,

filling/correcting fields ...

Regards

[Bug 18114] rpcrt4.NdrDllCanUnloadNow: COM proxy/stub factory reference count eval incorrect (crashes Visual Studio 2005 on exit)

http://bugs.winehq.org/show_bug.cgi?id=18114

Anastasius Focht  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
           Hardware|Other                       |x86
                 OS|other                       |Linux

[Bug 18114] rpcrt4.NdrDllCanUnloadNow: COM proxy/stub factory reference count eval incorrect (crashes Visual Studio 2005 on exit)

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=18114

Anastasius Focht  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                URL|http://download.microsoft.c |https://web.archive.org/web
                   |om/download/3/f/4/3f435aaa- |/20190127082540/http://down
                   |49ce-44c3-a2cc-d40bca9af941 |load.microsoft.com/download
                   |/ENU/vcssetup.exe           |/A/9/1/A91D6B2B-A798-47DF-9
                   |                            |C7E-A97854B7DD18/VC.iso