From c1cd5b87daf7f716f98b6cac87d490fb93bcfb48 Mon Sep 17 00:00:00 2001 From: Emilio Heredia Date: Thu, 24 Sep 2026 18:44:43 -0600 Subject: [PATCH] Fix Explorer crash when Open-Shell exits while the menu is open CleanStartMenuDLL called CloseManagers() before CMenuContainer::CloseStartMenu(). When the start menu was still open at exit, destroying it ran CMenuContainer::OnDestroy -> g_SearchManager.CloseMenu(), which locks the search manager's critical section. CloseManagers had already deleted that lock, so Explorer crashed with an access violation in ntdll!RtlpWaitOnCriticalSection. This order dates back to at least the Classic Shell -> Open-Shell rebrand and is in 4.4.198 and current master. The menu, the settings window and the owner window are now closed before the managers are shut down. Found with a crash dump (WER LocalDumps + full page heap on explorer.exe): StartMenuDLL!CSearchManager::CloseMenu+0x2d (SearchManager.cpp:139) StartMenuDLL!CMenuContainer::OnDestroy+0x361 ... StartMenuDLL!CMenuContainer::CloseStartMenu+0xa0 StartMenuDLL!CleanStartMenuDLL+0x605 StartMenuDLL!HookDesktopThread+0x7e6 FAILURE_BUCKET_ID: NULL_CLASS_PTR_WRITE_AVRF_c0000005_StartMenuDLL.dll!CSearchManager::CloseMenu Reproduce: start StartMenu.exe, run "StartMenu.exe -open", and while the menu is visible run "StartMenu.exe -exit". Explorer restarts. Verified on Windows 11 (26100): unmodified master crashed Explorer in every run with the menu open at exit; with this change, 5 of 5 such runs exited cleanly. --- Src/StartMenu/StartMenuDLL/StartMenuDLL.cpp | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/Src/StartMenu/StartMenuDLL/StartMenuDLL.cpp b/Src/StartMenu/StartMenuDLL/StartMenuDLL.cpp index 583c5b765..d487ee099 100644 --- a/Src/StartMenu/StartMenuDLL/StartMenuDLL.cpp +++ b/Src/StartMenu/StartMenuDLL/StartMenuDLL.cpp @@ -3314,14 +3314,17 @@ static void CleanStartMenuDLL( void ) ClearIatHook(g_ShellRegisterHotKeyHook); g_ShellRegisterHotKeyHook=NULL; - CloseManagers(false); - ClearIatHooks(); - - // cleanup + // close the menu and the settings before the managers. an open menu calls g_SearchManager.CloseMenu() when it is destroyed, + // and after CloseManagers that would use the search manager's deleted lock and crash Explorer (exiting with the menu open) if (g_Owner.m_hWnd) g_Owner.DestroyWindow(); CloseSettings(); CMenuContainer::CloseStartMenu(); CMenuFader::ClearAll(); + + CloseManagers(false); + ClearIatHooks(); + + // cleanup UnhookDropTarget(); EnableHotkeys(HOTKEYS_CLEAR); HWND hwnd=FindWindow(L"OpenShellMenu.CStartHookWindow",L"StartHookWindow");