Starting with the 7/31/17 cut, whenever the AcroPDFImpl DLL_PROCESS_DETACH event fires, the module puts the thread to sleep and causes 2-3 second hangs in the process that loaded it. This can happen in all sorts of places for an application that embeds PDF content.
00 0019b664 765d2e4a ntdll!NtDelayExecution+0xc
01 0019b6cc 765d2daf KERNELBASE!SleepEx+0x8a
02 0019b6dc 696fafda KERNELBASE!Sleep+0xf
03 0019b70c 76b3c314 AcroPDFImpl!DllCanUnloadNow+0x58
04 0019b7a8 76b4c09e combase!CClassCache::FreeUnused+0x89
05 0019b7b0 76b4c077 combase!CCFreeUnused+0x1c
06 0019b7c0 76b6ca69 combase!CoFreeUnusedLibrariesEx+0x37
07 0019b7cc 66059da1 combase!CoFreeUnusedLibraries+0x9
I ran some PE file analysis and turned up a new string in the most recent version (compiled 11/4/17) and found an interesting string (bDisallowDLLUnload).
I recognized this as a registry value because of previous experience with bProtectedMode causing similar issues when enabled.
I tested the following and found that it resolved our issue. I assume it causes Adobe.dll to leak a handle when it loads AcroPDFImpl.dll so that we just avoid ever hitting its DLL_PROCESS_DETACH event.
My question is why is Adobe code calling the sleep even when security registry settings (like bProtectedMode) is disabled. It seems like this registry key was added in response to the 7/31/17 change. Why not fix the issue instead of providing a completely undocumented registry setting instead?
In any case, hopefully other folks affected by this will see this post and try the bDisallowDLLUnload value.
1
Reply
AdChoices