MFC CComboBoxEx GDI資源泄漏

Question

我有一個非常簡單的MFC對話框，只有一個CComboBoxEx控件。

.RC

IDD_MFCAPPLICATION1_DIALOG DIALOGEX 0, 0, 160, 200
STYLE DS_SETFONT | DS_FIXEDSYS | WS_POPUP | WS_VISIBLE | WS_CAPTION | WS_SYSMENU | WS_THICKFRAME
EXSTYLE WS_EX_APPWINDOW
CAPTION "MFCApplication1"
FONT 8, "MS Shell Dlg", 0, 0, 0x1
BEGIN
    CONTROL  "", IDC_COMBO1, "ComboBoxEx32", CBS_DROPDOWNLIST | CBS_SORT | WS_VSCROLL | WS_TABSTOP, 10, 20, 140, 250
END

c ++源代碼

class CMFCApplication1Dlg : public CDialogEx
{
public:
    CMFCApplication1Dlg(CWnd* pParent = NULL);

    virtual void DoDataExchange( CDataExchange* pDX );

    CComboBoxEx m_ctrlComboEx1;

    virtual BOOL OnInitDialog();
    DECLARE_MESSAGE_MAP()
};

CMFCApplication1Dlg::CMFCApplication1Dlg(CWnd* pParent)
    : CDialogEx(IDD_MFCAPPLICATION1_DIALOG, pParent)
{}

void CMFCApplication1Dlg::DoDataExchange(CDataExchange* pDX)
{
    CDialogEx::DoDataExchange(pDX);
    DDX_Control(pDX, IDC_COMBO1, m_ctrlComboEx1);
}

BEGIN_MESSAGE_MAP(CMFCApplication1Dlg, CDialogEx)
END_MESSAGE_MAP()

BOOL CMFCApplication1Dlg::OnInitDialog()
{
    CDialogEx::OnInitDialog();

    for (int i = 0; i<24; i++)  // add useless junk text strings
    {
        COMBOBOXEXITEM  cbei;  memset(&cbei, 0, sizeof(cbei));

        cbei.mask = CBEIF_TEXT;
        cbei.iItem = i;
        cbei.pszText = L"useless junk text string 4 handle leaks";
        cbei.iImage = 0;
        cbei.iSelectedImage = 0;

        m_ctrlComboEx1.InsertItem(&cbei);
    }

    return TRUE;
}

當滾動列表框的項目時，應用程序的GDI資源會迅速增加並且永遠不會被釋放。

請參閱圖像，其中顯示了任務管理器中GDI對象的效果和數量的增加：

這似乎與文本項目的藍色“突出顯示”有關。

Windows的規范

Edition                    Windows 10 Home
Version                    1809
Installed on               19.12.2018
Operating System Build     17763.253

Scree規模100％

建立

• Microsoft Visual Studio版本15.9.5
• Windows SDK版本10.0.17763.0
• Visual Studio 2017（第141頁）
• 共享DLL中的MFC
• 統一

這個問題在x64 Debug和Release配置中都很准確，所以它似乎與調試或優化設置無關。

這是我的小應用程序中的錯誤還是這個（可能知道的）Windows系統錯誤？
如果這是一個Windows bug，那么有解決方法嗎？

---

帶有完整項目的GitHub存儲庫： MFC-CComboBoxEx-Resource-Issue

---

注意：

使用以下Windows 10預覽版仍無法修復GDI資源泄漏：

Windows 10 19H1 Insider Preview Build 18317
內部版本號10.0.18317.1000

Answer 1

這真是贏得1809版本的錯誤。 當ComboboxEx下拉時稱為comctl32!ListBox_FillDrawItem然后是comctl32!ComboEx_OnDrawItem 。 在Windows 1709（沒有句柄泄漏）我查看下一個：

但在Windows 1809上 - 下一個：

這里存在CreateSolidBrush調用，對此沒有DeleteObject調用。

---

我們可以做下一步的測試：

• 使用comboxex創建簡單的模態對話框，使用單個項目創建droplist。
• 在CBN_DROPDOWN和CBN_CLOSEUP上枚舉並打印新的/刪除的gdi句柄

我使用下一個代碼：

typedef struct
{
    PVOID pKernelAddress;
    USHORT wProcessId;
    USHORT wCount;
    USHORT wUpper;
    USHORT wType;
    PVOID pUserAddress;
} GDICELL;

struct DemoDlg 
{
    struct GH {
        USHORT wType;
        bool bPresent;
        GH() : bPresent(true) {}
    };

    GDICELL* m_GdiSharedHandleTable;
    SIZE_T m_nMaxHandleCount;
    std::map<PVOID, GH> m_hm;

    BOOL InitGDICheck()
    {
        _PEB* peb = RtlGetCurrentPeb();
        GDICELL* GdiSharedHandleTable = (GDICELL*)peb->GdiSharedHandleTable;

        MEMORY_BASIC_INFORMATION mbi;
        if (VirtualQuery(GdiSharedHandleTable, &mbi, sizeof(mbi)))
        {
            m_nMaxHandleCount = mbi.RegionSize / sizeof(GDICELL);
            m_GdiSharedHandleTable = GdiSharedHandleTable;
            return TRUE;
        }

        return FALSE;
    }

    SIZE_T CheckGdiLeaks()
    {
        GDICELL* GdiSharedHandleTable = m_GdiSharedHandleTable;
        SIZE_T nHandleCount = m_nMaxHandleCount, n = 0;

        USHORT wProcessId = (USHORT)GetCurrentProcessId();

        do 
        {
            if (GdiSharedHandleTable->wProcessId == wProcessId)
            {
                n++;

                GH& p = m_hm[GdiSharedHandleTable->pKernelAddress];

                if (p.bPresent)
                {
                    p.wType = GdiSharedHandleTable->wType;

                    DbgPrint("++%p>%04x\n", GdiSharedHandleTable->pKernelAddress, p.wType);
                }

                p.bPresent = true;
            }
        } while (GdiSharedHandleTable++, --nHandleCount);

        auto end = m_hm.end(), it = m_hm.begin();

        if (it != end)
        {
            do 
            {
                GH& p = it->second;

                if (p.bPresent)
                {
                    p.bPresent = false;
                    it++;
                }
                else
                {
                    DbgPrint("--%p>%04x\n", it->first, p.wType);
                    it = m_hm.erase(it);
                }
            } while (it != end);
        }

        return n;
    }

    static INT_PTR CALLBACK _DialogProc(HWND hwndDlg, UINT uMsg, WPARAM wParam, LPARAM lParam)
    {
        if (uMsg == WM_INITDIALOG)
        {
            SetWindowLongPtr(hwndDlg, DWLP_USER, (LONG_PTR)lParam);
        }

        if (DemoDlg* p = reinterpret_cast<DemoDlg*>(GetWindowLongPtrW(hwndDlg, DWLP_USER)))
        {
            return p->DialogProc(hwndDlg, uMsg, wParam, lParam);
        }

        return 0;
    }

    INT_PTR DialogProc(HWND hwndDlg, UINT uMsg, WPARAM wParam, LPARAM /*lParam*/)
    {
        switch (uMsg)
        {
        case WM_INITDIALOG:
            if (InitGDICheck())
            {
                COMBOBOXEXITEM  cbei = { CBEIF_TEXT }; 
                cbei.pszText = L"any text";
                SendMessageW(GetDlgItem(hwndDlg, IDC_COMBOBOXEX1), CBEM_INSERTITEM, 0, (LPARAM)&cbei);
            }
            else
            {
                EndDialog(hwndDlg, 0);
            }
            break;

        case WM_COMMAND:
            switch (wParam)
            {
            case MAKEWPARAM(IDC_COMBOBOXEX1, CBN_DROPDOWN ):
                DbgPrint("--- DROPDOWN [%x] --- \n", CheckGdiLeaks());
                break;
            case MAKEWPARAM(IDC_COMBOBOXEX1, CBN_CLOSEUP):
                DbgPrint("--- CLOSEUP [%x] --- \n", CheckGdiLeaks());
                break;

            case MAKEWPARAM(IDCANCEL, BN_CLICKED):
                EndDialog(hwndDlg, 1);
                break;
            }
            break;
        }
        return 0;
    }
};
{
    DemoDlg dlg;
    DialogBoxParamW((HINSTANCE)&__ImageBase, 
        MAKEINTRESOURCE(IDD_DIALOG1), HWND_DESKTOP, DemoDlg::_DialogProc, (LPARAM)&dlg);
}

贏得1709我查看下一個日志：

++FFFFFFFFFF3C0DC0>0004
++FFFFFFFFFF81171B>0004
++FFFFFFFFFF06171F>0004
++FFFFFFFFFFA61737>0005
++FFFFFFFFFF8517D9>0001
--FFFFFFFFFF02171F>0004
--FFFFFFFFFF3A0DC0>0004
--FFFFFFFFFF80171B>0004
--FFFFFFFFFF8417D9>0005
--FFFFFFFFFFA51737>0001
--- DROPDOWN [a] --- 
++FFFFFFFFFF470DC0>0004
++FFFFFFFFFF12171F>0004
++FFFFFFFFFF8917D9>0001
--FFFFFFFFFF06171F>0004
--FFFFFFFFFF3C0DC0>0004
--FFFFFFFFFF8517D9>0001
--- CLOSEUP [a] --- 
++FFFFFFFFFF490DC0>0004
++FFFFFFFFFF85171B>0004
++FFFFFFFFFF13171F>0004
++FFFFFFFFFFA71737>0001
++FFFFFFFFFF8A17D9>0005
--FFFFFFFFFF12171F>0004
--FFFFFFFFFF470DC0>0004
--FFFFFFFFFF81171B>0004
--FFFFFFFFFF8917D9>0001
--FFFFFFFFFFA61737>0005
--- DROPDOWN [a] --- 
++FFFFFFFFFF540DC0>0004
++FFFFFFFFFF91171B>0004
++FFFFFFFFFFAB1737>0001
--FFFFFFFFFF490DC0>0004
--FFFFFFFFFF85171B>0004
--FFFFFFFFFFA71737>0001
--- CLOSEUP [a] ---

gdi對象的數量保持不變（0xa）。 創建一些對象然后銷毀。

但在最近的1809年另一個日志：

++FFFFFFFFFF141043>0005
++FFFFFFFFFF1015B8>0004
++FFFFFFFFFF6B198C>0004
++FFFFFFFFFF3319B6>0001
++FFFFFFFFFFFB1A5E>0005
++FFFFFFFFFF6A1AC4>0004
++FFFFFFFFFF8C1B87>0001
++FFFFFFFFFF0F1C31>0004
--FFFFFFFFFF0515B8>0004
--FFFFFFFFFF060ED2>0001
--FFFFFFFFFF1010FF>0005
--FFFFFFFFFF3E198C>0004
--FFFFFFFFFF5A1AC4>0004
--FFFFFFFFFFD812DD>0001
--FFFFFFFFFFE11C31>0004
--FFFFFFFFFFFA0CFB>0005
--- DROPDOWN [10] ---
++FFFFFFFFFFCB08DF>0010
++FFFFFFFFFF1715B8>0004
++FFFFFFFFFF7E198C>0004
++FFFFFFFFFF3519B6>0001
++FFFFFFFFFF8F1B87>0001
++FFFFFFFFFF231C31>0004
--FFFFFFFFFF0F1C31>0004
--FFFFFFFFFF1015B8>0004
--FFFFFFFFFF3319B6>0001
--FFFFFFFFFF6B198C>0004
--FFFFFFFFFF8C1B87>0001
--- CLOSEUP [11] ---
++FFFFFFFFFF2615B8>0004
++FFFFFFFFFF87198C>0004
++FFFFFFFFFF3619B6>0001
++FFFFFFFFFF901B87>0001
++FFFFFFFFFF2C1C31>0004
--FFFFFFFFFF1715B8>0004
--FFFFFFFFFF231C31>0004
--FFFFFFFFFF3519B6>0001
--FFFFFFFFFF7E198C>0004
--FFFFFFFFFF8F1B87>0001
--- DROPDOWN [11] ---
++FFFFFFFFFF3A15B8>0004
++FFFFFFFFFF8E198C>0004
++FFFFFFFFFF3819B6>0001
++FFFFFFFFFF931B87>0001
++FFFFFFFFFF3F1C31>0004
++FFFFFFFFFFA51C6F>0010
--FFFFFFFFFF2615B8>0004
--FFFFFFFFFF2C1C31>0004
--FFFFFFFFFF3619B6>0001
--FFFFFFFFFF87198C>0004
--FFFFFFFFFF901B87>0001
--- CLOSEUP [12] ---
++FFFFFFFFFF4115B8>0004
++FFFFFFFFFF96198C>0004
++FFFFFFFFFF6B1AC4>0004
++FFFFFFFFFF4E1C31>0004
--FFFFFFFFFF141043>0005
--FFFFFFFFFF3819B6>0001
--FFFFFFFFFF3A15B8>0004
--FFFFFFFFFF3F1C31>0004
--FFFFFFFFFF6A1AC4>0004
--FFFFFFFFFF8E198C>0004
--FFFFFFFFFF931B87>0001
--FFFFFFFFFFFB1A5E>0005
--- DROPDOWN [e] ---
++FFFFFFFFFF161043>0005
++FFFFFFFFFF4515B8>0004
++FFFFFFFFFFA2198C>0004
++FFFFFFFFFF5F19B6>0005
++FFFFFFFFFF1B1A52>0010
++FFFFFFFFFF281A5E>0001
++FFFFFFFFFFBF1B87>0001
++FFFFFFFFFF6C1C31>0004
--FFFFFFFFFF4115B8>0004
--FFFFFFFFFF4E1C31>0004
--FFFFFFFFFF96198C>0004
--- CLOSEUP [13] ---
++FFFFFFFFFF171043>0001
++FFFFFFFFFF4615B8>0004
++FFFFFFFFFFAA198C>0004
++FFFFFFFFFF6019B6>0001
++FFFFFFFFFF291A5E>0005
++FFFFFFFFFF721AC4>0004
++FFFFFFFFFFC01B87>0005
++FFFFFFFFFF7B1C31>0004
--FFFFFFFFFF161043>0005
--FFFFFFFFFF281A5E>0001
--FFFFFFFFFF4515B8>0004
--FFFFFFFFFF5F19B6>0005
--FFFFFFFFFF6B1AC4>0004
--FFFFFFFFFF6C1C31>0004
--FFFFFFFFFFA2198C>0004
--FFFFFFFFFFBF1B87>0001
--- DROPDOWN [13] ---
++FFFFFFFFFF1A1043>0001
++FFFFFFFFFF01112F>0010
++FFFFFFFFFFB6198C>0004
++FFFFFFFFFF6219B6>0001
++FFFFFFFFFF761AC4>0004
++FFFFFFFFFF991C31>0004
--FFFFFFFFFF171043>0001
--FFFFFFFFFF6019B6>0001
--FFFFFFFFFF721AC4>0004
--FFFFFFFFFF7B1C31>0004
--FFFFFFFFFFAA198C>0004
--- CLOSEUP [14] ---

gdi對象計數永久增長。 可見該類型為0x10（這是畫筆）的對象已創建但從未刪除