Repository navigation
Fix Explorer crash when Open-Shell exits while the menu is open - #2576
Merged
Merged
Conversation
CleanStartMenuDLL called CloseManagers() before CMenuContainer::CloseStartMenu(). When the start menu was still open at exit, destroying it ran CMenuContainer::OnDestroy -> g_SearchManager.CloseMenu(), which locks the search manager's critical section. CloseManagers had already deleted that lock, so Explorer crashed with an access violation in ntdll!RtlpWaitOnCriticalSection. This order dates back to at least the Classic Shell -> Open-Shell rebrand and is in 4.4.198 and current master. The menu, the settings window and the owner window are now closed before the managers are shut down. Found with a crash dump (WER LocalDumps + full page heap on explorer.exe): StartMenuDLL!CSearchManager::CloseMenu+0x2d (SearchManager.cpp:139) StartMenuDLL!CMenuContainer::OnDestroy+0x361 ... StartMenuDLL!CMenuContainer::CloseStartMenu+0xa0 StartMenuDLL!CleanStartMenuDLL+0x605 StartMenuDLL!HookDesktopThread+0x7e6 FAILURE_BUCKET_ID: NULL_CLASS_PTR_WRITE_AVRF_c0000005_StartMenuDLL.dll!CSearchManager::CloseMenu Reproduce: start StartMenu.exe, run "StartMenu.exe -open", and while the menu is visible run "StartMenu.exe -exit". Explorer restarts. Verified on Windows 11 (26100): unmodified master crashed Explorer in every run with the menu open at exit; with this change, 5 of 5 such runs exited cleanly.
ge0rdi
approved these changes
Nov 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CleanStartMenuDLLcalledCloseManagers()beforeCMenuContainer::CloseStartMenu().If the start menu was open at exit, destroying it ran
CMenuContainer::OnDestroy→g_SearchManager.CloseMenu(), which locks the search manager's critical section. Thatlock had already been deleted, so Explorer crashed.
The fix closes the menu, the settings window and the owner window before the managers are
shut down. The order has been like this since at least the Classic Shell → Open-Shell
rebrand, so 4.4.198 is affected too.
To reproduce: start
StartMenu.exe, runStartMenu.exe -open, and while the menu isvisible run
StartMenu.exe -exit. Explorer restarts.Tested on Windows 11 26100: unmodified master crashed Explorer in every run with the
menu open at exit. With this change, 5 of 5 such runs exited cleanly.
That test ran on master 1384d4e. The branch has since been rebased onto current master (9dfa7fa) with the same change, and I've been running it in my daily build since then.