Crash if creating a new tab when the window height is too small #3951

Closed
opened 2026-01-30 23:34:06 +00:00 by claunia · 5 comments
Owner

Originally created by @dsafa on GitHub (Sep 20, 2019).

Environment

Windows build number: 10.0.18362.0
Windows Terminal version (if applicable): master

Any other software?

Steps to reproduce

  1. Minimize the height of Terminal. Doesn't even have to be fully minimized.
  2. Create a new tab

WindowsTerminal_cY56ao4860

Expected behavior

A new tab is created

Actual behavior

Terminal crashes

Details
Terminal crashes with the exception Unhandled exception at 0x00007FF8AB012830 (Windows.UI.Xaml.dll) in WindowsTerminal.exe: 0xC000027B: An application-internal exception has occurred (parameters: 0x0000027E170823C0, 0x0000000000000002).

This should be the actual error.

E:\Code\terminal\src\renderer\dx\DxRenderer.cpp(247)\TerminalControl.dll!00007FF835C818E6: (caller: 00007FF835C7CBCB) ReturnHr(1) tid(2944) 887A0001 The application made a call that is invalid. Either the parameters of the call or the state of some object was incorrect.
Enable the D3D debug layer in order to see details via debug messages.
    [Microsoft::Console::Render::DxEngine::_CreateDeviceResources(_dxgiFactory2->CreateSwapChainForComposition(_d3dDevice.Get(), &SwapChainDesc, nullptr, &_dxgiSwapChain))]
// src\renderer\dx\DxRenderer.cpp(L233-249)
case SwapChainMode::ForComposition:
{
	SwapChainDesc.Width = _displaySizePixels.cx;
	SwapChainDesc.Height = _displaySizePixels.cy;
	
	// omitted

-->	RETURN_IF_FAILED(_dxgiFactory2->CreateSwapChainForComposition(_d3dDevice.Get(),
																  &SwapChainDesc,
																  nullptr,
																  &_dxgiSwapChain));
	break;
}

Height is 0 which I assume is an invalid parameter.

Originally created by @dsafa on GitHub (Sep 20, 2019). <!-- 🚨🚨🚨🚨🚨🚨🚨🚨🚨🚨 I ACKNOWLEDGE THE FOLLOWING BEFORE PROCEEDING: 1. If I delete this entire template and go my own path, the core team may close my issue without further explanation or engagement. 2. If I list multiple bugs/concerns in this one issue, the core team may close my issue without further explanation or engagement. 3. If I write an issue that has many duplicates, the core team may close my issue without further explanation or engagement (and without necessarily spending time to find the exact duplicate ID number). 4. If I leave the title incomplete when filing the issue, the core team may close my issue without further explanation or engagement. 5. If I file something completely blank in the body, the core team may close my issue without further explanation or engagement. All good? Then proceed! --> <!-- This bug tracker is monitored by Windows Terminal development team and other technical folks. **Important: When reporting BSODs or security issues, DO NOT attach memory dumps, logs, or traces to Github issues**. Instead, send dumps/traces to secure@microsoft.com, referencing this GitHub issue. If this is an application crash, please also provide a Feedback Hub submission link so we can find your diagnostic data on the backend. Use the category "Apps > Windows Terminal (Preview)" and choose "Share My Feedback" after submission to get the link. Please use this form and describe your issue, concisely but precisely, with as much detail as possible. --> # Environment ```none Windows build number: 10.0.18362.0 Windows Terminal version (if applicable): master Any other software? ``` # Steps to reproduce 1. Minimize the height of Terminal. Doesn't even have to be fully minimized. 2. Create a new tab ![WindowsTerminal_cY56ao4860](https://user-images.githubusercontent.com/7334282/65287337-baf66d00-daf7-11e9-92fe-732823faf487.png) # Expected behavior A new tab is created # Actual behavior Terminal crashes <!-- What's actually happening? --> **Details** Terminal crashes with the exception `Unhandled exception at 0x00007FF8AB012830 (Windows.UI.Xaml.dll) in WindowsTerminal.exe: 0xC000027B: An application-internal exception has occurred (parameters: 0x0000027E170823C0, 0x0000000000000002).` This should be the actual error. ``` E:\Code\terminal\src\renderer\dx\DxRenderer.cpp(247)\TerminalControl.dll!00007FF835C818E6: (caller: 00007FF835C7CBCB) ReturnHr(1) tid(2944) 887A0001 The application made a call that is invalid. Either the parameters of the call or the state of some object was incorrect. Enable the D3D debug layer in order to see details via debug messages. [Microsoft::Console::Render::DxEngine::_CreateDeviceResources(_dxgiFactory2->CreateSwapChainForComposition(_d3dDevice.Get(), &SwapChainDesc, nullptr, &_dxgiSwapChain))] ``` ```cpp // src\renderer\dx\DxRenderer.cpp(L233-249) case SwapChainMode::ForComposition: { SwapChainDesc.Width = _displaySizePixels.cx; SwapChainDesc.Height = _displaySizePixels.cy; // omitted --> RETURN_IF_FAILED(_dxgiFactory2->CreateSwapChainForComposition(_d3dDevice.Get(), &SwapChainDesc, nullptr, &_dxgiSwapChain)); break; } ``` `Height` is 0 which I assume is an invalid parameter.
Author
Owner

@zadjii-msft commented on GitHub (Sep 20, 2019):

Yep this is a very real crash that shouldn't happen. Good find!

@zadjii-msft commented on GitHub (Sep 20, 2019): Yep this is a very real crash that shouldn't happen. Good find!
Author
Owner

@mkitzan commented on GitHub (Jan 29, 2020):

Repro-ing this with the most recent build, the crash is due to a nullptr dereference at TermControl L1504 when setting the DPI. I'll looking into the deeper chain of events leading to the crash.

@mkitzan commented on GitHub (Jan 29, 2020): Repro-ing this with the most recent build, the crash is due to a `nullptr` dereference at [TermControl L1504](https://github.com/microsoft/terminal/blob/master/src/cascadia/TerminalControl/TermControl.cpp#L1504) when setting the DPI. I'll looking into the deeper chain of events leading to the crash.
Author
Owner

@mkitzan commented on GitHub (Jan 30, 2020):

Here's the crash:
A callback to _swapChainScaleChanged is made before _InitializeTerminal is called at which point _renderEngine is a nullptr (since _InitializeTerminal sets _renderEngine), inside _swapChainScaleChanged _renderEngine is dereferenced 💣->💥

@mkitzan commented on GitHub (Jan 30, 2020): Here's the crash: A callback to [`_swapChainScaleChanged`](https://github.com/microsoft/terminal/blob/master/src/cascadia/TerminalControl/TermControl.cpp#L1497) is made before `_InitializeTerminal` is called at which point `_renderEngine` is a `nullptr` (since [`_InitializeTerminal`](https://github.com/microsoft/terminal/blob/master/src/cascadia/TerminalControl/TermControl.cpp#L648) sets `_renderEngine`), inside `_swapChainScaleChanged` [`_renderEngine` is dereferenced](https://github.com/microsoft/terminal/blob/master/src/cascadia/TerminalControl/TermControl.cpp#L1504) 💣->💥
Author
Owner

@mkitzan commented on GitHub (Jan 30, 2020):

_InitializeTerminal is simply not called when the window size is so small. As a result, with the crash fixed, the tab title is not set. I'll PR a fix for the crash, but I'll also make sure the title is set so to a user everything appears to be set and running (even though the terminal initialization is deferred).
Edit for this last part ^^^
Seem like it'd take a lot of encapsulation breaking to get the title. Maybe Terminal should just go ahead and be initialized?

@mkitzan commented on GitHub (Jan 30, 2020): `_InitializeTerminal` is simply not called when the window size is so small. As a result, with the crash fixed, the tab title is not set. I'll PR a fix for the crash, but I'll also make sure the title is set so to a user everything appears to be set and running (even though the terminal initialization is deferred). Edit for this last part ^^^ Seem like it'd take a lot of encapsulation breaking to get the title. Maybe Terminal should just go ahead and be initialized?
Author
Owner

@carlos-zamora commented on GitHub (Mar 17, 2020):

Tested on current HEAD of master (7621994). It looks like Terminal doesn't crash anymore. The connection on the other side fails to launch and outputs some kind of error like
[error 0x80070057 when launching `C:\Program Files\PowerShell\7\pwsh.exe']

Realistically, we wouldn't be able to start a process that's 100x0 anyways, since windows console applications always have a size. So, as long as the Terminal doesn't crash, this seems like a fair compromise.

Closing unless someone can verify that the crash starts occurring again.

@carlos-zamora commented on GitHub (Mar 17, 2020): Tested on current HEAD of master (7621994). It looks like Terminal doesn't crash anymore. The connection on the other side fails to launch and outputs some kind of error like ```[error 0x80070057 when launching `C:\Program Files\PowerShell\7\pwsh.exe']``` Realistically, we wouldn't be able to start a process that's 100x0 anyways, since windows console applications always have a size. So, as long as the Terminal doesn't crash, this seems like a fair compromise. Closing unless someone can verify that the crash starts occurring again.
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/terminal#3951