VirtualBox COM service crash at exit

[Mihai Hanor]

Host: Windows 7 x64

To reproduce, just launch VirtualBox with --startvm and an invalid VM UUID. After closing the VirtualBox error message box, VBoxSVC crashes at exit with this message box:

Microsoft Visual C++ Runtime Library
Runtime Error!
Program: C:\Program Files\Oracle\VirtualBox\VBoxSVC.exe

R6025
-pure virtual function call

The issue was also mentioned here and here

[Mihai Hanor]

I can also reproduce the problem with 4.3.17-96047.

[Mihai Hanor]

Also reproducible with 4.3.18. In real life usage, it occurs occasionally, after the last VM has closed.

[mag]

Same here. Started with 4.3.16 or 4.3.18 (not sure now) and it bugs me every time after the last running VM goes down. As expected there's nothing in the VBox.log at all. There's some brief information in the Windows event log as well as the Windows Error Report is generated for each occurrence - these all are attached in 13391-eventlog.zip

Windows 7 SP1 Professional x64

[Mihai Hanor]

This is how a crash backtrace looks like for the self-compiled OSE 4.3.22:

 VBoxSVC!ComPtr<VirtualBox>::copyFrom(class VirtualBox * p = 0x00000000`0579ef50)+0x4f [c:\work_x64\vbox\include\vbox\com\ptr.h @ 386]
 VBoxSVC!ComPtr<VirtualBox>::ComPtr<VirtualBox>(class VirtualBox * that_p = 0x00000000`0579ef50)+0x32 [c:\work_x64\vbox\include\vbox\com\ptr.h @ 160]
 VBoxSVC!ComObjPtr<VirtualBox>::ComObjPtr<VirtualBox>(class VirtualBox * that_p = 0x00000000`0579ef50)+0x32 [c:\work_x64\vbox\include\vbox\com\ptr.h @ 440]
 VBoxSVC!Medium::uninit(void)+0x4c [c:\work_x64\vbox\src\vbox\main\src-server\mediumimpl.cpp @ 1378]
 VBoxSVC!Medium::FinalRelease(void)+0x2e [c:\work_x64\vbox\src\vbox\main\src-server\mediumimpl.cpp @ 879]
 VBoxSVC!ATL::CComObjectNoLock<Medium>::~CComObjectNoLock<Medium>(void)+0x6f [c:\winddk\7600.16385.1\inc\atl71\atlcom.h @ 2736]
 VBoxSVC!ATL::CComObjectNoLock<Medium>::`scalar deleting destructor'(void)+0x2c
 VBoxSVC!ATL::CComObjectNoLock<Medium>::Release(void)+0x6f [c:\winddk\7600.16385.1\inc\atl71\atlcom.h @ 2749]
 combase!CStdIdentity::ReleaseCtrlUnk(unsigned long dwDisconnectType = 8)+0x83 [d:\9147\com\combase\dcomrem\stdid.cxx @ 1274]
 combase!CStdMarshal::Disconnect(unsigned long dwType = 8)+0x3a4 [d:\9147\com\combase\dcomrem\marshal.cxx @ 3805]
 combase!DisconnectSwitch(void * pv = 0x00000000`008eb110)+0x1b [d:\9147\com\combase\dcomrem\marshal.cxx @ 3446]
 combase!CStdMarshal::DisconnectAndRelease(unsigned long dwType = <Value unavailable error>)+0x2d [d:\9147\com\combase\dcomrem\marshal.cxx @ 3494]
 combase!COIDTable::ThreadCleanup(void)+0x105 [d:\9147\com\combase\dcomrem\idobj.cxx @ 1845]
 combase!FinishShutdown(void)+0xb1 [d:\9147\com\combase\class\compobj.cxx @ 2233]
 combase!NAUninitialize(void)+0x5c [d:\9147\com\combase\class\compobj.cxx @ 2431]
 combase!ApartmentUninitialize(int fHostThread = 0n0)+0x158 [d:\9147\com\combase\class\compobj.cxx @ 2612]
 combase!wCoUninitialize(class COleTls * Tls = 0x00000000`008eb620, int fHostThread = 0n0)+0x133 [d:\9147\com\combase\class\compobj.cxx @ 3947]
 combase!CoUninitialize(void)+0xb3 [d:\9147\com\combase\class\compobj.cxx @ 3814]
 VBoxSVC!com::Shutdown(void)+0x74 [c:\work_x64\vbox\src\vbox\main\glue\initterm.cpp @ 585]
 VBoxSVC!WinMain(struct HINSTANCE__ * hInstance = 0x00007ff6`38900000, struct HINSTANCE__ * __formal = 0x00000000`00000000, char * __formal = 0x00000000`021b5fe7 "-Embedding", int __formal = 0n10)+0x939 [c:\work_x64\vbox\src\vbox\main\src-server\win\svcmain.cpp @ 422]
 VBoxSVC!__tmainCRTStartup(void)+0x15f [f:\dd\vctools\crt_bld\self_64_amd64\crt\src\crtexe.c @ 547]
 kernel32!BaseThreadInitThunk+0x22
 ntdll!RtlUserThreadStart+0x34

The VirtualBox object (referenced by p) was previously freed here:

 ntdll!RtlDebugFreeHeap+0x0000000000000047
 ntdll!RtlpFreeHeap+0x00000000000779d1
 ntdll!RtlFreeHeap+0x0000000000000368
 msvcr100!free+0x000000000000001c
 VBoxSVC!ATL::CComObjectCached<VirtualBox>::`scalar deleting destructor'+0x0000000000000041
 VBoxSVC!ATL::CComObjectCached<VirtualBox>::Release+0x000000000000006f [c:\winddk\7600.16385.1\inc\atl71\atlcom.h @ 2678]
 VBoxSVC!ATL::CComPtrBase<IUnknown>::~CComPtrBase<IUnknown>+0x000000000000003f [c:\winddk\7600.16385.1\inc\atl71\atlcomcli.h @ 135]
 VBoxSVC!ATL::CComPtr<IUnknown>::~CComPtr<IUnknown>+0x0000000000000028
 VBoxSVC!CMyComClassFactorySingleton<VirtualBox>::~CMyComClassFactorySingleton<VirtualBox>+0x000000000000003e [c:\work_x64\vbox\src\vbox\main\include\virtualboxbase.h @ 78]
 VBoxSVC!ATL::CComObjectNoLock<CMyComClassFactorySingleton<VirtualBox> >::~CComObjectNoLock<CMyComClassFactorySingleton<VirtualBox> >+0x000000000000005e [c:\winddk\7600.16385.1\inc\atl71\atlcom.h @ 2740]
 VBoxSVC!ATL::CComObjectNoLock<CMyComClassFactorySingleton<VirtualBox> >::`scalar deleting destructor'+0x000000000000002c
 VBoxSVC!ATL::CComObjectNoLock<CMyComClassFactorySingleton<VirtualBox> >::Release+0x000000000000006b [c:\winddk\7600.16385.1\inc\atl71\atlcom.h @ 2749]
 combase!CClassCache::CLSvrClassEntry::CFinishObject::Finish+0x0000000000000061 [d:\9147\com\combase\objact\dllcache.cxx @ 1997]
 combase!CClassCache::Revoke+0x00000000000000aa [d:\9147\com\combase\objact\dllcache.cxx @ 6803]
 combase!CoRevokeClassObject+0x000000000000002e [d:\9147\com\combase\objact\sobjact.cxx @ 370]
 VBoxSVC!ATL::_ATL_OBJMAP_ENTRY30::RevokeClassObject+0x000000000000003b [c:\winddk\7600.16385.1\inc\atl71\atlbase.h @ 225]
 VBoxSVC!ATL::CComModule::RevokeClassObjects+0x000000000000005c [c:\winddk\7600.16385.1\inc\atl71\atlbase.h @ 7296]
 VBoxSVC!WinMain+0x000000000000091d [c:\work_x64\vbox\src\vbox\main\src-server\win\svcmain.cpp @ 415]
 VBoxSVC!__tmainCRTStartup+0x000000000000015f [f:\dd\vctools\crt_bld\self_64_amd64\crt\src\crtexe.c @ 547]
 kernel32!BaseThreadInitThunk+0x0000000000000022
 ntdll!RtlUserThreadStart+0x0000000000000034

[Mihai Hanor]

You can close this ticket, I haven't encountered the crash in a while.

[Frank Mehnert]

Thanks Mihai!