DLL that was not present in memory despite not being formally unloaded

 (devblogs.microsoft.com)

50 points | by ibobev 4 hours ago

6 comments

  • nopurpose 0 minutes ago
    How big and important third-party vendor must be for Raymond Chen to dissect its coredumps?
  • masfuerte 1 hour ago
    Part two:

    https://devblogs.microsoft.com/oldnewthing/20260626-00/?p=11...

    [-]
    • Someone1234 1 hour ago
      Part 1 was interesting; it isn't clear why he split that into a Part 2 since it adds little to the story and is a paragraph long.
      [-]
      • londons_explore 1 minute ago
        I assume the fact it is a third party application means debugging gets harder, and the business case for doing so is weaker/none.

        But I would hope that some kind of reverse debugger triggered on one of these crashes would make it pretty simple to say "who wrote this 01".

      • taneq 52 minutes ago
        Might have been an “I need to look into this” segueing into “ never mind”?
  • zabzonk 1 hour ago
    > The good news for the shell32 team is that they are off the hook; they are the victim. The bad news is that we don’t know who the culprit is.

    The story of software development through the ages.

    [-]
    • brookst 1 hour ago
      When you’ve eliminated all possible explanation, it’s time to pack it in.
      [-]
      • taneq 50 minutes ago
        Oh man, my journey from idealistic “there is always an explanation” youth to “some days it do be like that, and we may never know why” in a nutshell.
  • rwmj 38 minutes ago
    What MSFT support policy do you need to have the legendary Raymond Chen take a look at it?

    I say this because we've reported a bunch of Windows bugs (mainly running Windows under virtualization) and getting them to pay attention at all is an up-hill battle.

    [-]
    • hackyhacky 20 minutes ago
      > What MSFT support policy do you need to have the legendary Raymond Chen take a look at it?

      If you have to ask, you can't afford it.

  • kumarvvr 1 hour ago
    I see posts like this, this deep dive into the call stacks and am always humbled and reminded of the limits of my knowledge about computers and programs.
    [-]
    • dist-epoch 59 minutes ago
      Goes both ways, author probably knows little about FPGA programming, React or PyTorch.
    • Panzer04 1 hour ago
      Not a programmer?
      [-]
      • kumarvvr 51 minutes ago
        I am, for 20 years now. I do embedded stuff too. Still.
        [-]
        • Panzer04 33 minutes ago
          I'm a bit surprised you don't run into things like this then :). Do you use GDB and the like at all?

          Or do you mean all the windows specific stuff etc, I guess I was more imaging the call stack etc.

          No insult was intended XD

          [-]
          • FartyMcFarter 20 minutes ago
            As someone who has debugged his fair share of tricky low-level issues, the parts that I find impressive in his blog posts are things such as "then we look at the bytes in memory and oh yeah, this looks like an exception record". I would usually not think to do that (or be able to recognise it as easily as I presume he did).
          • kumarvvr 25 minutes ago
            I have done everything from desktop apps to web apps and a bunch in between. Regular debugging is good enough for me. Never had the need to go down into call stack level.

            Even with embedded programming, regular C debugger has always been enough.

  • defrost 1 hour ago
    That's some doggedly determined back tracing to uncover an unexpected heisenbug (loose meaning).

      So a total of 46% of the crashes were due to this rogue force-unload of a DLL. This is a case of bucket spray, where a single underlying cause generates a large number of different types of crashes.
    [-]
    • chrisjj 1 hour ago
      We've not yet seen sufficient evidence this is any type of heisenbug.
      [-]
      • defrost 47 minutes ago
        It's not, by the article, in a strict taxonomy.

        In a wider sloppier sense some use the term for bugs that are hard to pin down and exhibit wide behaviours.

      • brookst 59 minutes ago
        Looking more closely would resolve it one way or the other.
        [-]