c++ - MFC CComboBoxEx GDI 资源泄漏

Question

我有一个非常简单的 MFC 对话框，只有一个 CComboBoxEx控制。

.rc

IDD_MFCAPPLICATION1_DIALOG DIALOGEX 0, 0, 160, 200
STYLE DS_SETFONT | DS_FIXEDSYS | WS_POPUP | WS_VISIBLE | WS_CAPTION | WS_SYSMENU | WS_THICKFRAME
EXSTYLE WS_EX_APPWINDOW
CAPTION "MFCApplication1"
FONT 8, "MS Shell Dlg", 0, 0, 0x1
BEGIN
    CONTROL  "", IDC_COMBO1, "ComboBoxEx32", CBS_DROPDOWNLIST | CBS_SORT | WS_VSCROLL | WS_TABSTOP, 10, 20, 140, 250
END

c++源代码

class CMFCApplication1Dlg : public CDialogEx
{
public:
    CMFCApplication1Dlg(CWnd* pParent = NULL);

    virtual void DoDataExchange( CDataExchange* pDX );

    CComboBoxEx m_ctrlComboEx1;

    virtual BOOL OnInitDialog();
    DECLARE_MESSAGE_MAP()
};

CMFCApplication1Dlg::CMFCApplication1Dlg(CWnd* pParent)
    : CDialogEx(IDD_MFCAPPLICATION1_DIALOG, pParent)
{}

void CMFCApplication1Dlg::DoDataExchange(CDataExchange* pDX)
{
    CDialogEx::DoDataExchange(pDX);
    DDX_Control(pDX, IDC_COMBO1, m_ctrlComboEx1);
}

BEGIN_MESSAGE_MAP(CMFCApplication1Dlg, CDialogEx)
END_MESSAGE_MAP()

BOOL CMFCApplication1Dlg::OnInitDialog()
{
    CDialogEx::OnInitDialog();

    for (int i = 0; i<24; i++)  // add useless junk text strings
    {
        COMBOBOXEXITEM  cbei;  memset(&cbei, 0, sizeof(cbei));

        cbei.mask = CBEIF_TEXT;
        cbei.iItem = i;
        cbei.pszText = L"useless junk text string 4 handle leaks";
        cbei.iImage = 0;
        cbei.iSelectedImage = 0;

        m_ctrlComboEx1.InsertItem(&cbei);
    }

    return TRUE;
}

当滚动列表框的项目时，应用程序的 GDI 资源迅速增加并且永远不会被释放。

请看图片，它显示了任务管理器中 GDI 对象的效果和数量的增加:

这似乎与文本项的蓝色“突出显示”有关。

Windows 规范

Edition                    Windows 10 Home
Version                    1809
Installed on               19.12.2018
Operating System Build     17763.253

屏幕比例 100%

构建

• Microsoft Visual Studio 版本 15.9.5
• Windows SDK 版本 10.0.17763.0
• Visual Studio 2017 (v141)
• 共享 DLL 中的 MFC
• 统一码

问题在 x64 调试和发布配置中都存在，因此它似乎与调试或优化设置无关。

这是我的小应用程序中的错误还是(可能已知的)Windows 系统错误？
如果这是 Windows 错误，那么是否有解决方法？

---

包含完整项目的 GitHub 存储库:MFC-CComboBoxEx-Resource-Issue

---

注意:

以下 Windows 10 预览版仍未修复 GDI 资源泄漏问题:

Windows 10 19H1 Insider Preview Build 18317
Build Number 10.0.18317.1000

Answer 1

这确实是win 1809版本的bug。当调用 ComboboxEx 下拉菜单时comctl32!ListBox_FillDrawItem 然后是 comctl32!ComboEx_OnDrawItem。在 Windows 1709 中(没有句柄泄漏)我查看下一个:

但在 Windows 1809 上 - 下一步:

这里存在 CreateSolidBrush 调用，没有 DeleteObject 调用。

---

同样为了测试我们接下来可以做:

• 使用 comboxex 创建简单的模态对话框，使用单个项目创建下拉列表。
• 在 CBN_DROPDOWN 上枚举并打印新的/删除的 gdi 句柄和CBN_CLOSEUP

我使用下一个代码:

typedef struct
{
    PVOID pKernelAddress;
    USHORT wProcessId;
    USHORT wCount;
    USHORT wUpper;
    USHORT wType;
    PVOID pUserAddress;
} GDICELL;

struct DemoDlg 
{
    struct GH {
        USHORT wType;
        bool bPresent;
        GH() : bPresent(true) {}
    };

    GDICELL* m_GdiSharedHandleTable;
    SIZE_T m_nMaxHandleCount;
    std::map<PVOID, GH> m_hm;

    BOOL InitGDICheck()
    {
        _PEB* peb = RtlGetCurrentPeb();
        GDICELL* GdiSharedHandleTable = (GDICELL*)peb->GdiSharedHandleTable;

        MEMORY_BASIC_INFORMATION mbi;
        if (VirtualQuery(GdiSharedHandleTable, &mbi, sizeof(mbi)))
        {
            m_nMaxHandleCount = mbi.RegionSize / sizeof(GDICELL);
            m_GdiSharedHandleTable = GdiSharedHandleTable;
            return TRUE;
        }

        return FALSE;
    }

    SIZE_T CheckGdiLeaks()
    {
        GDICELL* GdiSharedHandleTable = m_GdiSharedHandleTable;
        SIZE_T nHandleCount = m_nMaxHandleCount, n = 0;

        USHORT wProcessId = (USHORT)GetCurrentProcessId();

        do 
        {
            if (GdiSharedHandleTable->wProcessId == wProcessId)
            {
                n++;

                GH& p = m_hm[GdiSharedHandleTable->pKernelAddress];

                if (p.bPresent)
                {
                    p.wType = GdiSharedHandleTable->wType;

                    DbgPrint("++%p>%04x\n", GdiSharedHandleTable->pKernelAddress, p.wType);
                }

                p.bPresent = true;
            }
        } while (GdiSharedHandleTable++, --nHandleCount);

        auto end = m_hm.end(), it = m_hm.begin();

        if (it != end)
        {
            do 
            {
                GH& p = it->second;

                if (p.bPresent)
                {
                    p.bPresent = false;
                    it++;
                }
                else
                {
                    DbgPrint("--%p>%04x\n", it->first, p.wType);
                    it = m_hm.erase(it);
                }
            } while (it != end);
        }

        return n;
    }

    static INT_PTR CALLBACK _DialogProc(HWND hwndDlg, UINT uMsg, WPARAM wParam, LPARAM lParam)
    {
        if (uMsg == WM_INITDIALOG)
        {
            SetWindowLongPtr(hwndDlg, DWLP_USER, (LONG_PTR)lParam);
        }

        if (DemoDlg* p = reinterpret_cast<DemoDlg*>(GetWindowLongPtrW(hwndDlg, DWLP_USER)))
        {
            return p->DialogProc(hwndDlg, uMsg, wParam, lParam);
        }

        return 0;
    }

    INT_PTR DialogProc(HWND hwndDlg, UINT uMsg, WPARAM wParam, LPARAM /*lParam*/)
    {
        switch (uMsg)
        {
        case WM_INITDIALOG:
            if (InitGDICheck())
            {
                COMBOBOXEXITEM  cbei = { CBEIF_TEXT }; 
                cbei.pszText = L"any text";
                SendMessageW(GetDlgItem(hwndDlg, IDC_COMBOBOXEX1), CBEM_INSERTITEM, 0, (LPARAM)&cbei);
            }
            else
            {
                EndDialog(hwndDlg, 0);
            }
            break;

        case WM_COMMAND:
            switch (wParam)
            {
            case MAKEWPARAM(IDC_COMBOBOXEX1, CBN_DROPDOWN ):
                DbgPrint("--- DROPDOWN [%x] --- \n", CheckGdiLeaks());
                break;
            case MAKEWPARAM(IDC_COMBOBOXEX1, CBN_CLOSEUP):
                DbgPrint("--- CLOSEUP [%x] --- \n", CheckGdiLeaks());
                break;

            case MAKEWPARAM(IDCANCEL, BN_CLICKED):
                EndDialog(hwndDlg, 1);
                break;
            }
            break;
        }
        return 0;
    }
};
{
    DemoDlg dlg;
    DialogBoxParamW((HINSTANCE)&__ImageBase, 
        MAKEINTRESOURCE(IDD_DIALOG1), HWND_DESKTOP, DemoDlg::_DialogProc, (LPARAM)&dlg);
}

使用 win 1709 我查看下一个日志:

++FFFFFFFFFF3C0DC0>0004
++FFFFFFFFFF81171B>0004
++FFFFFFFFFF06171F>0004
++FFFFFFFFFFA61737>0005
++FFFFFFFFFF8517D9>0001
--FFFFFFFFFF02171F>0004
--FFFFFFFFFF3A0DC0>0004
--FFFFFFFFFF80171B>0004
--FFFFFFFFFF8417D9>0005
--FFFFFFFFFFA51737>0001
--- DROPDOWN [a] --- 
++FFFFFFFFFF470DC0>0004
++FFFFFFFFFF12171F>0004
++FFFFFFFFFF8917D9>0001
--FFFFFFFFFF06171F>0004
--FFFFFFFFFF3C0DC0>0004
--FFFFFFFFFF8517D9>0001
--- CLOSEUP [a] --- 
++FFFFFFFFFF490DC0>0004
++FFFFFFFFFF85171B>0004
++FFFFFFFFFF13171F>0004
++FFFFFFFFFFA71737>0001
++FFFFFFFFFF8A17D9>0005
--FFFFFFFFFF12171F>0004
--FFFFFFFFFF470DC0>0004
--FFFFFFFFFF81171B>0004
--FFFFFFFFFF8917D9>0001
--FFFFFFFFFFA61737>0005
--- DROPDOWN [a] --- 
++FFFFFFFFFF540DC0>0004
++FFFFFFFFFF91171B>0004
++FFFFFFFFFFAB1737>0001
--FFFFFFFFFF490DC0>0004
--FFFFFFFFFF85171B>0004
--FFFFFFFFFFA71737>0001
--- CLOSEUP [a] ---

gdi 对象的计数保持不变 (0xa)。一些对象创建然后销毁。

但在最近的 1809 年，另一个日志:

++FFFFFFFFFF141043>0005
++FFFFFFFFFF1015B8>0004
++FFFFFFFFFF6B198C>0004
++FFFFFFFFFF3319B6>0001
++FFFFFFFFFFFB1A5E>0005
++FFFFFFFFFF6A1AC4>0004
++FFFFFFFFFF8C1B87>0001
++FFFFFFFFFF0F1C31>0004
--FFFFFFFFFF0515B8>0004
--FFFFFFFFFF060ED2>0001
--FFFFFFFFFF1010FF>0005
--FFFFFFFFFF3E198C>0004
--FFFFFFFFFF5A1AC4>0004
--FFFFFFFFFFD812DD>0001
--FFFFFFFFFFE11C31>0004
--FFFFFFFFFFFA0CFB>0005
--- DROPDOWN [10] ---
++FFFFFFFFFFCB08DF>0010
++FFFFFFFFFF1715B8>0004
++FFFFFFFFFF7E198C>0004
++FFFFFFFFFF3519B6>0001
++FFFFFFFFFF8F1B87>0001
++FFFFFFFFFF231C31>0004
--FFFFFFFFFF0F1C31>0004
--FFFFFFFFFF1015B8>0004
--FFFFFFFFFF3319B6>0001
--FFFFFFFFFF6B198C>0004
--FFFFFFFFFF8C1B87>0001
--- CLOSEUP [11] ---
++FFFFFFFFFF2615B8>0004
++FFFFFFFFFF87198C>0004
++FFFFFFFFFF3619B6>0001
++FFFFFFFFFF901B87>0001
++FFFFFFFFFF2C1C31>0004
--FFFFFFFFFF1715B8>0004
--FFFFFFFFFF231C31>0004
--FFFFFFFFFF3519B6>0001
--FFFFFFFFFF7E198C>0004
--FFFFFFFFFF8F1B87>0001
--- DROPDOWN [11] ---
++FFFFFFFFFF3A15B8>0004
++FFFFFFFFFF8E198C>0004
++FFFFFFFFFF3819B6>0001
++FFFFFFFFFF931B87>0001
++FFFFFFFFFF3F1C31>0004
++FFFFFFFFFFA51C6F>0010
--FFFFFFFFFF2615B8>0004
--FFFFFFFFFF2C1C31>0004
--FFFFFFFFFF3619B6>0001
--FFFFFFFFFF87198C>0004
--FFFFFFFFFF901B87>0001
--- CLOSEUP [12] ---
++FFFFFFFFFF4115B8>0004
++FFFFFFFFFF96198C>0004
++FFFFFFFFFF6B1AC4>0004
++FFFFFFFFFF4E1C31>0004
--FFFFFFFFFF141043>0005
--FFFFFFFFFF3819B6>0001
--FFFFFFFFFF3A15B8>0004
--FFFFFFFFFF3F1C31>0004
--FFFFFFFFFF6A1AC4>0004
--FFFFFFFFFF8E198C>0004
--FFFFFFFFFF931B87>0001
--FFFFFFFFFFFB1A5E>0005
--- DROPDOWN [e] ---
++FFFFFFFFFF161043>0005
++FFFFFFFFFF4515B8>0004
++FFFFFFFFFFA2198C>0004
++FFFFFFFFFF5F19B6>0005
++FFFFFFFFFF1B1A52>0010
++FFFFFFFFFF281A5E>0001
++FFFFFFFFFFBF1B87>0001
++FFFFFFFFFF6C1C31>0004
--FFFFFFFFFF4115B8>0004
--FFFFFFFFFF4E1C31>0004
--FFFFFFFFFF96198C>0004
--- CLOSEUP [13] ---
++FFFFFFFFFF171043>0001
++FFFFFFFFFF4615B8>0004
++FFFFFFFFFFAA198C>0004
++FFFFFFFFFF6019B6>0001
++FFFFFFFFFF291A5E>0005
++FFFFFFFFFF721AC4>0004
++FFFFFFFFFFC01B87>0005
++FFFFFFFFFF7B1C31>0004
--FFFFFFFFFF161043>0005
--FFFFFFFFFF281A5E>0001
--FFFFFFFFFF4515B8>0004
--FFFFFFFFFF5F19B6>0005
--FFFFFFFFFF6B1AC4>0004
--FFFFFFFFFF6C1C31>0004
--FFFFFFFFFFA2198C>0004
--FFFFFFFFFFBF1B87>0001
--- DROPDOWN [13] ---
++FFFFFFFFFF1A1043>0001
++FFFFFFFFFF01112F>0010
++FFFFFFFFFFB6198C>0004
++FFFFFFFFFF6219B6>0001
++FFFFFFFFFF761AC4>0004
++FFFFFFFFFF991C31>0004
--FFFFFFFFFF171043>0001
--FFFFFFFFFF6019B6>0001
--FFFFFFFFFF721AC4>0004
--FFFFFFFFFF7B1C31>0004
--FFFFFFFFFFAA198C>0004
--- CLOSEUP [14] ---

gdi 对象计数永久增长。可见类型为 0x10 的对象(这是画笔)已创建但从未删除