rust-windowing / rust-windowing/winit

[Windows] "Misaligned Pointer Dereference" panic for i686-windows-msvc when you hover a file (debug mode)

Open
#2,932 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

DS - win32
Dominant language
Rust
Stars
6.2k
Forks
1.3k
Avg merge
2d 19h
Merged PRs (30d)
9

Description

OS rustc
Windows 11 1.70.0

Winit versions tested & observed to have this issue:

  • 0.27.5 (first observation, through iced-0.9.0)
  • 0.28.6 (latest as of this bug report)

Replicating the Issue

I was able to replicate the issue with the following steps:

  1. Install the i686-pc-windows-msvc target:
rustup target add i686-pc-windows-msvc
  1. Compile and run the code below with the target set to i686-pc-windows-msvc:
use winit::{
    event::{Event, WindowEvent},
    event_loop::{ControlFlow, EventLoop},
    window::WindowBuilder,
};

fn main() {
    let event_loop = EventLoop::new();
    let window = WindowBuilder::new().build(&event_loop).unwrap();

    event_loop.run(move |event, _, control_flow| {
        *control_flow = ControlFlow::Wait;

        match event {
            Event::WindowEvent {
                event: WindowEvent::CloseRequested,
                window_id,
            } if window_id == window.id() => *control_flow = ControlFlow::Exit,

            Event::WindowEvent { event, .. } => match event {
                WindowEvent::DroppedFile(_) => println!("File dropped!"),
                WindowEvent::HoveredFile(_) => println!("File hovered!"),
                WindowEvent::HoveredFileCancelled => println!("Hovered File cancelled!"),
                _ => ()
            },

            _ => (),
        }
    });
}

cargo run --target=i686-pc-windows-msvc

  1. Drag something onto the window.

  2. Watch the fireworks (full backtrace for version 0.28.6 at the bottom):

    Finished dev [unoptimized + debuginfo] target(s) in 6.96s
     Running `target\i686-pc-windows-msvc\debug\repeat.exe`
File hovered!
thread 'main' panicked at 'misaligned pointer dereference: address must be a multiple of 0x4 but is 0x1cf', C:\Users\boney\.cargo\registry\src\index.crates.io-6f17d22bba15001f\winit-0.27.5\src\platform_impl\windows\drop_handler.rs:109:9
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
thread 'main' panicked at 'panic in a function that cannot unwind', library\core\src\panicking.rs:126:5
   6:   0x1396b2 - std::panicking::rust_panic_with_hook
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library\std\src\panicking.rs:691
   7:   0x13941d - std::panicking::begin_panic_handler::closure$0
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library\std\src\panicking.rs:580
   8:   0x137c95 - std::sys_common::backtrace::__rust_end_short_backtrace<std::panicking::begin_panic_handler::closure_env$0,never$>
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library\std\src\sys_common\backtrace.rs:150
   9:   0x139144 - std::panicking::begin_panic_handler
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library\std\src\panicking.rs:578
  10:   0x14c34c - core::panicking::panic_nounwind_fmt
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library\core\src\panicking.rs:96
  11:   0x14c407 - core::panicking::panic_nounwind
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library\core\src\panicking.rs:126
  12:   0x14c53c - core::panicking::panic_cannot_unwind
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library\core\src\panicking.rs:188
  13: 0x766d8b93 - GetActiveObjectExt
  14: 0x7658fcad - I_RpcFreeSystemHandleCollection
  15:  0x158d478 - <unknown>
thread caused non-unwinding panic. aborting.
error: process didn't exit successfully: `target\i686-pc-windows-msvc\debug\repeat.exe` (exit code: 0xc0000409, STATUS_STACK_BUFFER_OVERRUN)

Observations

  • The panic only kicks in when compiled in debug mode. When run in release mode, the program doesn't seem to crash, but when you attempt to drop a file onto the window, it will not print "file dropped!", i.e WindowEvent::DroppedFile(..) wasn't emitted.
  • Sometimes you need to drag something over the window a few times to trigger the panic.
  • Pointer alignment of the received address is not constant - even when you use the same file.
    e.g. I got a multiple of 0x1cf, 0xd7, 0x17e etc.

Full Backtrace (0.28.6)

    Finished dev [unoptimized + debuginfo] target(s) in 0.04s
     Running `target\i686-pc-windows-msvc\debug\repeat.exe`
File hovered!
thread 'main' panicked at 'misaligned pointer dereference: address must be a multiple of 0x4 but is 0x17e', C:\Users\boney\.cargo\registry\src\index.crates.io-6f17d22bba15001f\winit-0.28.6\src\platform_impl\windows\drop_handler.rs:108:9
stack backtrace:
   0:   0xb6f10a - core::fmt::write
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library\core\src\fmt\mod.rs:1254
   1:   0xb58f11 - std::io::Write::write_fmt<std::sys::windows::stdio::Stderr>
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library\std\src\io\mod.rs:1698
   2:   0xb5bb95 - std::sys_common::backtrace::_print
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library\std\src\sys_common\backtrace.rs:47
   3:   0xb5bb95 - std::sys_common::backtrace::print
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library\std\src\sys_common\backtrace.rs:34
   4:   0xb5d967 - std::panicking::default_hook::closure$1
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library\std\src\panicking.rs:269
   5:   0xb5d5c4 - std::panicking::default_hook
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library\std\src\panicking.rs:288
   6:   0xb5e0f2 - std::panicking::rust_panic_with_hook
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library\std\src\panicking.rs:691
   7:   0xb5deb5 - std::panicking::begin_panic_handler::closure$0
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library\std\src\panicking.rs:582
   8:   0xb5c6c5 - std::sys_common::backtrace::__rust_end_short_backtrace<std::panicking::begin_panic_handler::closure_env$0,never$>
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library\std\src\sys_common\backtrace.rs:150
   9:   0xb5db84 - std::panicking::begin_panic_handler
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library\std\src\panicking.rs:578
  10:   0xb7537f - core::panicking::panic_fmt
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library\core\src\panicking.rs:67
  11:   0xb755c9 - core::panicking::panic_misaligned_pointer_dereference
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library\core\src\panicking.rs:174
  12:   0xb4754b - winit::platform_impl::platform::drop_handler::FileDropHandler::DragEnter
                       at C:\Users\boney\.cargo\registry\src\index.crates.io-6f17d22bba15001f\winit-0.28.6\src\platform_impl\windows\drop_handler.rs:108
  13: 0x766d8b93 - GetActiveObjectExt
  14: 0x76594b84 - NdrGetTypeFlags
  15: 0x76554bf0 - pfnUnmarshallRoutines
  16: 0x76555ec2 - NdrStubCall2
  17: 0x76c33c21 - CStdStubBuffer_Invoke
  18: 0x76c3382b - CoUninitialize
  19: 0x76c334f9 - CoUninitialize
  20: 0x76cf7a68 - Ordinal1
  21: 0x76c51cae - CoGetApartmentType
  22: 0x76c83af4 - Ordinal100
  23: 0x76c894df - Ordinal228
  24: 0x76c87471 - Ordinal228
  25: 0x76c86da8 - Ordinal228
  26: 0x76c82b08 - Ordinal100
  27: 0x76c227f1 - Ordinal87
  28: 0x76c2137e - Ordinal87
  29: 0x76ff22e3 - Ordinal2713
  30: 0x76fe3006 - CallWindowProcW
  31: 0x76fe18c5 - DispatchMessageW
  32: 0x76fe1410 - DispatchMessageW
  33:   0xaf2520 - winit::platform_impl::platform::event_loop::EventLoop<tuple$<> >::run_return<tuple$<>,repeat::main::closure_env$0>
                       at C:\Users\boney\.cargo\registry\src\index.crates.io-6f17d22bba15001f\winit-0.28.6\src\platform_impl\windows\event_loop.rs:282
  34:   0xaf280b - winit::platform_impl::platform::event_loop::EventLoop<tuple$<> >::run<tuple$<>,repeat::main::closure_env$0>
                       at C:\Users\boney\.cargo\registry\src\index.crates.io-6f17d22bba15001f\winit-0.28.6\src\platform_impl\windows\event_loop.rs:245
  35:   0xb0b842 - winit::event_loop::EventLoop<tuple$<> >::run<tuple$<>,repeat::main::closure_env$0>
                       at C:\Users\boney\.cargo\registry\src\index.crates.io-6f17d22bba15001f\winit-0.28.6\src\event_loop.rs:305
  36: 0x7726b680 - LdrHotPatchNotify
  37:   0xb023d7 - core::ops::function::FnOnce::call_once<void (*)(),tuple$<> >
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca\library\core\src\ops\function.rs:250
  38:   0xafea4f - std::sys_common::backtrace::__rust_begin_short_backtrace<void (*)(),tuple$<> >
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca\library\std\src\sys_common\backtrace.rs:134
  39:   0xafea4f - std::sys_common::backtrace::__rust_begin_short_backtrace<void (*)(),tuple$<> >
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca\library\std\src\sys_common\backtrace.rs:134
  40:   0xb5625a - core::ops::function::impls::impl$2::call_once
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library\core\src\ops\function.rs:287
  41:   0xb5625a - std::panicking::try::do_call
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library\std\src\panicking.rs:485
  42:   0xb5625a - std::panicking::try
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library\std\src\panicking.rs:449
  43:   0xb5625a - std::panic::catch_unwind
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library\std\src\panic.rs:140
  44:   0xb5625a - std::rt::lang_start_internal::closure$2
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library\std\src\rt.rs:148
  45:   0xb5625a - std::panicking::try::do_call
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library\std\src\panicking.rs:485
  46:   0xb5625a - std::panicking::try
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library\std\src\panicking.rs:449
  47:   0xb5625a - std::panic::catch_unwind
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library\std\src\panic.rs:140
  48:   0xb5625a - std::rt::lang_start_internal
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library\std\src\rt.rs:148
  49:   0xb0815e - std::rt::lang_start<tuple$<> >
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca\library\std\src\rt.rs:165
  50:   0xb73b3d - invoke_main
                       at D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:78
  51:   0xb73b3d - __scrt_common_main_seh
                       at D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
  52: 0x76a47d59 - BaseThreadInitThunk
  53: 0x7724b74b - RtlInitializeExceptionChain
  54: 0x7724b6cf - RtlClearBits
thread 'main' panicked at 'panic in a function that cannot unwind', library\core\src\panicking.rs:126:5
stack backtrace:
   0:   0xb6f10a - core::fmt::write
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library\core\src\fmt\mod.rs:1254
   1:   0xb58f11 - std::io::Write::write_fmt<std::sys::windows::stdio::Stderr>
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library\std\src\io\mod.rs:1698
   2:   0xb5bb95 - std::sys_common::backtrace::_print
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library\std\src\sys_common\backtrace.rs:47
   3:   0xb5bb95 - std::sys_common::backtrace::print
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library\std\src\sys_common\backtrace.rs:34
   4:   0xb5d967 - std::panicking::default_hook::closure$1
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library\std\src\panicking.rs:269
   5:   0xb5d5c4 - std::panicking::default_hook
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library\std\src\panicking.rs:288
   6:   0xb5e0f2 - std::panicking::rust_panic_with_hook
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library\std\src\panicking.rs:691
   7:   0xb5de5d - std::panicking::begin_panic_handler::closure$0
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library\std\src\panicking.rs:580
   8:   0xb5c6c5 - std::sys_common::backtrace::__rust_end_short_backtrace<std::panicking::begin_panic_handler::closure_env$0,never$>
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library\std\src\sys_common\backtrace.rs:150
   9:   0xb5db84 - std::panicking::begin_panic_handler
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library\std\src\panicking.rs:578
  10:   0xb753ec - core::panicking::panic_nounwind_fmt
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library\core\src\panicking.rs:96
  11:   0xb754a7 - core::panicking::panic_nounwind
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library\core\src\panicking.rs:126
  12:   0xb755dc - core::panicking::panic_cannot_unwind
                       at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library\core\src\panicking.rs:188
  13: 0x766d8b93 - GetActiveObjectExt
  14: 0x7658fcad - I_RpcFreeSystemHandleCollection
  15:   0xc062d0 - <unknown>
thread caused non-unwinding panic. aborting.
error: process didn't exit successfully: `target\i686-pc-windows-msvc\debug\repeat.exe` (exit code: 0xc0000409, STATUS_STACK_BUFFER_OVERRUN)

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the issue with the provided example using cargo run --target=i686-pc-windows-msvc, then inspect platform_impl/windows/drop_handler.rs around lines 108-109 and the event-loop path shown in the backtrace. Verify the result in debug mode by dragging a file over the window; done means no misaligned-pointer panic and the expected file-drop event is emitted.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
desktop, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
28/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.