Why is my DLL using Fault Tolerant Heap?

Dan Simkin 0 Reputation points

I am getting a crash when a DLL written in C++ unloads. It looks like this has something to do with heap corruption. Based on the following partial stack trace, I think my application is trying to use Fault Tolerant Heap. I have tried to turn this off to reveal the original source of heap corruption, but I don't think this is working.

ntdll.dll!RtlReportCriticalFailure()  + 0x56 bytes	
ntdll.dll!RtlpHeapHandleError()  + 0x12 bytes	
ntdll.dll!RtlpHpHeapHandleError()  + 0x7a bytes	
ntdll.dll!RtlpLogHeapFailure()  + 0x45 bytes	
ntdll.dll!RtlpFreeHeapInternal()  + 0x4e0 bytes	
ntdll.dll!RtlFreeHeap()  + 0x51 bytes	
	APIHook_RtlFreeHeap()  + 0x431 bytes	
ucrtbase.dll!_free_base()  + 0x1b bytes	
	void * _Ptr, unsigned __int64 _Count, 
	unsigned __int64 _Sz)
	std::vector<int,std::allocator<int> >::_Tidy()
	`dynamic atexit destructor for 'DPSetupStatus''()
	+ 0x19 bytes	C++
	operator()()  + 0xa6 bytes	
	<lambda_f03950bc5685219e0bcd2087efbe011e> &,
	<lambda_3883c3dff614d5e0c5f61bb1ac94921c> >()
ucrtbase.dll!_execute_onexit_table()  + 0x34 bytes	
	dllmain_crt_process_detach(const bool is_terminating)
	dllmain_dispatch(HINSTANCE__ * const instance, 
	const unsigned long reason, void * const reserved)

Based on the call to NS_FaultTolerantHeap::APIHook_RtlFreeHeap()
I think the application is still using fault tolerant heap. I have verified that the vector being cleaned up is not itself corrupt (the inner pointer passed to Deallocate has the same value as it originally did). I don't see how this vector could possibly have been cleaned up twice, since it is a static global variable and it would only get cleaned up once when the DLL unloads.

Here are the steps I've tried to use to turn off fault tolerant heap:

  1. I've stopped and disabled the Diagnostic Policy Service
  2. In the registry, I set HKEY_LOCAL_MACHINE\SOFTWARE\

Microsoft\FTH\Enabled to 0.

  1. I ran the following command as admin:

Rundll32.exe fthsvc.dll,FthSysprepSpecialize

  1. I restarted my computer several times.
  2. In the Event Viewer, I've verified that there's no recent activity in the Fault Tolerance Heap event log (under Applications and Services / Microsoft / Windows).

Is there some other service that would use the fault tolerant heap API? What else should I be doing to troubleshoot?

Windows 10
Windows 10
A Microsoft operating system that runs on personal computers and tablets.
7,487 questions
A high-level, general-purpose programming language, created as an extension of the C programming language, that has object-oriented, generic, and functional features in addition to facilities for low-level memory manipulation.
2,896 questions
{count} votes