Mysterious crash in Monarch::_clearOldMruEntries

[zadjii-msft]

Totally unclear what happened here. I reactivated the window, and the terminal took a trip to beeftown.

Crash is in Microsoft_Terminal_Remoting!winrt::Microsoft::Terminal::Remoting::implementation::WindowActivatedArgs::`scalar deleting destructor'+0x39 north of the call to _mruPeasants.erase(result);. The param to Monarch::_clearOldMruEntries is 0x000002dde61fe738, but that's garbage, and the stack below it shows that the right value (1).

> kv
...

1b 000000eb`857ff670 00007ffb`10538e58     : 000000eb`857ffda8 00000000`00000001 000002dd`dd2b1940 00000000`00000040 : Microsoft_Terminal_Remoting!winrt::Microsoft::Terminal::Remoting::implementation::Monarch::_clearOldMruEntries+0x182 [E:\BA\89\s\src\cascadia\Remoting\Monarch.cpp @ 265] 
1c 000000eb`857ff750 00007ffb`10538be6     : 0000000e`00000000 00000000`00000000 000002dd`dd2b1940 000002dd`e40ce920 : Microsoft_Terminal_Remoting!winrt::Microsoft::Terminal::Remoting::implementation::Monarch::_doHandleActivatePeasant+0x48 [E:\BA\89\s\src\cascadia\Remoting\Monarch.cpp @ 284] 
1d 000000eb`857ff870 00007ffb`1053d14c     : 000000eb`00000002 00000000`00000000 000000eb`00000000 000002dd`da01cb20 : Microsoft_Terminal_Remoting!winrt::Microsoft::Terminal::Remoting::implementation::Monarch::HandleActivatePeasant+0x66 [E:\BA\89\s\src\cascadia\Remoting\Monarch.cpp @ 231] 


0:021> dv
                       this = 0x000002dd`dd2b1940
                  peasantID = 0x000002dd`e61fe738
                   _TlgData = struct _EVENT_DATA_DESCRIPTOR [4]
_Tlgg_hRemotingProviderProv = <value unavailable>
                  _TlgEvent = struct winrt::Microsoft::Terminal::Remoting::implementation::Monarch::_clearOldMruEntries::__l7::<unnamed-type-_TlgEvent>
             _TlgLevelConst = _TlgLevelConst (0n5)

Stack Trace

0:021> k
 # Child-SP          RetAddr               Call Site
00 000000eb`857ff220 00007ffb`452a3df3     ntdll!RtlReportFatalFailure+0x9 [minkernel\ntos\rtl\rtlutil.c @ 150] 
01 000000eb`857ff270 00007ffb`452acdfa     ntdll!RtlReportCriticalFailure+0x97 [minkernel\ntos\rtl\rtlutil.c @ 218] 
02 000000eb`857ff360 00007ffb`452ad0da     ntdll!RtlpHeapHandleError+0x12 [minkernel\ntos\rtl\heaplog.c @ 352] 
03 000000eb`857ff390 00007ffb`452b7a1d     ntdll!RtlpHpHeapHandleError+0x7a [minkernel\ntos\rtl\heaplog.c @ 678] 
04 000000eb`857ff3c0 00007ffb`45256b04     ntdll!RtlpLogHeapFailure+0x45 [minkernel\ntos\rtl\heaplibcommon.c @ 159] 
05 (Inline Function) --------`--------     ntdll!RtlpHpLfhReportError+0x20 [minkernel\ntos\rtl\heaplfh.c @ 7001] 
06 000000eb`857ff3f0 00007ffb`451ccac0     ntdll!RtlpHpLfhSubsegmentFreeBlock+0x89b94 [minkernel\ntos\rtl\heaplfh.c @ 6004] 
07 (Inline Function) --------`--------     ntdll!RtlpHpLfhContextFree+0x9 [minkernel\ntos\rtl\heaplfh.c @ 598] 
08 (Inline Function) --------`--------     ntdll!RtlpHpSegFree+0xc8 [minkernel\ntos\rtl\heapsegmentalloc.c @ 662] 
09 (Inline Function) --------`--------     ntdll!RtlpHpFreeHeap+0x367 [minkernel\ntos\rtl\heapsegshared.c @ 1795] 
0a 000000eb`857ff470 00007ffb`451cc2ce     ntdll!RtlpFreeHeapInternal+0x3c0 [minkernel\ntos\rtl\heap.c @ 2549] 
0b (Inline Function) --------`--------     ntdll!RtlpHpHeapFreeRedirectLayer+0x1a [minkernel\ntos\rtl\heappublic.c @ 243] 
0c 000000eb`857ff530 00007ffb`451cc1fd     ntdll!RtlpHpFreeWithExceptionProtection+0x1e [minkernel\ntos\rtl\heappublic.c @ 281] 
0d 000000eb`857ff5a0 00007ffb`426f218b     ntdll!RtlFreeHeap+0x6d [minkernel\ntos\rtl\heappublic.c @ 351] 
0e 000000eb`857ff5e0 00007ffb`10537d79     ucrtbase!_free_base+0x1b [minkernel\crts\ucrt\src\appcrt\heap\free_base.cpp @ 105] 
0f 000000eb`857ff610 00007ffb`10536eb7     Microsoft_Terminal_Remoting!winrt::Microsoft::Terminal::Remoting::implementation::WindowActivatedArgs::`scalar deleting destructor'+0x39
10 (Inline Function) --------`--------     Microsoft_Terminal_Remoting!winrt::impl::root_implements<winrt::Microsoft::Terminal::Remoting::implementation::CommandlineArgs,winrt::Microsoft::Terminal::Remoting::CommandlineArgs>::NonDelegatingRelease+0x3d [E:\BA\89\s\src\cascadia\Remoting\Generated Files\winrt\base.h @ 7325] 
11 (Inline Function) --------`--------     Microsoft_Terminal_Remoting!winrt::impl::root_implements<winrt::Microsoft::Terminal::Remoting::implementation::CommandlineArgs,winrt::Microsoft::Terminal::Remoting::CommandlineArgs>::Release+0x3d [E:\BA\89\s\src\cascadia\Remoting\Generated Files\winrt\base.h @ 7206] 
12 (Inline Function) --------`--------     Microsoft_Terminal_Remoting!winrt::implements<winrt::Microsoft::Terminal::Remoting::implementation::CommandlineArgs,winrt::Microsoft::Terminal::Remoting::CommandlineArgs>::Release+0x3d [E:\BA\89\s\src\cascadia\Remoting\Generated Files\winrt\base.h @ 7802] 
13 000000eb`857ff640 00007ffb`10538d92     Microsoft_Terminal_Remoting!winrt::impl::produce_base<winrt::Microsoft::Terminal::Remoting::implementation::CommandlineArgs,winrt::Microsoft::Terminal::Remoting::ICommandlineArgs,void>::Release+0x47 [E:\BA\89\s\src\cascadia\Remoting\Generated Files\winrt\base.h @ 6874] 
14 (Inline Function) --------`--------     Microsoft_Terminal_Remoting!winrt::Windows::Foundation::IUnknown::release_ref+0xd [E:\BA\89\s\src\cascadia\Remoting\Generated Files\winrt\base.h @ 2125] 
15 (Inline Function) --------`--------     Microsoft_Terminal_Remoting!winrt::Windows::Foundation::IUnknown::operator=+0x12 [E:\BA\89\s\src\cascadia\Remoting\Generated Files\winrt\base.h @ 2049] 
16 (Inline Function) --------`--------     Microsoft_Terminal_Remoting!winrt::Windows::Foundation::IInspectable::operator=+0x12 [E:\BA\89\s\src\cascadia\Remoting\Monarch.cpp @ 740] 
17 (Inline Function) --------`--------     Microsoft_Terminal_Remoting!winrt::Microsoft::Terminal::Remoting::IWindowActivatedArgs::operator=+0x12 [E:\BA\89\s\src\cascadia\Remoting\Monarch.cpp @ 740] 
18 (Inline Function) --------`--------     Microsoft_Terminal_Remoting!winrt::Microsoft::Terminal::Remoting::WindowActivatedArgs::operator=+0x12 [E:\BA\89\s\src\cascadia\Remoting\Monarch.cpp @ 740] 
19 (Inline Function) --------`--------     Microsoft_Terminal_Remoting!std::_Move_unchecked+0x17 [C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.28.29910\include\xutility @ 4661] 
1a (Inline Function) --------`--------     Microsoft_Terminal_Remoting!std::vector<winrt::Microsoft::Terminal::Remoting::WindowActivatedArgs,std::allocator<winrt::Microsoft::Terminal::Remoting::WindowActivatedArgs> >::erase+0x25 [C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.28.29910\include\vector @ 1360] 
1b 000000eb`857ff670 00007ffb`10538e58     Microsoft_Terminal_Remoting!winrt::Microsoft::Terminal::Remoting::implementation::Monarch::_clearOldMruEntries+0x182 [E:\BA\89\s\src\cascadia\Remoting\Monarch.cpp @ 265] 
1c 000000eb`857ff750 00007ffb`10538be6     Microsoft_Terminal_Remoting!winrt::Microsoft::Terminal::Remoting::implementation::Monarch::_doHandleActivatePeasant+0x48 [E:\BA\89\s\src\cascadia\Remoting\Monarch.cpp @ 284] 
1d 000000eb`857ff870 00007ffb`1053d14c     Microsoft_Terminal_Remoting!winrt::Microsoft::Terminal::Remoting::implementation::Monarch::HandleActivatePeasant+0x66 [E:\BA\89\s\src\cascadia\Remoting\Monarch.cpp @ 231] 
1e (Inline Function) --------`--------     Microsoft_Terminal_Remoting!winrt::Windows::Foundation::TypedEventHandler<winrt::Windows::Foundation::IInspectable,winrt::Windows::Foundation::IInspectable>::<lambda_580a090febe30467cdb04244d2cfc0ab>::operator()+0x1c [E:\BA\89\s\src\cascadia\Remoting\Generated Files\winrt\Windows.Foundation.h @ 2511] 
1f 000000eb`857ff900 00007ffb`105414eb     Microsoft_Terminal_Remoting!winrt::impl::delegate<winrt::Windows::Foundation::TypedEventHandler<winrt::Windows::Foundation::IInspectable,winrt::Windows::Foundation::IInspectable>,<lambda_580a090febe30467cdb04244d2cfc0ab> >::Invoke+0x3c [E:\BA\89\s\src\cascadia\Remoting\Generated Files\winrt\Windows.Foundation.h @ 894] 
20 (Inline Function) --------`--------     Microsoft_Terminal_Remoting!winrt::Windows::Foundation::TypedEventHandler<winrt::Windows::Foundation::IInspectable,winrt::Microsoft::Terminal::Remoting::WindowActivatedArgs>::operator()+0x16 [E:\BA\89\s\src\cascadia\Remoting\Generated Files\winrt\Windows.Foundation.h @ 2524] 
21 000000eb`857ff950 00007ffb`1053f02b     Microsoft_Terminal_Remoting!winrt::impl::invoke<winrt::Windows::Foundation::TypedEventHandler<winrt::Windows::Foundation::IInspectable,winrt::Microsoft::Terminal::Remoting::WindowActivatedArgs>,winrt::Microsoft::Terminal::Remoting::implementation::Peasant,winrt::Microsoft::Terminal::Remoting::WindowActivatedArgs>+0x6b [E:\BA\89\s\src\cascadia\Remoting\Generated Files\winrt\base.h @ 5707] 
22 (Inline Function) --------`--------     Microsoft_Terminal_Remoting!winrt::event<winrt::Windows::Foundation::TypedEventHandler<winrt::Windows::Foundation::IInspectable,winrt::Microsoft::Terminal::Remoting::WindowActivatedArgs> >::operator()+0x53 [E:\BA\89\s\src\cascadia\Remoting\Generated Files\winrt\base.h @ 5842] 
23 000000eb`857ff9a0 00007ffb`10541102     Microsoft_Terminal_Remoting!winrt::Microsoft::Terminal::Remoting::implementation::Peasant::ActivateWindow+0xbb [E:\BA\89\s\src\cascadia\Remoting\Peasant.cpp @ 93] 
24 000000eb`857ffa80 00007ff7`ee8a92f4     Microsoft_Terminal_Remoting!winrt::impl::produce<winrt::Microsoft::Terminal::Remoting::implementation::Peasant,winrt::Microsoft::Terminal::Remoting::IPeasant>::ActivateWindow+0x32 [E:\BA\89\s\src\cascadia\Remoting\Generated Files\winrt\Microsoft.Terminal.Remoting.h @ 618] 
25 (Inline Function) --------`--------     WindowsTerminal!winrt::impl::consume_Microsoft_Terminal_Remoting_IPeasant<winrt::Microsoft::Terminal::Remoting::IPeasant>::ActivateWindow+0x28 [E:\BA\89\s\src\cascadia\WindowsTerminal\Generated Files\winrt\Microsoft.Terminal.Remoting.h @ 131] 
26 000000eb`857ffac0 00007ff7`ee899f20     WindowsTerminal!AppHost::_WindowActivated$_ResumeCoro$1+0x3f4 [E:\BA\89\s\src\cascadia\WindowsTerminal\AppHost.cpp @ 631] 
27 (Inline Function) --------`--------     WindowsTerminal!std::experimental::coroutine_handle<void>::resume+0xc [C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.28.29910\include\experimental\coroutine @ 107] 
28 (Inline Function) --------`--------     WindowsTerminal!std::experimental::coroutine_handle<void>::operator()+0xc [C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.28.29910\include\experimental\coroutine @ 99] 
29 000000eb`857ffbc0 00007ffb`451a9e63     WindowsTerminal!winrt::impl::resume_background_callback+0x10 [E:\BA\89\s\src\cascadia\WindowsTerminal\Generated Files\winrt\base.h @ 8376] 
2a 000000eb`857ffbf0 00007ffb`451c8d7d     ntdll!TppSimplepExecuteCallback+0xa3 [minkernel\threadpool\ntdll\simple.c @ 376] 
2b 000000eb`857ffc40 00007ffb`442154e0     ntdll!TppWorkerThread+0x67d [minkernel\threadpool\ntdll\worker.c @ 1109] 
2c 000000eb`857fff30 00007ffb`451fdddb     KERNEL32!BaseThreadInitThunk+0x10 [clientcore\base\win32\client\thread.c @ 75] 
2d 000000eb`857fff60 00000000`00000000     ntdll!RtlUserThreadStart+0x2b [minkernel\ntdll\rtlstrt.c @ 1152] 

More importantly, there might be other crashes in this bucket: a90749d8-7430-c4ba-d031-827f78f57d94. Search for that GUID, you'll find it.

Got the local .dump /ma in "C:\Users\migrie\OneDrive - Microsoft\dumps\windowActivatedArgsCrash.dmp". I'll keep my eye out if this happens again.

[zadjii-msft]

You know, I haven't seen this since, and I'm guessing that this is something that's actually probably fixed by #11189, So I'm going to close this out.