starred/terminal
1
0
Fork 0
mirror of https://github.com/microsoft/terminal.git synced 2026-02-04 05:35:20 +00:00
Code Issues 19.0k Packages Projects Releases 20 Wiki Activity

Crash in conhost!til::manage_vector<Microsoft::Console::Render::Cluster> when resizing quickly from left to right #10780

New Issue
Open
opened 2026-01-31 02:30:08 +00:00 by claunia · 0 comments
claunia commented 2026-01-31 02:30:08 +00:00
Owner
Copy Link

Originally created by @Treit on GitHub (Sep 26, 2020).

Environment

Windows build 10.0.20221.0

Steps to reproduce

  1. Open cmd.exe from Start | Run
  2. Click the left-hand edge so that you can resize the window.
  3. Resize from left-to-right as quickly as possible.

Expected behavior

No crash.

Actual behavior

(410c.aabc): Security check failure or stack buffer overrun - code c0000409 (!!! second chance !!!)
Subcode: 0x7 FAST_FAIL_FATAL_APP_EXIT 
ucrtbase!abort+0x4e:
0:004> kL
 # Child-SP          RetAddr               Call Site
00 000000b8`c97fc520 00007ffe`d866c2b9     ucrtbase!abort+0x4e
01 000000b8`c97fc550 00007ffe`d8657dff     ucrtbase!terminate+0x29
02 000000b8`c97fc580 00007ff6`ac66159a     ucrtbase!__crt_state_management::wrapped_invoke<void (__cdecl*)(void) noexcept,void>+0xf
03 000000b8`c97fc5b0 00007ffe`d887492d     conhost!__scrt_unhandled_exception_filter+0x5a
04 000000b8`c97fc5e0 00007ffe`dadc2052     KERNELBASE!UnhandledExceptionFilter+0x1bd
05 (Inline Function) --------`--------     ntdll!RtlpThreadExceptionFilter+0x80
06 000000b8`c97fc700 00007ffe`dad93130     ntdll!LdrpLogFatalUserCallbackException+0xa2
07 000000b8`c97fc840 00007ffe`dad9471f     ntdll!KiUserCallbackDispatcherHandler+0x20
08 000000b8`c97fc880 00007ffe`dad4d35b     ntdll!RtlpExecuteHandlerForException+0xf
09 000000b8`c97fc8b0 00007ffe`dad4d0ae     ntdll!RtlDispatchException+0x25b
0a 000000b8`c97fcff0 00007ffe`d8803c8c     ntdll!RtlRaiseException+0x15e
0b 000000b8`c97fde90 00007ffe`d863200a     KERNELBASE!RaiseException+0x6c
0c 000000b8`c97fdf70 00007ffe`d8373d3d     ucrtbase!_CxxThrowException+0x9a
0d 000000b8`c97fdfd0 00007ff6`ac670a5c     msvcp_win!std::_Xlength_error+0x4d
0e (Inline Function) --------`--------     conhost!std::vector<Microsoft::Console::Render::Cluster,std::allocator<Microsoft::Console::Render::Cluster> >::_Xlength+0xe
0f (Inline Function) --------`--------     conhost!std::vector<Microsoft::Console::Render::Cluster,std::allocator<Microsoft::Console::Render::Cluster> >::reserve+0x27543
10 000000b8`c97fe030 00007ff6`ac64941e     conhost!til::manage_vector<Microsoft::Console::Render::Cluster>+0x27580
11 000000b8`c97fe080 00007ff6`ac64ac2e     conhost!Microsoft::Console::Render::Renderer::_CheckViewportAndScroll+0x13e
12 000000b8`c97fe0e0 00007ff6`ac64492d     conhost!Microsoft::Console::Render::Renderer::TriggerScroll+0xe
13 000000b8`c97fe110 00007ff6`ac66cba0     conhost!Microsoft::Console::Interactivity::Win32::Window::ChangeViewport+0x16d
14 000000b8`c97fe160 00007ff6`ac697d6f     conhost!SCREEN_INFORMATION::SetViewportOrigin+0x29220
15 000000b8`c97fe190 00007ff6`ac697b0d     conhost!SCREEN_INFORMATION::ResizeWithReflow+0x133
16 000000b8`c97fe210 00007ff6`ac698d04     conhost!SCREEN_INFORMATION::ResizeScreenBuffer+0xbd
17 000000b8`c97fe270 00007ff6`ac697447     conhost!SCREEN_INFORMATION::_AdjustScreenBuffer+0x188
18 000000b8`c97fe2c0 00007ff6`ac67320e     conhost!SCREEN_INFORMATION::ProcessResizeWindow+0x5b
19 000000b8`c97fe300 00007ff6`ac64d586     conhost!Microsoft::Console::Interactivity::Win32::Window::_HandleWindowPosChanged+0x237de
1a 000000b8`c97fe360 00007ff6`ac64d0b3     conhost!Microsoft::Console::Interactivity::Win32::Window::ConsoleWindowProc+0x486
1b 000000b8`c97fe4c0 00007ffe`d90d0099     conhost!Microsoft::Console::Interactivity::Win32::Window::s_ConsoleWindowProc+0x53
1c 000000b8`c97fe500 00007ffe`d90cfc0c     user32!UserCallWinProcCheckWow+0x319
1d 000000b8`c97fe690 00007ffe`d90e7c7a     user32!DispatchClientMessage+0x9c
1e 000000b8`c97fe6f0 00007ffe`dad931c4     user32!__fnINLPWINDOWPOS+0x3a
1f 000000b8`c97fe750 00007ffe`d83e1124     ntdll!KiUserCallbackDispatcherContinue
20 000000b8`c97fe7f8 00007ffe`d90cd24b     win32u!ZwUserMessageCall+0x14
21 000000b8`c97fe800 00007ffe`d90ccdef     user32!RealDefWindowProcWorker+0xeb
22 000000b8`c97fe8e0 00007ffe`d5d574bc     user32!RealDefWindowProcW+0x4f
23 000000b8`c97fe920 00007ffe`d5d78482     uxtheme!DoMsgDefault+0x38
24 000000b8`c97fe960 00007ffe`d5d5bb09     uxtheme!OnDwpSysCommand+0x32
25 000000b8`c97fe990 00007ffe`d5d5b561     uxtheme!_ThemeDefWindowProc+0x599
26 000000b8`c97feb00 00007ffe`d90cd006     uxtheme!ThemeDefWindowProcW+0x11
27 000000b8`c97feb40 00007ff6`ac64d251     user32!DefWindowProcW+0x1d6
28 000000b8`c97febb0 00007ff6`ac64d0b3     conhost!Microsoft::Console::Interactivity::Win32::Window::ConsoleWindowProc+0x151
29 000000b8`c97fed10 00007ffe`d90d0099     conhost!Microsoft::Console::Interactivity::Win32::Window::s_ConsoleWindowProc+0x53
2a 000000b8`c97fed50 00007ffe`d90cfc0c     user32!UserCallWinProcCheckWow+0x319
2b 000000b8`c97feee0 00007ffe`d90e5f9d     user32!DispatchClientMessage+0x9c
2c 000000b8`c97fef40 00007ffe`dad931c4     user32!__fnDWORD+0x3d
2d 000000b8`c97fefa0 00007ffe`d83e1124     ntdll!KiUserCallbackDispatcherContinue
2e 000000b8`c97ff028 00007ffe`d90cd24b     win32u!ZwUserMessageCall+0x14
2f 000000b8`c97ff030 00007ffe`d90ccdef     user32!RealDefWindowProcWorker+0xeb
30 000000b8`c97ff110 00007ffe`d5d574bc     user32!RealDefWindowProcW+0x4f
31 000000b8`c97ff150 00007ffe`d5d783d7     uxtheme!DoMsgDefault+0x38
32 000000b8`c97ff190 00007ffe`d5d5bb09     uxtheme!OnDwpNcLButtonDown+0xa7
33 000000b8`c97ff1d0 00007ffe`d5d5b561     uxtheme!_ThemeDefWindowProc+0x599
34 000000b8`c97ff340 00007ffe`d90cd006     uxtheme!ThemeDefWindowProcW+0x11
35 000000b8`c97ff380 00007ff6`ac64d251     user32!DefWindowProcW+0x1d6
36 000000b8`c97ff3f0 00007ff6`ac64d0b3     conhost!Microsoft::Console::Interactivity::Win32::Window::ConsoleWindowProc+0x151
37 000000b8`c97ff550 00007ffe`d90d0099     conhost!Microsoft::Console::Interactivity::Win32::Window::s_ConsoleWindowProc+0x53
38 000000b8`c97ff590 00007ffe`d90cfa12     user32!UserCallWinProcCheckWow+0x319
39 000000b8`c97ff720 00007ff6`ac657857     user32!DispatchMessageWorker+0x1d2
3a 000000b8`c97ff7a0 00007ffe`d97d4c5e     conhost!ConsoleInputThreadProcWin32+0xe7
3b 000000b8`c97ff800 00007ffe`dad4f3eb     KERNEL32!BaseThreadInitThunk+0x1e
3c 000000b8`c97ff830 00000000`00000000     ntdll!RtlUserThreadStart+0x2b
Originally created by @Treit on GitHub (Sep 26, 2020). # Environment Windows build 10.0.20221.0 # Steps to reproduce 1. Open cmd.exe from Start | Run 2. Click the left-hand edge so that you can resize the window. 3. Resize from left-to-right as quickly as possible. # Expected behavior No crash. # Actual behavior ``` (410c.aabc): Security check failure or stack buffer overrun - code c0000409 (!!! second chance !!!) Subcode: 0x7 FAST_FAIL_FATAL_APP_EXIT ucrtbase!abort+0x4e: 0:004> kL # Child-SP RetAddr Call Site 00 000000b8`c97fc520 00007ffe`d866c2b9 ucrtbase!abort+0x4e 01 000000b8`c97fc550 00007ffe`d8657dff ucrtbase!terminate+0x29 02 000000b8`c97fc580 00007ff6`ac66159a ucrtbase!__crt_state_management::wrapped_invoke<void (__cdecl*)(void) noexcept,void>+0xf 03 000000b8`c97fc5b0 00007ffe`d887492d conhost!__scrt_unhandled_exception_filter+0x5a 04 000000b8`c97fc5e0 00007ffe`dadc2052 KERNELBASE!UnhandledExceptionFilter+0x1bd 05 (Inline Function) --------`-------- ntdll!RtlpThreadExceptionFilter+0x80 06 000000b8`c97fc700 00007ffe`dad93130 ntdll!LdrpLogFatalUserCallbackException+0xa2 07 000000b8`c97fc840 00007ffe`dad9471f ntdll!KiUserCallbackDispatcherHandler+0x20 08 000000b8`c97fc880 00007ffe`dad4d35b ntdll!RtlpExecuteHandlerForException+0xf 09 000000b8`c97fc8b0 00007ffe`dad4d0ae ntdll!RtlDispatchException+0x25b 0a 000000b8`c97fcff0 00007ffe`d8803c8c ntdll!RtlRaiseException+0x15e 0b 000000b8`c97fde90 00007ffe`d863200a KERNELBASE!RaiseException+0x6c 0c 000000b8`c97fdf70 00007ffe`d8373d3d ucrtbase!_CxxThrowException+0x9a 0d 000000b8`c97fdfd0 00007ff6`ac670a5c msvcp_win!std::_Xlength_error+0x4d 0e (Inline Function) --------`-------- conhost!std::vector<Microsoft::Console::Render::Cluster,std::allocator<Microsoft::Console::Render::Cluster> >::_Xlength+0xe 0f (Inline Function) --------`-------- conhost!std::vector<Microsoft::Console::Render::Cluster,std::allocator<Microsoft::Console::Render::Cluster> >::reserve+0x27543 10 000000b8`c97fe030 00007ff6`ac64941e conhost!til::manage_vector<Microsoft::Console::Render::Cluster>+0x27580 11 000000b8`c97fe080 00007ff6`ac64ac2e conhost!Microsoft::Console::Render::Renderer::_CheckViewportAndScroll+0x13e 12 000000b8`c97fe0e0 00007ff6`ac64492d conhost!Microsoft::Console::Render::Renderer::TriggerScroll+0xe 13 000000b8`c97fe110 00007ff6`ac66cba0 conhost!Microsoft::Console::Interactivity::Win32::Window::ChangeViewport+0x16d 14 000000b8`c97fe160 00007ff6`ac697d6f conhost!SCREEN_INFORMATION::SetViewportOrigin+0x29220 15 000000b8`c97fe190 00007ff6`ac697b0d conhost!SCREEN_INFORMATION::ResizeWithReflow+0x133 16 000000b8`c97fe210 00007ff6`ac698d04 conhost!SCREEN_INFORMATION::ResizeScreenBuffer+0xbd 17 000000b8`c97fe270 00007ff6`ac697447 conhost!SCREEN_INFORMATION::_AdjustScreenBuffer+0x188 18 000000b8`c97fe2c0 00007ff6`ac67320e conhost!SCREEN_INFORMATION::ProcessResizeWindow+0x5b 19 000000b8`c97fe300 00007ff6`ac64d586 conhost!Microsoft::Console::Interactivity::Win32::Window::_HandleWindowPosChanged+0x237de 1a 000000b8`c97fe360 00007ff6`ac64d0b3 conhost!Microsoft::Console::Interactivity::Win32::Window::ConsoleWindowProc+0x486 1b 000000b8`c97fe4c0 00007ffe`d90d0099 conhost!Microsoft::Console::Interactivity::Win32::Window::s_ConsoleWindowProc+0x53 1c 000000b8`c97fe500 00007ffe`d90cfc0c user32!UserCallWinProcCheckWow+0x319 1d 000000b8`c97fe690 00007ffe`d90e7c7a user32!DispatchClientMessage+0x9c 1e 000000b8`c97fe6f0 00007ffe`dad931c4 user32!__fnINLPWINDOWPOS+0x3a 1f 000000b8`c97fe750 00007ffe`d83e1124 ntdll!KiUserCallbackDispatcherContinue 20 000000b8`c97fe7f8 00007ffe`d90cd24b win32u!ZwUserMessageCall+0x14 21 000000b8`c97fe800 00007ffe`d90ccdef user32!RealDefWindowProcWorker+0xeb 22 000000b8`c97fe8e0 00007ffe`d5d574bc user32!RealDefWindowProcW+0x4f 23 000000b8`c97fe920 00007ffe`d5d78482 uxtheme!DoMsgDefault+0x38 24 000000b8`c97fe960 00007ffe`d5d5bb09 uxtheme!OnDwpSysCommand+0x32 25 000000b8`c97fe990 00007ffe`d5d5b561 uxtheme!_ThemeDefWindowProc+0x599 26 000000b8`c97feb00 00007ffe`d90cd006 uxtheme!ThemeDefWindowProcW+0x11 27 000000b8`c97feb40 00007ff6`ac64d251 user32!DefWindowProcW+0x1d6 28 000000b8`c97febb0 00007ff6`ac64d0b3 conhost!Microsoft::Console::Interactivity::Win32::Window::ConsoleWindowProc+0x151 29 000000b8`c97fed10 00007ffe`d90d0099 conhost!Microsoft::Console::Interactivity::Win32::Window::s_ConsoleWindowProc+0x53 2a 000000b8`c97fed50 00007ffe`d90cfc0c user32!UserCallWinProcCheckWow+0x319 2b 000000b8`c97feee0 00007ffe`d90e5f9d user32!DispatchClientMessage+0x9c 2c 000000b8`c97fef40 00007ffe`dad931c4 user32!__fnDWORD+0x3d 2d 000000b8`c97fefa0 00007ffe`d83e1124 ntdll!KiUserCallbackDispatcherContinue 2e 000000b8`c97ff028 00007ffe`d90cd24b win32u!ZwUserMessageCall+0x14 2f 000000b8`c97ff030 00007ffe`d90ccdef user32!RealDefWindowProcWorker+0xeb 30 000000b8`c97ff110 00007ffe`d5d574bc user32!RealDefWindowProcW+0x4f 31 000000b8`c97ff150 00007ffe`d5d783d7 uxtheme!DoMsgDefault+0x38 32 000000b8`c97ff190 00007ffe`d5d5bb09 uxtheme!OnDwpNcLButtonDown+0xa7 33 000000b8`c97ff1d0 00007ffe`d5d5b561 uxtheme!_ThemeDefWindowProc+0x599 34 000000b8`c97ff340 00007ffe`d90cd006 uxtheme!ThemeDefWindowProcW+0x11 35 000000b8`c97ff380 00007ff6`ac64d251 user32!DefWindowProcW+0x1d6 36 000000b8`c97ff3f0 00007ff6`ac64d0b3 conhost!Microsoft::Console::Interactivity::Win32::Window::ConsoleWindowProc+0x151 37 000000b8`c97ff550 00007ffe`d90d0099 conhost!Microsoft::Console::Interactivity::Win32::Window::s_ConsoleWindowProc+0x53 38 000000b8`c97ff590 00007ffe`d90cfa12 user32!UserCallWinProcCheckWow+0x319 39 000000b8`c97ff720 00007ff6`ac657857 user32!DispatchMessageWorker+0x1d2 3a 000000b8`c97ff7a0 00007ffe`d97d4c5e conhost!ConsoleInputThreadProcWin32+0xe7 3b 000000b8`c97ff800 00007ffe`dad4f3eb KERNEL32!BaseThreadInitThunk+0x1e 3c 000000b8`c97ff830 00000000`00000000 ntdll!RtlUserThreadStart+0x2b ```
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
⛺ Reserved
A11yCO
A11yMAS
A11ySev1
A11ySev2
A11ySev3
A11yTTValidated
A11yUsable
A11yVoiceAccess
A11yWCAG
Area-Accessibility
Area-AtlasEngine
Area-AzureShell
Area-Build
Area-Build
Area-Chat
Area-CmdPal
Area-CodeHealth
Area-Commandline
Area-CookedRead
Area-DefApp
Area-Extensibility
Area-Fonts
Area-GroupPolicy
Area-i18n
Area-Input
Area-Interaction
Area-Interop
Area-Localization
Area-Output
Area-Performance
Area-Portable
Area-Quality
Area-Remoting
Area-Rendering
Area-Schema
Area-Server
Area-Settings
Area-SettingsUI
Area-ShellExtension
Area-ShellExtension
Area-ShellExtension
Area-Suggestions
Area-Suggestions
Area-TerminalConnection
Area-TerminalControl
Area-Theming
Area-UserInterface
Area-VT
Area-Windowing
Area-WPFControl
AutoMerge
Blocking-Ingestion
Culprit-Centennial
Culprit-WinUI
Disability-All
Disability-Blind
Disability-LowVision
Disability-Mobility
External-Blocked-WinUI3
Fixed
Gathering-Data
good first issue
HCL-E+D
HCL-WindowsTerminal
Help Wanted
Impact-Compatibility
Impact-Compliance
Impact-Correctness
Impact-Visual
In-PR
InclusionBacklog
InclusionBacklog-Windows TerminalWin32
InclusionCommitted-202206
Issue-Bug
Issue-Docs
Issue-Feature
Issue-Feature
Issue-Question
Issue-Samples
Issue-Scenario
Issue-Task
Needs-Attention
Needs-Author-Feedback
Needs-Bisect
Needs-Discussion
Needs-Repro
Needs-Tag-Fix
Needs-Tag-Fix
Needs-Triage
No-Recent-Activity
Priority-0
Priority-1
Priority-2
Priority-3
Product-Cmd.exe
Product-Colortool
Product-Colortool
Product-Colortool
Product-Conhost
Product-Conpty
Product-Meta
Product-Powershell
Product-Terminal
Product-WSL
pull-request
Mirrored from GitHub Pull Request
 Resolution-Answered
Resolution-By-Design
Resolution-Duplicate
Resolution-External
Resolution-Fix-Available
Resolution-Fix-Committed
Resolution-No-Repro
Resolution-Won't-Fix
Severity-Blocking
Severity-Crash
Severity-DataLoss
spam
this-will-be-a-breaking-change
Tracking-External
WindowsTerminal_Win32
Work-Item
zAskModeBug
zInbox-Bug
No Label Area-Output Help Wanted Issue-Bug Needs-Tag-Fix Priority-0 Product-Conhost Resolution-Fix-Committed Severity-Crash
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
claunia
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/terminal#10780
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?