Win10旧Metro应用随机文件访问错误及RuntimeBroker崩溃排查

问题背景 #

有一个需在Windows 10上运行的旧Metro应用，通过Documents Library与本地其他进程交互执行文件操作，多数情况下运行正常，但偶尔会触发异常。

触发异常的代码 #

StorageFolder flagFolder = await KnownFolders.DocumentsLibrary.GetFolderAsync(dirPath);

异常日志 #

Message: The RPC server is unavailable. (Exception from HRESULT: 0x800706BA)
Source : Windows.Storage
Type   : System.Exception
Stack  :
 at Windows.Storage.KnownFolders.get_DocumentsLibrary()
 at XXX.<TimerTick>d__a.MoveNext()

事件查看器记录的RuntimeBroker崩溃日志 #

Faulting application name: RuntimeBroker.exe, version: 10.0.19041.746, time stamp: 0x5b78739c
Faulting module name: shcore.dll, version: 10.0.19041.746, time stamp: 0x5e98fab6
Exception code: 0xc0000005
Fault offset: 0x0000000000022227
Faulting process id: 0xe94
Faulting application start time: 0x01d8f4397cb4625c
Faulting application path: C:\Windows\System32\RuntimeBroker.exe
Faulting module path: C:\Windows\System32\shcore.dll
Report Id: ce450896-5110-4b5e-9aa2-a6ea4182d40a
Faulting package full name: XXX
Faulting package-relative application ID: runtimebroker07f4358a809ac99a64a67c1

异常后应用症状 #

• 无法从线程池注册新线程
• 依赖线程池的定时器失效
• 仍可向之前打开的日志文件写入
• 约半小时后，无法在Documents Library中读写新文件，触发相同RPC异常

Windbg转储分析结果 #

堆栈信息 #

[0x0]   ntdll!NtWaitForMultipleObjects + 0x14   
[0x1]   KERNELBASE!WaitForMultipleObjectsEx + 0xf0   
[0x2]   KERNELBASE!WaitForMultipleObjects + 0xe   
[0x3]   kernel32!WerpReportFaultInternal + 0x58a   
[0x4]   kernel32!WerpReportFault + 0xbe   
[0x5]   KERNELBASE!UnhandledExceptionFilter + 0x3d9   
[0x6]   ntdll!RtlUserThreadStart$filt$0 + 0xa2   
[0x7]   ntdll!_C_specific_handler + 0x96   
[0x8]   ntdll!RtlpExecuteHandlerForException + 0xf   
[0x9]   ntdll!RtlDispatchException + 0x244   
[0xa]   ntdll!KiUserExceptionDispatch + 0x2e   
[0xb]   SHCore!COplockFileHandle::_Initialize + 0x167   
[0xc]   SHCore!COplockFileHandle::s_CreateInstance + 0xaa   
[0xd]   SHCore!SHManagedCreateFile + 0x1ff   
[0xe]   SHCore!CSafeSaveHandleManager::_EnsureMainHandle + 0x154   
[0xf]   SHCore!CSafeSaveHandleManager::GetHandleForRead + 0x4a   
[0x10]   SHCore!`anonymous namespace'::_CreateRandomAccessStreamOnFileHelper + 0xd6   
[0x11]   SHCore!CreateRandomAccessStreamOnFileWithOptions + 0x19   
[0x12]   windows_storage!CFSFolder::_BindToChild + 0xdb3   
[0x13]   windows_storage!CFSFolder::_Bind + 0x9de   
[0x14]   windows_storage!CFSFolder::BindToObject + 0x44e   
[0x15]   windows_storage!CShellItem::BindToHandler + 0x548   
[0x16]   windows_storage!_CreateRandomAccessStream + 0xeb   
[0x17]   windows_storage!CShellItem::BindToHandler + 0x67b   
[0x18]   windows_storage!CStorageFileBase::s_OpenAsyncPrivateWorker + 0x1ae   
[0x19]   windows_storage!<lambda_6590a290d3704fa33cc8569c7c432ebe>::operator() + 0x135   
[0x1a]   windows_storage!<lambda_b0a6a9cfa44b8f830e3e8e8eecceff13>::operator() + 0x74   
[0x1b]   windows_storage!Windows::Internal::COperationLambdaVar<0,<lambda_b0a6a9cfa44b8f830e3e8e8eecceff13>,Windows::Internal::CMarshaledInterfaceResult<Windows::Storage::Streams::IInputStream> >::Run + 0x23   
[0x1c]   windows_storage!Windows::Internal::AsyncOperation<Windows::Foundation::IAsyncOperation<Windows::Storage::Streams::IInputStream *>,Windows::Foundation::IAsyncOperationCompletedHandler<Windows::Storage::Streams::IInputStream *>,Windows::Internal::CMarshaledInterfaceResult<Windows::Storage::Streams::IInputStream>,Windows::Internal::ComTaskPoolHandler,Windows::Internal::INilDelegate,Microsoft::WRL::AsyncOptions<-1,0,&GUID_CAUSALITY_WINDOWS_PLATFORM_ID,2> >::Run + 0x79   
[0x1d]   SHCore!WorkThreadManager::CThread::ThreadProc + 0x1d0   
[0x1e]   SHCore!WorkThreadManager::CThread::s_ExecuteThreadProc + 0x18   
[0x1f]   SHCore!<lambda_9844335fc14345151eefcc3593dd6895>::<lambda_invoker_cdecl> + 0x11   
[0x20]   kernel32!BaseThreadInitThunk + 0x14   
[0x21]   ntdll!RtlUserThreadStart + 0x21   

分析摘要 #

STACK_COMMAND:  ~4s; .ecxr ; kb

SYMBOL_NAME:  SHCore!COplockFileHandle::_Initialize+167

MODULE_NAME: SHCore

IMAGE_NAME:  SHCore.dll

FAILURE_BUCKET_ID:  NULL_POINTER_READ_c0000005_SHCore.dll!COplockFileHandle::_Initialize

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

IMAGE_VERSION:  10.0.19041.746

FAILURE_ID_HASH:  {6e7c4134-ffb6-90fc-7715-5adc39084c1a}

Followup:     MachineOwner

补充信息 #

• 重启电脑可解决问题，但并非可行方案
• 仅重启应用无法可靠修复
• 该应用在Windows 8、8.1及旧版Windows 10上运行时从未出现此问题

疑问 #

有没有人遇到过类似问题？这是什么原因导致的？

内容的提问来源于stack exchange，提问作者yanc