Skip to content

[BUG] [Crash] Windows UI Click causes Invalid Pointer Read in flutter_windows.dll #1342

@Ethan0x0000

Description

@Ethan0x0000

操作系统/Operating System

Windows

系统版本/Operating System Version

Windows 11 Professional 25H2 (Build 26100.1)

App版本/App Version

1.2.14.1701

描述/Describeption

Issue Description

Application crashes with "Error launching CrashSender.exe" error when clicking UI elements. High probability of crash occurrence. Crash generates Windows minidump file.

Crash Analysis (WinDbg)

Exception Information

Property | Value -- | -- Exception Code | 0xc0000005 (Access Violation) Exception Type | INVALID_POINTER_READ Faulting Module | flutter_windows.dll Crash Function | WindowManager_SetWindowContentSize

Technical Details

 Crash Instruction:
 flutter_windows!InternalFlutterWindows_WindowManager_SetWindowContentSize+0x5540
 mov eax,dword ptr [rax+50h]
 
 Registers:
 rax = 0000000000000000 (NULL pointer)
 Attempt to read from address 0000000000000050

Stack Trace

 flutter_windows!InternalFlutterWindows_WindowManager_SetWindowContentSize+0x5540
 flutter_windows!InternalFlutterWindows_WindowManager_SetWindowContentSize+0x4bfe
 flutter_windows!FlutterDesktopTextureRegistrarMarkExternalTextureFrameAvailable+0x4276
 flutter_windows!InternalFlutterWindows_WindowManager_SetWindowContentSize+0x9ea57
 flutter_windows!InternalFlutterWindows_WindowManager_SetWindowContentSize+0xaded1
 flutter_windows!InternalFlutterWindows_WindowManager_SetWindowContentSize+0xade2c
 flutter_windows!InternalFlutterWindows_WindowManager_SetWindowContentSize+0x6bc9ca
 flutter_windows!InternalFlutterWindows_WindowManager_SetWindowContentSize+0x6b4be3
 flutter_windows!InternalFlutterWindows_WindowManager_SetWindowContentSize+0x6a2b37

Additional Context

  • Windows Error Reporting Service (WerSvc) was disabled on the system

  • This may be related to system modification using Windows Defender removal scripts

  • Application is built with Flutter framework

  • Crash occurs in Flutter's window management code, not in Karing's custom code

System Information

 OS Version: 10.0.26100.1
 Build Lab: ge_release
 Platform: x64
 Crash Dump: karing.exe.88416.dmp (39MB)

Attachments

  • Crash dump file available at: C:\Users\Ethan\AppData\Local\CrashDumps\karing.exe.88416.dmp

Expected Behavior

Application should not crash when clicking UI elements.

Possible Root Cause

This appears to be a bug in the Flutter framework itself (flutter_windows.dll), specifically in the window management code. The crash occurs when attempting to read from a NULL pointer during window size/content operations.

复现步骤/Reproduction steps

  1. Start Karing application
  2. Click any UI element (button, menu, etc.)
  3. Application crashes immediately
  4. Windows shows error dialog about CrashSender.exe "Error lauching CrashSender.exe"

日志/Log

*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************


KEY_VALUES_STRING: 1

    Key  : AV.Type
    Value: Read

    Key  : Analysis.CPU.mSec
    Value: 750

    Key  : Analysis.Elapsed.mSec
    Value: 29693

    Key  : Analysis.IO.Other.Mb
    Value: 0

    Key  : Analysis.IO.Read.Mb
    Value: 1

    Key  : Analysis.IO.Write.Mb
    Value: 49

    Key  : Analysis.Init.CPU.mSec
    Value: 265

    Key  : Analysis.Init.Elapsed.mSec
    Value: 20166

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 114

    Key  : Analysis.Version.DbgEng
    Value: 10.0.29507.1001

    Key  : Analysis.Version.Description
    Value: 10.2511.5.1 amd64fre

    Key  : Analysis.Version.Ext
    Value: 1.2511.5.1

    Key  : Failure.Bucket
    Value: INVALID_POINTER_READ_c0000005_flutter_windows.dll!Unknown

    Key  : Failure.Exception.Code
    Value: 0xc0000005

    Key  : Failure.Exception.IP.Address
    Value: 0x7ffef9d4a8dc

    Key  : Failure.Exception.IP.Module
    Value: flutter_windows

    Key  : Failure.Exception.IP.Offset
    Value: 0x3a8dc

    Key  : Failure.Hash
    Value: {5878de7f-c60d-ed9e-ed48-7758ffd479b6}

    Key  : Failure.ProblemClass.Primary
    Value: INVALID_POINTER_READ

    Key  : Faulting.IP.Type
    Value: Paged

    Key  : Timeline.OS.Boot.DeltaSec
    Value: 110935

    Key  : Timeline.Process.Start.DeltaSec
    Value: 5195

    Key  : WER.OS.Branch
    Value: ge_release

    Key  : WER.OS.Version
    Value: 10.0.26100.1

    Key  : WER.Process.Version
    Value: 1.2.14.1701


FILE_IN_CAB:  karing.exe.88416.dmp

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

CONTEXT:  (.ecxr)
rax=0000000000000000 rbx=0000000000149130 rcx=57660af972810000
rdx=000000005a6d7640 rsi=000000005a82f5a0 rdi=0000000051dc0020
rip=00007ffef9d4a8dc rsp=0000000000148ee0 rbp=0000000000000007
 r8=0000000000000007  r9=0000000000000002 r10=000000005a42e570
r11=0000000000148dc0 r12=000000005a778704 r13=000000005a7786f8
r14=0000000000149170 r15=0000000000148f18
iopl=0         nv up ei pl nz na pe nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010200
flutter_windows!InternalFlutterWindows_WindowManager_SetWindowContentSize+0x5540:
00007ffe`f9d4a8dc 8b4050          mov     eax,dword ptr [rax+50h] ds:00000000`00000050=????????
Resetting default scope

EXCEPTION_RECORD:  (.exr -1)
ExceptionAddress: 00007ffef9d4a8dc (flutter_windows!InternalFlutterWindows_WindowManager_SetWindowContentSize+0x0000000000005540)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 0000000000000050
Attempt to read from address 0000000000000050

PROCESS_NAME:  karing.exe

READ_ADDRESS:  0000000000000050 

ERROR_CODE: (NTSTATUS) 0xc0000005 - 0x%p            0x%p                    %s

EXCEPTION_CODE_STR:  c0000005

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000050

STACK_TEXT:  
00000000`00148ee0 00007ffe`f9d49f9a     : 00000000`5a8c68e8 00000000`00000000 00000000`00419c00 00000000`004102b0 : flutter_windows!InternalFlutterWindows_WindowManager_SetWindowContentSize+0x5540
00000000`00149350 00007ffe`f9d2a092     : 00005766`0aedeb91 00000000`00000000 00000000`0014a020 00000000`001499b8 : flutter_windows!InternalFlutterWindows_WindowManager_SetWindowContentSize+0x4bfe
00000000`00149940 00007ffe`f9de3df3     : 00000000`00000002 00000000`00000000 00000000`00149d68 00000000`000002a0 : flutter_windows!FlutterDesktopTextureRegistrarMarkExternalTextureFrameAvailable+0x4276
00000000`00149990 00007ffe`f9df326d     : 00000000`00149d68 00000000`5a8c38e0 00000000`00149ba8 00007ffe`fa402044 : flutter_windows!InternalFlutterWindows_WindowManager_SetWindowContentSize+0x9ea57
00000000`00149ad0 00007ffe`f9df31c8     : 00000000`00149c30 00000000`00000000 00000000`5a8c3e40 00000000`00000000 : flutter_windows!InternalFlutterWindows_WindowManager_SetWindowContentSize+0xaded1
00000000`00149b20 00007ffe`fa401d66     : 00000000`00000080 00007ffe`faaab94f 00000000`5ab2ab80 00000000`00149d68 : flutter_windows!InternalFlutterWindows_WindowManager_SetWindowContentSize+0xade2c
00000000`00149c00 00007ffe`fa3f9f7f     : 00000000`00000000 00000000`005d0000 00000000`0014a020 00007fff`7d3bcca4 : flutter_windows!InternalFlutterWindows_WindowManager_SetWindowContentSize+0x6bc9ca
00000000`00149ce0 00007ffe`fa3e7ed3     : 00000000`00000010 00007ffe`f9d17983 00000000`00149f48 00000000`5ab2ab80 : flutter_windows!InternalFlutterWindows_WindowManager_SetWindowContentSize+0x6b4be3
00000000`00149e40 00007ffe`fa482856     : 00000000`00000000 00000000`51df4e98 00000000`4dbcb680 00007ffe`fa955153 : flutter_windows!InternalFlutterWindows_WindowManager_SetWindowContentSize+0x6a2b37
00000000`00149f20 00000000`4d1ee2c1     : 00007ffe`fa41b170 00000000`4dbcb680 00000000`51df4e80 00007ffe`fa419548 : flutter_windows!InternalFlutterWindows_WindowManager_SetWindowContentSize+0x73d4ba
00000000`0014a000 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x4d1ee2c1


STACK_COMMAND: ~0s; .ecxr ; kb

IP_IN_PAGED_CODE: 
flutter_windows!InternalFlutterWindows_WindowManager_SetWindowContentSize+5540
00007ffe`f9d4a8dc 8b4050          mov     eax,dword ptr [rax+50h]

SYMBOL_NAME:  flutter_windows+3a8dc

MODULE_NAME: flutter_windows

IMAGE_NAME:  flutter_windows.dll

FAILURE_BUCKET_ID:  INVALID_POINTER_READ_c0000005_flutter_windows.dll!Unknown

OS_VERSION:  10.0.26100.1

BUILDLAB_STR:  ge_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {5878de7f-c60d-ed9e-ed48-7758ffd479b6}

Followup:     MachineOwner
---------

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions