Windows.Devices.Bluetooth.dll crash when exit app.

frank zhang 121

I use BluetoothLEAdvertisementWatcher.Received() to register scan callback and start scan LE, after scanning, I free the callback and stop scan. It works well, but when exit app, below crash will happend, it seems an inner crash in Windows.Devices.Bluetooth.dll when free something, so what's wrong and How can I avoid it?

on windows version 10.0.19045, crash stack:

Crash reason: EXCEPTION_ACCESS_VIOLATION_READ
Crash address: 0x546267d8
Exception code: 0xc0000005 
Process uptime: 74 seconds #95 Thread 110400 (crashed)

0  combase.dll + 0xacfd7!Microsoft::WRL::ComPtr<IUnknown>::InternalRelease() [onecore\external\sdk\inc\wrl\client.h : 235 + 0x3]
 
    Found by: inline record
 1  combase.dll + 0xacfd7!CAgileReferenceToAgileObject::`scalar deleting destructor'(unsigned int) [onecore\external\sdk\inc\wrl\client.h : 290 + 0x3]
    eip = 0x75aacfd7   esp = 0x2176fc54   ebp = 0x2176fc60   ebx = 0x00000000
    esi = 0x268348f0   edi = 0x75aacfc0   eax = 0x546267d0   ecx = 0x26ff4350
    edx = 0x75a01528   efl = 0x00010246
    Found by: given as instruction pointer in context
 2  combase.dll + 0xacf63!Microsoft::WRL::Details::RuntimeClassImpl<Microsoft::WRL::RuntimeClassFlags<2>,1,0,0,IAgileReference,Microsoft::WRL::FtmBase>::Release() [onecore\external\sdk\inc\wrl\implements.h : 1625 + 0x1b]
    eip = 0x75aacf63   esp = 0x2176fc68   ebp = 0x2176fc78
    Found by: call frame info
 3  Windows.Devices.Bluetooth.dll + 0x6a693!Microsoft::WRL::ComPtr<Windows::Foundation::IAsyncOperationCompletedHandler<Windows::Devices::Bluetooth::GenericAttributeProfile::GattWriteResult*> >::InternalRelease(void) + 0x1b
    eip = 0x2581a693   esp = 0x2176fc80   ebp = 0x2176fc90
    Found by: call frame info
 4  Windows.Devices.Bluetooth.dll + 0xb5c20!Windows::Internal::Details::GitInvokeHelper<Windows::Foundation::ITypedEventHandler<Windows::Devices::Bluetooth::GenericAttributeProfile::GattCharacteristic*, Windows::Devices::Bluetooth::GenericAttributeProfile::GattValueChangedEventArgs*>, Windows::Internal::GitPtrSupportsAgile<Windows::Foundation::ITypedEventHandler<Windows::Devices::Bluetooth::GenericAttributeProfile::GattCharacteristic*, Windows::Devices::Bluetooth::GenericAttributeProfile::GattValueChangedEventArgs*> >, 2>::`scalar deleting destructor'(unsigned int) + 0x10
    eip = 0x25865c20   esp = 0x2176fc8c   ebp = 0x2176fc90
    Found by: call frame info
 5  Windows.Devices.Bluetooth.dll + 0x81f50!Microsoft::WRL::Details::RuntimeClassImpl<Microsoft::WRL::RuntimeClassFlags<2>, 1, 0, 0, Windows::Foundation::ITypedEventHandler<Windows::Devices::Bluetooth::GenericAttributeProfile::GattSession*, IInspectable*>, Microsoft::WRL::FtmBase>::Release(void) + 0x30
    eip = 0x25831f50   esp = 0x2176fc98   ebp = 0x2176fca8
    Found by: call frame info
 6  Windows.Devices.Bluetooth.dll + 0x6a693!Microsoft::WRL::ComPtr<Windows::Foundation::IAsyncOperationCompletedHandler<Windows::Devices::Bluetooth::GenericAttributeProfile::GattWriteResult*> >::InternalRelease(void) + 0x1b
    eip = 0x2581a693   esp = 0x2176fcb0   ebp = 0x2176fce8
    Found by: call frame info
 7  Windows.Devices.Bluetooth.dll + 0x14b04f!`eh vector destructor iterator'(void*, unsigned int, unsigned int, void (*)(void*)) + 0x44
    eip = 0x258fb04f   esp = 0x2176fcbc   ebp = 0x2176fce8
    Found by: call frame info
 8  Windows.Devices.Bluetooth.dll + 0x65d88!Microsoft::WRL::ComPtr<IUnknown>::`vector deleting destructor'(unsigned int) + 0x15
    eip = 0x25815d88   esp = 0x2176fcf0   ebp = 0x2176fd10
    Found by: call frame info
 9  Windows.Devices.Bluetooth.dll + 0x6a250!wil::details::unique_storage<wil::details::resource_policy<_TP_TIMER*, void (*)(_TP_TIMER*), void (wil::details::DestroyThreadPoolTimer<wil::details::SystemThreadPoolMethods, 0>::Destroy::*)(_TP_TIMER*), wistd::integral_constant<unsigned int, 0>, _TP_TIMER*, _TP_TIMER*, 0, std::nullptr_t> >::reset(_TP_TIMER*) + 0x32
    eip = 0x2581a250   esp = 0x2176fd00   ebp = 0x2176fd10
    Found by: call frame info
10  Windows.Devices.Bluetooth.dll + 0x7bc00!Microsoft::WRL::Details::RuntimeClassImpl<Microsoft::WRL::RuntimeClassFlags<2>, 1, 0, 0, IUnknown>::Release(void) + 0x30
    eip = 0x2582bc00   esp = 0x2176fd18   ebp = 0x2176fd28
    Found by: previous frame's frame pointer
11  Windows.Devices.Bluetooth.dll + 0xb588a!wil::AsyncEventSourceT<Windows::Foundation::ITypedEventHandler<Windows::Devices::Bluetooth::Advertisement::BluetoothLEAdvertisementWatcher*, Windows::Devices::Bluetooth::Advertisement::BluetoothLEAdvertisementReceivedEventArgs*>, Windows::Internal::GitEventSourceSupportsAgile, Microsoft::WRL::InvokeModeOptions<2>, 1, wil::err_returncode_policy>::AsyncEventWorkItem::~AsyncEventWorkItem(void) + 0x3d
    eip = 0x2586588a   esp = 0x2176fd30   ebp = 0x2176fd44
    Found by: call frame info
12  Windows.Devices.Bluetooth.dll + 0xb593d!wil::AsyncEventSourceT<Windows::Foundation::ITypedEventHandler<Windows::Devices::Bluetooth::Advertisement::BluetoothLEAdvertisementWatcher*, Windows::Devices::Bluetooth::Advertisement::BluetoothLEAdvertisementReceivedEventArgs*>, Windows::Internal::GitEventSourceSupportsAgile, Microsoft::WRL::InvokeModeOptions<2>, 1, wil::err_returncode_policy>::AsyncEventWorkItem::`scalar deleting destructor'(unsigned int) + 0xd
    eip = 0x2586593d   esp = 0x2176fd40   ebp = 0x2176fd44
    Found by: call frame info
13  Windows.Devices.Bluetooth.dll + 0xd6db2!wil::details::AsyncEventInvocationPolicy<1>::HandleAsyncEventInvoke(wil::srwlock&, wil::details::AsyncEventWorkQueue&) + 0x87
    eip = 0x25886db2   esp = 0x2176fd4c   ebp = 0x2176fd6c
    Found by: call frame info
14  Windows.Devices.Bluetooth.dll + 0xd6e2e!wil::details::EventInvocationContext<1>::AsyncEventWorkCallback(_TP_CALLBACK_INSTANCE*, void*, _TP_WORK*) + 0x4e
    eip = 0x25886e2e   esp = 0x2176fd74   ebp = 0x2176fd84
    Found by: call frame info
15  ntdll.dll + 0x36d14!TppWorkpExecuteCallback + 0x144
    eip = 0x77ad6d14   esp = 0x2176fd8c   ebp = 0x2176fdbc
    Found by: call frame info
16  ntdll.dll + 0x35db2!TppWorkerThread + 0x472
    eip = 0x77ad5db2   esp = 0x2176fdc4   ebp = 0x2176ff70
    Found by: call frame info
17  KERNEL32.DLL + 0x1fcc9!BaseThreadInitThunk + 0x19
    eip = 0x76c5fcc9   esp = 0x2176ff78   ebp = 0x2176ff80
    Found by: call frame info
18  ntdll.dll + 0x67c6e!__RtlUserThreadStart + 0x2f
    eip = 0x77b07c6e   esp = 0x2176ff88   ebp = 0x2176ffdc
    Found by: call frame info
19  ntdll.dll + 0x67c3e!_RtlUserThreadStart + 0x1b
    eip = 0x77b07c3e   esp = 0x2176ffe4   ebp = 0x2176ffec
    Found by: call frame info

Roy Li - MSFT 33,586 Reputation points Microsoft Vendor

2024-03-07T07:07:16.31+00:00

Could you please share more information about the real scenario? You mentioned that the crash happens when you exit the app, what actions are you doing before exiting the app? Which line of code throws the error?

frank zhang 121

Thank you for your reply，my code is just like below.

I did not do any more things before quit app， I just do start scan/advertiser and stop scan/advertiser before quit app. And my code work well and did not throw any error. The crash callstack is caught by another error detect tools. It shows that Devices.Bluetooth.dll has crashed before exit. Can you find some clue on the callstack ? Thanks.



#include "BleControllerWin.h"
#pragma comment(lib, "windowsapp")
#define ADVERTISER_OPERATION_TIMEOUT 500
#define SCANNER_OPERATION_TIMEOUT 500

//advertiser notify
void BleControllerWin::notifyPublishStatusChanged(
    Bluetooth::Advertisement::BluetoothLEAdvertisementPublisher,
    Windows::Devices::Bluetooth::Advertisement::
        BluetoothLEAdvertisementPublisherStatusChangedEventArgs args) {
    auto status = args.Status();
    auto errStatus = args.Error();
    if (status == Bluetooth::Advertisement::
                      BluetoothLEAdvertisementPublisherStatus::Started ||
        status == Bluetooth::Advertisement::
                      BluetoothLEAdvertisementPublisherStatus::Aborted ||
        status == Bluetooth::Advertisement::
                      BluetoothLEAdvertisementPublisherStatus::Stopped ||
        errStatus != Bluetooth::BluetoothError::Success) {
        notifyCv.notify_one();
    }
}


void BleControllerWin::startAdvertiser(const char *broadcastData) {
//start advertiser 
    if (publisher == nullptr)
        publisher =
            Bluetooth::Advertisement::BluetoothLEAdvertisementPublisher();
    auto manufacturerData =
        Bluetooth::Advertisement::BluetoothLEManufacturerData();
    manufacturerData.CompanyId(BLE_MANUFACTURER_ID);
    auto writer = DataWriter();
    for (int i = 0; i < BLE_SLOT_LEN; i++)
        writer.WriteByte(broadcastData[i]);
    manufacturerData.Data(writer.DetachBuffer());
    publisher.Advertisement().ManufacturerData().Clear();
    publisher.Advertisement().ManufacturerData().Append(manufacturerData);
    auto statusChanged =
        std::bind(&BleControllerWin::notifyPublishStatusChanged, this,
                  std::placeholders::_1, std::placeholders::_2);
    auto registerPubToken = publisher.StatusChanged(
        Windows::Foundation::TypedEventHandler<
            Bluetooth::Advertisement::BluetoothLEAdvertisementPublisher,
            Windows::Devices::Bluetooth::Advertisement::
                BluetoothLEAdvertisementPublisherStatusChangedEventArgs>(
            statusChanged));

    try {
        publisher.Start();
    } catch (std::exception &ex) {
        return ;
    } catch (...) {
        return ;
    }
	//wait advertiser start done
    std::unique_lock<std::mutex> lk(notifyMutex);
    notifyCv.wait_for(lk,
                      std::chrono::milliseconds(ADVERTISER_OPERATION_TIMEOUT));
    publisher.StatusChanged(registerPubToken);
    auto status = publisher.Status();
    if (status == Bluetooth::Advertisement::
                      BluetoothLEAdvertisementPublisherStatus::Aborted)
        return ;
    if (status != Bluetooth::Advertisement::
                      BluetoothLEAdvertisementPublisherStatus::Started)
        return ;
    return ;
}

void BleControllerWin::stopAdvertiser() {
	// stop advertiser
    auto statusChanged =
        std::bind(&BleControllerWin::notifyPublishStatusChanged, this,
                  std::placeholders::_1, std::placeholders::_2);
    auto registerPubToken = publisher.StatusChanged(
        Windows::Foundation::TypedEventHandler<
            Bluetooth::Advertisement::BluetoothLEAdvertisementPublisher,
            Windows::Devices::Bluetooth::Advertisement::
                BluetoothLEAdvertisementPublisherStatusChangedEventArgs>(
            statusChanged));
    try {
        publisher.Stop();
    } catch (std::exception &ex) {
        return ;
    } catch (...) {
        return ;
    }
//wait stop advertiser done
    std::unique_lock<std::mutex> lk(notifyMutex);
    notifyCv.wait_for(lk,
                      std::chrono::milliseconds(ADVERTISER_OPERATION_TIMEOUT));
    publisher.StatusChanged(registerPubToken);
    auto status = publisher.Status();
    if (status != Bluetooth::Advertisement::
                      BluetoothLEAdvertisementPublisherStatus::Stopped) {
        return;
    }
    return;
}
void notifyServerFound(
    Bluetooth::Advertisement::BluetoothLEAdvertisementWatcher,
    Windows::Devices::Bluetooth::Advertisement::
        BluetoothLEAdvertisementReceivedEventArgs args) {
    //do scan filter things.
}

void BleControllerWin::startScanner(BleScanSlotCallback callback) {
    try {
        this->registerAdvToken = bleAdvertisementWatcher.Received(
        Windows::Foundation::TypedEventHandler<
            Bluetooth::Advertisement::BluetoothLEAdvertisementWatcher,
            Windows::Devices::Bluetooth::Advertisement::
                BluetoothLEAdvertisementReceivedEventArgs>(&notifyServerFound));// add receive callback
        bleAdvertisementWatcher.Start(); // start scan 
    } catch (...) {
    }
    return;
}
void BleControllerWin::stopScanner() {
    try {
        bleAdvertisementWatcher.Received(this->registerAdvToken); //remove callback
        bleAdvertisementWatcher.Stop(); // stop scan
    } catch (...) {
       ...
    }
    ...
}

Roy Li - MSFT 33,586 Reputation points Microsoft Vendor

2024-03-08T07:20:03.65+00:00

I have to say that your issue might more support and it might beyond the scope of the forum.

For your scenario, I suggest that you might need to open a support ticket for this. Please contact our paid support at MS Support. You will get 1:1 support on that. Select Developer Tools -> Windows UWP Development -> Windows 10 Universal App Dev -> Devices and Sensors Development-> Bluetooth API in the support page and you could contact the team. Please kindly note that your support ticket will be free if it is Microsoft's issue.
frank zhang 121 Reputation points

2024-03-11T02:12:44.9333333+00:00

@Roy Li - MSFT Thanks for your reply.Your link is a commercial support channel. I think this is a bluetooth system bug, is there any official bug report feedback channel for it？
Roy Li - MSFT 33,586 Reputation points Microsoft Vendor

2024-03-11T03:33:28.5466667+00:00

I have to say that it's hard to define the issue without further investigating. That's why I'm suggesting you open a ticket. If you just want to report such behavior, you could submit feedback in the Feedback Hub. You could find the Feedback Hub in the Start Menu. Please select Developer Platform->API Feedback as the category when you submit your request. Please select Developer Platform->API Feedback as the category when you submit your feedback.
frank zhang 121 Reputation points

2024-03-18T03:01:40.9633333+00:00

Thank you@Roy Li - MSFT, I will take your advice.

Share via

Windows.Devices.Bluetooth.dll crash when exit app.

Your answer