[TSF-IME] Access violation when using / Heap Corruption ITfUIElementSink

Oliver Sradnick 21

Hi,
Im currently working with the Text Service Framework.
And if I use advise sink on an ITfUIElement, i'll get an exception (see picture) after using my simple test application and spamming some keys and spaces in chinese.

If i dont advise sink ITfUIElement and use the OS Candidate window everything works fine^^ even deleting all my code in

HRESULT CandidateList::BeginUIElement(DWORD dwUIElementId, BOOL* pbShow)  
HRESULT CandidateList::UpdateUIElement(DWORD dwUIElementId)  
HRESULT CandidateList::EndUIElement(DWORD dwUIElementId)

the behaviour does not change.

I remember using the same project on a different pc and it works without any crash.

Im using Microsoft Windows [Version 10.0.18363.1082] and Visual Studio 2017
Windows SDK 10.0.14393.0
Platform Toolset VS 2017 v141

Any Ideas ?

EDIT:
Here u can download my project to test it urself
https://drive.google.com/file/d/1hAZZhtP5kHOT28jEVoRGVbqO1EJgp-mz/view?usp=sharing

Rita Han - MSFT 2,166 Reputation points

2020-09-21T03:27:58.427+00:00
Hello @Oliver Sradnick , I can't reproduce this issue on Windows 10 1909 with build 18363.836 and SDK version is 18362. It works for me. Some suggestions to narrow down this issue:

Build a release version and run it without Visual Studio. Test it on multiple machines to see if specific machine environment related.

Check this document to see if it is 32bit/64bit related.
Oliver Sradnick 21 Reputation points

2020-09-21T18:07:17.277+00:00
Hi, thx for the answer

Check this document to see if it is 32bit/64bit related.

pretty good resource but sadly it didn't help
Gonna try a release build on different machines but I assume it works because I did this for a while, it still is kinda important to find out why this on some machines happens.

Any other Idea ? Or maybe you need some more information i could provide so you get different ideas ? :>
Rita Han - MSFT 2,166 Reputation points

2020-09-22T02:37:25.937+00:00
@Oliver Sradnick

Exclude unrelated part to create a mini and reproducible sample. In order to find why this invalid address is accessed.

From your shared snapshot, it seems the exception happens at GetMessage() and the message is WM_KEYUP, when K key is released. Any specific condition triggers this exception?
Oliver Sradnick 21 Reputation points

2020-09-26T10:44:03.577+00:00

So i excluded everything that is not related to the TextServiceFramework.
I tried debug and release build, also different buildtools and sdk's.
The exception happens only on some machines and i could not figure out why.

I used the dll i created in a Unity build and there is the same issue, but in this case it is a instant crash without any logs/error messages.

I have no idea what i can do..
Rita Han - MSFT 2,166 Reputation points

2020-09-27T05:45:41.52+00:00

What's difference in Windows version between working and non-working machines? And can you reproduce this issue on Windows 10 1909 or newer version?
Oliver Sradnick 21 Reputation points

2020-09-27T13:55:51.73+00:00

I trid on :
On 10.0.19042.541, 10.0.19041.508 it works, on 10.0.18363.1110 it does not.
Rita Han - MSFT 2,166 Reputation points

2020-09-28T01:19:30.643+00:00

Thanks for trying. Please update to new version. Feel free let me know if there is any issue with new version.
Oliver Sradnick 21 Reputation points

2020-09-28T19:31:17.753+00:00

I think i got it.
in UpdateUIElement from the ITfUIElementSink, i query ITfCandidateListUIElement to retrieve information that i need. Instead of realsing it or using CComPtr， so it will be released at the end of scope, i just ignore this step.
So query but not releasing ITfCandidateListUIElement does fix the problem. I still need to test that on different windows versions.
Rita Han - MSFT 2,166 Reputation points

2020-09-29T01:24:30.503+00:00

Good news. Looking forward for your update.
Oliver Sradnick 21 Reputation points

2020-09-29T15:19:00.363+00:00

Unfortunately, i could not figure out a proper way to deal with that.
On Microsoft Windows [Version 10.0.18363.1110] and some others I cant get the TextServiceFramework to work proplery. If i implement ITfUIElement and get the ui elment i'll get an Heap corruption if i release it at the end, the error does not occure if i dont release it but this ends in a memory leak.

https://pastebin.com/ZwW8tcj5

It is necessary to run on different Windows Versions for me.

I appreciate any help!
Rita Han - MSFT 2,166 Reputation points

2020-09-30T05:22:41.67+00:00

I upgraded to 10.0.18363.1082 and 10.0.18363.1110, both work for me without reproducing this issue.
Oliver Sradnick 21 Reputation points

2020-09-30T06:35:08.287+00:00

I have no clue. I installed 10.0.18363.1082 and 10.0.18363.1110 on a VM and I could reproduce it.

Steps I did.
1 turn on chinese lang
2 open test Programm
3 spam/type fast letters and space so the composition process ends

Going to upload 2 test programs and link it here. Would be nice if you could try it again. Thanks for still trying to help me.
Rita Han - MSFT 2,166 Reputation points

2020-09-30T07:21:15.7+00:00

Just follow your steps but still not reproduced. Do you use Microsoft Pinyin?
Oliver Sradnick 21 Reputation points

2020-09-30T07:32:25.783+00:00

https://drive.google.com/file/d/1vIygjSdHt0uCdPySP0OdkHmWjMrEg7KS/view?usp=sharing Build/Test programm
https://drive.google.com/file/d/1BflcXST6wnNflQkihtI3Qf-_KBbLKd9q/view?usp=sharing Solution/Source Code
https://streamable.com/yvg51w Repro video
Rita Han - MSFT 2,166 Reputation points

2020-10-10T01:08:00.667+00:00

Hello @Oliver Sradnick , thanks for your test program and repro video. Since I can't reproduce this issue on my side, it is suggested to contact the Windows developer support for further assistance for this kind of environment related issue. You can refer to this page and submit an incident like this:

Share via

[TSF-IME] Access violation when using / Heap Corruption ITfUIElementSink

Your answer