2000475 - Crash in [@ RaiseFailFastException | CFlat::Abandonment::FailWithException]

Status: NEW

(Core :: Widget: Win32, defect)

Description

[BugBot [:suhaib / :marco]]

Crash report: https://crash-stats.mozilla.org/report/index/e6b43fac-c0f2-40e4-a0db-335a30251026

Reason: unknown 0xe0464645

Top 10 frames of crashing thread:

0  KERNELBASE.dll  RaiseFailFastException  
1  CoreMessaging.dll  CFlat::Abandonment::FailWithException  
2  CoreMessaging.dll  CFlat::Abandonment::Fail  
3  CoreMessaging.dll  CFlat::Abandonment::UseOfInvalidatedExportAdapter  
4  CoreMessaging.dll  Microsoft::CoreUI::Messaging::MessagingValidationException::FromResult  
5  CoreMessaging.dll  Microsoft::CoreUI::Dispatch::WaitCollection::UnregisterWait  
6  CoreMessaging.dll  Microsoft::CoreUI::Dispatch::WaitController::DisableEventLoopWait  
7  CoreMessaging.dll  Microsoft::CoreUI::Dispatch::Win32EventLoopBridge::Reset  
8  CoreMessaging.dll  Microsoft::CoreUI::Dispatch::EventLoop::Reset  
9  CoreMessaging.dll  Microsoft::CoreUI::Messaging::MessageSession::DoNonblockingCleanupOnFinalRelease  

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2025-10-18
• Process type: Multiple distinct types
• Is startup crash: No
• Has user comments: No
• Is null crash: No

Comment 1

[Andrew McCreight [:mccr8]]

The first Gecko frame way up the stack is mozilla::widget::IMEContext::AssociateDefaultContext().

Comment 2

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

I have no idea only from the stack because we tried to enable IME on the window when an editable element in a remote process gets focus and TSF in Windows crashes during its initialization.

The crash occurred during Microsoft::CoreUI::Messaging::MessageSession::OnFinalRelease(bool, CFlat::Ref<System::IntPtr>). According to its name, sounds like that double free or something might have happened. If so, we can do nothing.

Comment 3

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Well, the first Gecko frame in the other crash reports of the same signature are vary. It seems that this is a generic issue of Windows.

As far as I checked, the most first frame is WindowsUIUtils::SetIsTitlebarCollapsed. I think the crashes occurred at various API call immediately after startup.

Comment 4

[Greg Stoll :gstoll]

Yeah, most of these go through WindowsUIUtils::SetIsTitlebarCollapsed(), specifically the call to put_ExtendsContentIntoTitleBar().

Comment 5

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1947324

Comment 6

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1947324

Comment 7

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

https://crash-stats.mozilla.org/report/index/85253364-f46a-4d90-932a-c63e90251209

This is another scenario. This crashes when we make a window for the fullscreen mode. The crash occurred during this call, ::SetWindowLongPtrW(aWnd, GWL_STYLE, aStyles.style). Then, nsWindow gets received a message for the window's style change and crash during a call of previous wndproc. Before that, it calls nsWindow::ProcessMessage so that anything could have already occurred such as destruction of the window. So, I wonder if the last call is safe.

Comment 8

[David Parks [:handyman]]

My sense is that the signature is generic, as comment 3 suggests. Looks to be related to exception reporting, but maybe we can narrow it down.

I think the Gecko signature is the right frame to search for here. For example, searching further up the stack, the Win32 function TextInputHost::Initialize includes stuff that isn't related. Crash frequency suggests this hasn't changed in the 6 months we have data for.

The emergence of the (unrelated) signature in comment 7 is probably related to the WinApp SDK work that went in in early October. I've filed bug 2005322 for that.

Comment 9

[Fredo Guan]

https://crash-stats.mozilla.org/report/index/315bead2-8518-4b58-9329-00d270260717
https://crash-stats.mozilla.org/report/index/1db658ac-8e07-4fd7-8fb1-5a1b50260717
https://crash-stats.mozilla.org/report/index/87c51b72-9303-400c-9143-351880260717
https://crash-stats.mozilla.org/report/index/e0a24c1e-564b-429b-8c58-cf5c10260717
https://crash-stats.mozilla.org/report/index/d2422098-b0ba-4d38-b5a1-d35b00260709

Started occuring for me after moving my windows install from a win11/cascade lake machine to a win11/zen5 epyc machine about 3 weeks ago. Went from never happening to around once every 2 days. Seems like its the same issue every time, may be hardware dependent? The intel machine has had either a GTX 1080 or an Arc B570 in the past 2 months and the AMD machine has an RTX 3090. Not sure if the hardware info may be useful.

Comment 10

[Fredo Guan]

https://crash-stats.mozilla.org/report/index/7342c2e6-2505-430f-a3f6-263de0260821

154.0 still affected. Opening a new private window reliably triggers the issue for me on the zen5 machine listed above.