Skip to content

nvdaHelperLocal dll import table hook for oleacc SendMessageTimeoutW not being used #14746

@jcsteh

Description

@jcsteh

Steps to reproduce:

  1. Press Windows+r to open the Run dialog.
  2. Type \\1.2.3.4 and press enter.
  3. NVDA will stop responding because Explorer stops responding. Press alt+tab to switch apps.

Actual behavior:

NVDA freezes until Explorer responds again.

Expected behavior:

NVDA shouldn't freeze; watchdog should kill the unresponsive call when you alt+tab.

System configuration

NVDA installed/portable/running from source:

Installed.

NVDA version:

alpha-27892,42dbabcc

Windows version:

Windows 11 Version 22H2 (OS Build 22621.1413)
Also reproduced on Windows 11 Version 21H2 (OS Build 22000.1696)

Other info

Relevant NVDA log snippet

ERROR - watchdog._watcher (08:56:19.048) - watchdog (21904):
Core frozen in stack!
INFO - watchdog._watcher (08:56:19.051) - watchdog (21904):
Listing stacks for Python threads:
...
Python stack for thread 13448 (MainThread):
  File "nvda.pyw", line 390, in <module>
  File "core.pyc", line 776, in main
  File "wx\core.pyc", line 2237, in MainLoop
  File "gui\__init__.pyc", line 760, in Notify
  File "core.pyc", line 738, in run
  File "queueHandler.pyc", line 88, in pumpAll
  File "queueHandler.pyc", line 55, in flushQueue
  File "scriptHandler.pyc", line 170, in _queueScriptCallback
  File "keyboardHandler.pyc", line 531, in executeScript
  File "inputCore.pyc", line 199, in executeScript
  File "scriptHandler.pyc", line 216, in executeScript
  File "editableText.pyc", line 187, in script_caret_newLine
  File "editableText.pyc", line 86, in _hasCaretMoved
  File "api.pyc", line 368, in processPendingEvents
  File "IAccessibleHandler\__init__.pyc", line 1075, in pumpAll
  File "IAccessibleHandler\__init__.pyc", line 724, in processFocusWinEvent
  File "IAccessibleHandler\__init__.pyc", line 576, in winEventToNVDAEvent
  File "NVDAObjects\IAccessible\__init__.pyc", line 64, in getNVDAObjectFromEvent
  File "IAccessibleHandler\__init__.pyc", line 349, in accessibleObjectFromEvent
  File "oleacc.pyc", line 265, in AccessibleObjectFromEvent

WinDBG stack for main thread

0:018:x86> ~0 kpn
 # ChildEBP RetAddr
00 00cfd814 7614d892 win32u!NtUserMessageCall+0xc
01 00cfd85c 76190a21 USER32!SendMessageTimeoutWorker+0xc2
02 00cfd87c 6f1291d2 USER32!SendMessageTimeoutW+0x21
03 00cfd8b8 6f129082 OLEACC!NativeIAccessibleFromWindow+0x70
04 00cfd8e8 6f150972 OLEACC!AccessibleObjectFromWindow+0x27
05 00cfd924 6f150f97 OLEACC!AccessibleObjectFromEvent+0x5e
06 00cfd938 706ce7ba OLEACC!EXTERNAL_AccessibleObjectFromEvent+0x27
WARNING: Stack unwind information not available. Following frames may be wrong.
07 00cfd958 706cd10b _ctypes!DllCanUnloadNow+0x628a
08 00cfd994 706c926f _ctypes!DllCanUnloadNow+0x4bdb
09 00cfda54 706c9a5e _ctypes!DllCanUnloadNow+0xd3f
0a 00cfdb54 706c59a1 _ctypes!DllCanUnloadNow+0x152e
0b 00cfdba4 702d817b _ctypes+0x59a1
0c 00cfdbc8 703735be python37!PyObject_FastCallKeywords+0x15b
...

Analysis

We're calling AccessibleObjectFromEvent. That calls SendMessageTimeoutW (frame 2). However, NVDA installs a dll import table hook in oleacc for SendMessageTimeoutW:
oleaccHooks->requestFunctionHook("USER32.dll", "SendMessageTimeoutW", fake_SendMessageTimeoutW);
We don't see fake_SendMessageTimeoutW nor cancellableSendMessageTimeout in the stack! We should see this between frames 2 and 3.
This suggests that these hooks aren't working for some reason. That's pretty concerning, since watchdog depends on these to keep NVDA responsive in quite a few cases.

CC @michaelDCurran.

Metadata

Metadata

Assignees

Labels

bug/app-freezebug/freezep2https://github.com/nvaccess/nvda/blob/master/projectDocs/issues/triage.md#prioritytriagedHas been triaged, issue is waiting for implementation.

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions