WPF app crashes without stacktrace when clicking on a link in PDF file

[abid76]

I have a WPF app using CefSharp.

Since upgrading from CefSharp 132.3.11 to 145.0.260 the WPF app crashes when clicking on a link in a PDF file displayed in a browser instance.

• PDF file: Test-1.pdf
• Cef log: cef-debug.log

The application crashes without a stracktrace, even the cef log does not show anything helpful (at least to me).

When opening the attached PDF file in https://github.com/cefsharp/CefSharp.MinimalExample, the application does not crash.

As the app is quite complex it's currently not possible to provide a minimal example. I am using a custom LifespanHandler, a BrowserRequestHandler and a BrowserResourceRequestHandler. I placed a breakpoint in every handler method, none is hit when clicking on the link.

This is how I initialize Cef:

public static void InitCef()
{
    var cefSettings = new CefSettings()
    {
        LogSeverity = LogSeverity.Verbose,
        CachePath = SystemService.CefCacheDir,
        LogFile = SystemService.GetLogFile(SystemService.CefSharpLogFile),
        Locale = "de-DE",
        // CefCommandLineArgs = { ["disable-gpu-shader-disk-cache"] = "1" } // Ordner GPUCache nicht erstellen
    };
    CefCustomScheme localScheme = new CefCustomScheme
    {
        SchemeName = LocalSchemeHandlerFactory.SchemeNameLocal,
        SchemeHandlerFactory = new LocalSchemeHandlerFactory(),
        IsCSPBypassing = true
    };
    CefCustomScheme smbScheme = new CefCustomScheme
    {
        SchemeName = SmbSchemeHandlerFactory.SchemeNameSmb,
        SchemeHandlerFactory = new SmbSchemeHandlerFactory(),
        IsCSPBypassing = true
    };
    cefSettings.RegisterScheme(localScheme);
    cefSettings.RegisterScheme(smbScheme);
    CefSharp.Cef.Initialize(cefSettings);
}

I'm afraid this is very little information to analyze the problem's cause.

But maybe someone can provide me any hints how to investigate further?

[amaitland]

https://github.com/cefsharp/CefSharp/wiki/Trouble-Shooting#unmanaged-crashes-when-the-process-dies

[abid76]

Thanks for your help and sorry for the delay!

First, I upgraded to version 146.0.100, which didn't help.

I then placed the crash_reporter.cfg, together with the libcef.dll.pdb in the install directory and reproduced the error.

[Config]
ProductName=Betreuung
ProductVersion=1.0.0
AppName=Case Manager Pro
ExternalHandler=CefSharp.BrowserSubprocess.exe

After the crash, I opened the dmp file in the reports folder using WinDbg. Find the content below.

I guess, the main points of interest are these lines

FAULTING_SOURCE_FILE:  Y:\work\CEF3_git\chromium\src\chrome\browser\extensions\api\tabs\tabs_api.cc

FAULTING_SOURCE_LINE_NUMBER:  2302

SYMBOL_NAME:  libcef!extensions::TabsUpdateFunction::Run+370

How to investigate further? Is there anything I can do to provide more error details?

Content of dmp file in WinDbg:

************* Preparing the environment for Debugger Extensions Gallery repositories **************
   ExtensionRepository : Implicit
   UseExperimentalFeatureForNugetShare : true
   AllowNugetExeUpdate : true
   NonInteractiveNuget : true
   AllowNugetMSCredentialProviderInstall : true
   AllowParallelInitializationOfLocalRepositories : true
   EnableRedirectToChakraJsProvider : false

   -- Configuring repositories
      ----> Repository : LocalInstalled, Enabled: true
      ----> Repository : UserExtensions, Enabled: true

>>>>>>>>>>>>> Preparing the environment for Debugger Extensions Gallery repositories completed, duration 0.000 seconds

************* Waiting for Debugger Extensions Gallery to Initialize **************

>>>>>>>>>>>>> Waiting for Debugger Extensions Gallery to Initialize completed, duration 0.672 seconds
   ----> Repository : UserExtensions, Enabled: true, Packages count: 0
   ----> Repository : LocalInstalled, Enabled: true, Packages count: 46

Microsoft (R) Windows Debugger Version 10.0.29547.1002 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\abidh\AppData\Local\Case Manager Pro\User Data\Crashpad\reports\b5995c38-d181-427d-bdaa-f56dc32bcb26.dmp]
User Mini Dump File: Only registers, stack and portions of memory are available

Symbol search path is: srv*
Executable search path is: 
Windows 10 Version 26200 (8037) MP (20 procs) Free x64
Product: WinNt
Edition build lab: Windows NT 10.0.26200.8037
Debug session time: Tue Apr 14 14:45:19.000 2026 (UTC + 2:00)
System Uptime: not available
Process Uptime: 0 days 0:00:19.000
................................................................
................................................................
................................................................
....
Loading unloaded module list
..........................
----------------------------------------------------------------------------
The user dump currently examined is a minidump. Consequently, only a subset
of sos.dll functionality will be available. If needed, attaching to the live
process or debugging a full dump will allow access to sos.dll's full feature
set.
To create a full user dump use the command: .dump /ma <filename>
----------------------------------------------------------------------------
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr
(97cc.6094): Access violation - code c0000005 (first/second chance not available)
ReadVirtual() failed in GetXStateConfiguration() first read attempt (error == 0.)
Invalid mini-dump Miscellaneous information in InitializeConfiguration()
For analysis of this file, run !analyze -v
*** WARNING: Unable to verify checksum for ntdll.dll
*** WARNING: Unable to verify checksum for KERNELBASE.dll
*** WARNING: Unable to verify checksum for chrome_elf.dll
ntdll!NtDelayExecution+0x14:
00007ffe`e8482114 c3              ret
0:023> .ecxr
rax=0000000000000000 rbx=0000664c03399400 rcx=0000000000000000
rdx=0000000000000000 rsi=00000079f463ed60 rdi=0000664c02b70800
rip=00007ffd7f431150 rsp=00000079f463e7f0 rbp=0000664c04714700
 r8=00007ffd8d0efaf0  r9=0000664c03359a13 r10=00000000000000ff
r11=0000000000000002 r12=00000079f463e9f0 r13=0000664c04714700
r14=0000000000000000 r15=00000079f463e9bc
iopl=0         nv up ei pl zr na pe nc
cs=0033  ss=0000  ds=0000  es=0000  fs=0053  gs=002b             efl=00010246
libcef!extensions::TabsUpdateFunction::Run+0x370:
00007ffd`7f431150 488b01          mov     rax,qword ptr [rcx] ds:00000000`00000000=????????????????
0:023> !analyze -v
................................................................
................................................................
...............*** WARNING: Unable to verify checksum for libcef.dll
.................................................
..
Loading unloaded module list
..........................
*** WARNING: Unable to verify checksum for ntdll.dll
*** WARNING: Unable to verify checksum for KERNELBASE.dll
*** WARNING: Unable to verify checksum for chrome_elf.dll

************* Symbol Loading Error Summary **************
Module name            Error
chrome_elf             The system cannot find the file specified

You can troubleshoot most symbol related issues by turning on symbol loading diagnostics (!sym noisy) and repeating the command that caused symbols to be loaded.
You should also verify that your symbol search path (.sympath) is correct.
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

*** WARNING: Unable to verify checksum for clr.dll
*** WARNING: Unable to verify checksum for KERNEL32.dll
*** WARNING: Unable to verify checksum for ole32.dll
*** WARNING: Unable to verify checksum for twinapi.appcore.dll
Failed to request MethodData, not in JIT code range

KEY_VALUES_STRING: 1

    Key  : AV.Dereference
    Value: NullPtr

    Key  : AV.Type
    Value: Read

    Key  : Analysis.CPU.mSec
    Value: 8843

    Key  : Analysis.Elapsed.mSec
    Value: 106340

    Key  : Analysis.IO.Other.Mb
    Value: 20

    Key  : Analysis.IO.Read.Mb
    Value: 4672

    Key  : Analysis.IO.Write.Mb
    Value: 4737

    Key  : Analysis.Init.CPU.mSec
    Value: 14421

    Key  : Analysis.Init.Elapsed.mSec
    Value: 143326

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 5668

    Key  : Analysis.Version.DbgEng
    Value: 10.0.29547.1002

    Key  : Analysis.Version.Description
    Value: 10.2602.27.2 amd64fre

    Key  : Analysis.Version.Ext
    Value: 1.2602.27.2

    Key  : CLR.BuiltBy
    Value: NET481REL1LAST_25H2

    Key  : CLR.Engine
    Value: CLR

    Key  : CLR.MissingMetaData
    Value: clr!g_pConfig

    Key  : CLR.Version
    Value: 4.8.9221.0

    Key  : Failure.Bucket
    Value: INVALID_POINTER_READ_c0000005_libcef.dll!extensions::TabsUpdateFunction::Run

    Key  : Failure.Exception.Code
    Value: 0xc0000005

    Key  : Failure.Exception.IP.Address
    Value: 0x7ffd7f431150

    Key  : Failure.Exception.IP.Module
    Value: libcef

    Key  : Failure.Exception.IP.Offset
    Value: 0x14a1150

    Key  : Failure.Hash
    Value: {7f448750-9c99-306a-7255-eabfc3e185c7}

    Key  : Failure.ProblemClass.Primary
    Value: INVALID_POINTER_READ

    Key  : Faulting.IP.Type
    Value: Paged

    Key  : Timeline.Process.Start.DeltaSec
    Value: 19

    Key  : WER.Process.Version
    Value: 1.63.22.25525


FILE_IN_CAB:  b5995c38-d181-427d-bdaa-f56dc32bcb26.dmp

NTGLOBALFLAG:  0

CONTEXT:  (.ecxr)
rax=0000000000000000 rbx=0000664c03399400 rcx=0000000000000000
rdx=0000000000000000 rsi=00000079f463ed60 rdi=0000664c02b70800
rip=00007ffd7f431150 rsp=00000079f463e7f0 rbp=0000664c04714700
 r8=00007ffd8d0efaf0  r9=0000664c03359a13 r10=00000000000000ff
r11=0000000000000002 r12=00000079f463e9f0 r13=0000664c04714700
r14=0000000000000000 r15=00000079f463e9bc
iopl=0         nv up ei pl zr na pe nc
cs=0033  ss=0000  ds=0000  es=0000  fs=0053  gs=002b             efl=00010246
libcef!extensions::TabsUpdateFunction::Run+0x370:
00007ffd`7f431150 488b01          mov     rax,qword ptr [rcx] ds:00000000`00000000=????????????????
Resetting default scope

EXCEPTION_RECORD:  (.exr -1)
ExceptionAddress: 00007ffd7f431150 (libcef!extensions::TabsUpdateFunction::Run+0x0000000000000370)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 0000000000000000
Attempt to read from address 0000000000000000

PROCESS_NAME:  Betreuung.exe

READ_ADDRESS:  0000000000000000 

ERROR_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%p verwies auf Arbeitsspeicher bei 0x%p. Der Vorgang %s konnte im Arbeitsspeicher nicht durchgef hrt werden.

EXCEPTION_CODE_STR:  c0000005

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000000

STACK_TEXT:  
00000079`f463e7f0 00007ffd`84a9adb2     : 00000000`00000000 00000000`00000000 00000079`f463ee48 00007ffd`81f0316b : libcef!extensions::TabsUpdateFunction::Run+0x370
00000079`f463eb70 00007ffd`84a9f4ad     : ffffffff`00000000 00000020`00000013 ffffffff`00000000 00000001`00000033 : libcef!ExtensionFunction::RunWithValidation+0x72
00000079`f463ec00 00007ffd`84a9e927     : ffffffff`00000000 00007ffd`84b4b71b ffffffff`00000000 ffffffff`00000000 : libcef!extensions::ExtensionFunctionDispatcher::DispatchWithCallbackInternal+0x77d
00000079`f463ee00 00007ffd`84a99135     : 00000079`f463f158 00007ffd`84b40363 00000000`00000000 00000000`00000000 : libcef!extensions::ExtensionFunctionDispatcher::Dispatch+0x1c7
00000079`f463efa0 00007ffd`84b3dd11     : 00007ffd`8b98b888 0000664c`04700748 00000079`f463f180 00007ffd`813272e9 : libcef!extensions::ExtensionFrameHost::Request+0x65
00000079`f463f000 00007ffd`84a9a1ba     : 000042d6`3e288856 00000079`f463f1b0 0000664c`036c5680 00007ffd`826cd8ef : libcef!extensions::mojom::LocalFrameHostStubDispatch::AcceptWithResponder+0x381
00000079`f463f130 00007ffd`81f689a4     : 00000079`f463f478 00007ffd`8be93177 00000079`f463f200 00007ffd`8208d17d : libcef!extensions::mojom::LocalFrameHostStub<mojo::RawPtrImplRefTraits<extensions::mojom::LocalFrameHost> >::AcceptWithResponder+0x3a
(Inline Function) --------`--------     : --------`-------- --------`-------- --------`-------- --------`-------- : libcef!mojo::InterfaceEndpointClient::HandleValidatedMessage+0x2ca
00000079`f463f180 00007ffd`820c0d2f     : 00000000`00000000 00000000`00000000 00000079`f463f201 00007ffd`81f20e01 : libcef!mojo::InterfaceEndpointClient::HandleIncomingMessageThunk::Accept+0x2f4
00000079`f463f240 00007ffd`81f69ef7     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : libcef!mojo::MessageDispatcher::Accept+0xff
00000079`f463f2c0 00007ffd`8215340c     : 00000000`00000000 0000664c`03651518 00000000`00000008 00006648`00006068 : libcef!mojo::InterfaceEndpointClient::HandleIncomingMessage+0x57
(Inline Function) --------`--------     : --------`-------- --------`-------- --------`-------- --------`-------- : libcef!IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread+0x108
(Inline Function) --------`--------     : --------`-------- --------`-------- --------`-------- --------`-------- : libcef!base::internal::DecayedFunctorTraits<void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::`anonymous namespace'::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::`anonymous namespace'::ScopedUrgentMessageNotification &&>::Invoke+0x143
(Inline Function) --------`--------     : --------`-------- --------`-------- --------`-------- --------`-------- : libcef!base::internal::InvokeHelper<0,base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::`anonymous namespace'::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::`anonymous namespace'::ScopedUrgentMessageNotification &&>,void,0,1,2>::MakeItSo+0x14b
(Inline Function) --------`--------     : --------`-------- --------`-------- --------`-------- --------`-------- : libcef!base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::`anonymous namespace'::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::`anonymous namespace'::ScopedUrgentMessageNotification &&>,base::internal::BindState<1,1,0,void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::`anonymous namespace'::ScopedUrgentMessageNotification),scoped_refptr<IPC::ChannelAssociatedGroupController>,mojo::Message,IPC::`anonymous namespace'::ScopedUrgentMessageNotification>,void ()>::RunImpl+0x14b
00000079`f463f450 00007ffd`81f13c1d     : 00006648`000196a0 00007ffd`820b1a09 00000000`00001e30 00000000`00000000 : libcef!base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::`anonymous namespace'::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::`anonymous namespace'::ScopedUrgentMessageNotification &&>,base::internal::BindState<1,1,0,void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::`anonymous namespace'::ScopedUrgentMessageNotification),scoped_refptr<IPC::ChannelAssociatedGroupController>,mojo::Message,IPC::`anonymous namespace'::ScopedUrgentMessageNotification>,void ()>::RunOnce+0x16c
(Inline Function) --------`--------     : --------`-------- --------`-------- --------`-------- --------`-------- : libcef!base::OnceCallback<void ()>::Run+0x24
00000079`f463f550 00007ffd`820aff9d     : 00000079`f463f6a0 00007ffd`81f15537 00000005`ae566a96 000042d6`3e288cb6 : libcef!base::TaskAnnotator::RunTaskImpl+0x13d
(Inline Function) --------`--------     : --------`-------- --------`-------- --------`-------- --------`-------- : libcef!base::TaskAnnotator::RunTask+0x7d
(Inline Function) --------`--------     : --------`-------- --------`-------- --------`-------- --------`-------- : libcef!base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl+0x3f5
00000079`f463f5f0 00007ffd`81f04991     : 00000079`f463f970 00006648`00019788 0000664c`02957d70 00007ffd`7febd85f : libcef!base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork+0x48d
00000079`f463f830 00007ffd`7f7716c2     : ffffffff`ffffffff 00007ffd`7f79f2a8 ffffffff`ffffff01 00007ffd`7e7b6eec : libcef!base::MessagePumpForUI::DoRunLoop+0x61
00000079`f463f8d0 00007ffd`7febc4c5     : 00000079`f463fa28 00007ffd`826cd8ef 00000079`f463faf0 00007ffd`81ef7b59 : libcef!base::MessagePumpWin::Run+0xa2
00000079`f463f940 00007ffd`7f79f03c     : ffffffff`ffffffff 00007ffd`81ef7b59 00000079`f463f9e8 00000079`f463faf0 : libcef!base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run+0xf5
00000079`f463f9c0 00007ffd`7e2c56e6     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : libcef!base::RunLoop::Run+0xbc
00000079`f463fa90 00007ffd`7e33075e     : 00006648`000600f0 00006648`000600f0 00000000`00000001 00000255`76971740 : libcef!CefMainRunner::RunMessageLoop+0x126
00000079`f463fb40 00007ffd`7f76b217     : 00000000`00000000 00006648`000600f0 00000000`00000001 00000000`00000000 : libcef!CefUIThread::ThreadMain+0xce
00000079`f463fba0 00007ffe`e743e8d7     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : libcef!base::`anonymous namespace'::ThreadFunc+0x127
00000079`f463fc30 00007ffe`e83ac48c     : 00000000`00000000 00000000`00000000 000004f0`fffffb30 000004d0`fffffb30 : KERNEL32!BaseThreadInitThunk+0x17
00000079`f463fc60 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x2c


IP_IN_PAGED_CODE: 
libcef!extensions::TabsUpdateFunction::Run+370 [Y:\work\CEF3_git\chromium\src\chrome\browser\extensions\api\tabs\tabs_api.cc @ 2302]
00007ffd`7f431150 488b01          mov     rax,qword ptr [rcx]

FAULTING_SOURCE_LINE:  Y:\work\CEF3_git\chromium\src\chrome\browser\extensions\api\tabs\tabs_api.cc

FAULTING_SOURCE_FILE:  Y:\work\CEF3_git\chromium\src\chrome\browser\extensions\api\tabs\tabs_api.cc

FAULTING_SOURCE_LINE_NUMBER:  2302

SYMBOL_NAME:  libcef!extensions::TabsUpdateFunction::Run+370

MODULE_NAME: libcef

IMAGE_NAME:  libcef.dll

STACK_COMMAND: ~23s; .ecxr ; kb

FAILURE_BUCKET_ID:  INVALID_POINTER_READ_c0000005_libcef.dll!extensions::TabsUpdateFunction::Run

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

IMAGE_VERSION:  146.0.10.0

FAILURE_ID_HASH:  {7f448750-9c99-306a-7255-eabfc3e185c7}

Followup:     MachineOwner
---------

[amaitland]

To help determine where the problem needs to be fixed please download and test using the CEF Sample Application(cefclient).
1. Download for x86 or x64 or arm64.
2. Extract tar.bz2 file
3. Execute cefclient.exe using the command line args below:

      For WPF/OffScreen `cefclient.exe --multi-threaded-message-loop --no-sandbox --off-screen-rendering-enabled --enable-gpu`

I suspect this will need to be fixed upstream.
https://github.com/chromiumembedded/cef

Might be related to chromiumembedded/cef#4011

[abid76]

I tested it using cefclient.exe (x64) and could reproduce the error:

1. Run cefclient.exe --multi-threaded-message-loop --no-sandbox --off-screen-rendering-enabled --enable-gpu
2. Open https://gruenderschiff.de/wp-content/uploads/SEO_in_7_Schritten_Checkliste.pdf
3. Click on the link "Google Pagespeed Insights" on the first page

After clicking on the link, the application crashes. There have been files console.log and debug.log created but they don't contain any related info.

If there's anything I can do, please let me know 🙂

[amaitland]

Thanks for testing. As the problem reproduces with the CEF Sample application the issue will need to be fixed in CEF.

You will need to create an issue at https://github.com/chromiumembedded/cef/issues

[abid76]

I created a bug report: chromiumembedded/cef#4158

Thanks for your help!