AcroPDFImpl.dll Hangs During Unloads

Community Beginner ,
Dec 21, 2017

Copy link to clipboard

Copied

Starting with the 7/31/17 cut, whenever the AcroPDFImpl DLL_PROCESS_DETACH event fires, the module puts the thread to sleep and causes 2-3 second hangs in the process that loaded it. This can happen in all sorts of places for an application that embeds PDF content.

00 0019b664 765d2e4a ntdll!NtDelayExecution+0xc

01 0019b6cc 765d2daf KERNELBASE!SleepEx+0x8a

02 0019b6dc 696fafda KERNELBASE!Sleep+0xf

03 0019b70c 76b3c314 AcroPDFImpl!DllCanUnloadNow+0x58

04 0019b7a8 76b4c09e combase!CClassCache::FreeUnused+0x89

05 0019b7b0 76b4c077 combase!CCFreeUnused+0x1c

06 0019b7c0 76b6ca69 combase!CoFreeUnusedLibrariesEx+0x37

07 0019b7cc 66059da1 combase!CoFreeUnusedLibraries+0x9

I ran some PE file analysis and turned up a new string in the most recent version (compiled 11/4/17) and found an interesting string (bDisallowDLLUnload).

I recognized this as a registry value because of previous experience with bProtectedMode causing similar issues when enabled.

I tested the following and found that it resolved our issue. I assume it causes Adobe.dll to leak a handle when it loads AcroPDFImpl.dll so that we just avoid ever hitting its DLL_PROCESS_DETACH event.

My question is why is Adobe code calling the sleep even when security registry settings (like bProtectedMode) is disabled. It seems like this registry key was added in response to the 7/31/17 change. Why not fix the issue instead of providing a completely undocumented registry setting instead?

In any case, hopefully other folks affected by this will see this post and try the bDisallowDLLUnload value.

Views

899

Likes

Translate

Translate

Report

Report
Reply
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
Community Beginner ,
Nov 18, 2020

Copy link to clipboard

Copied

Flash forward to November 18, 2020 -- I've been having lots of issues with Adobe Acrobat DC crashing for end users - Specifically the browser plugin - after loading 4 or more PDFs in a workflow chain the browser / application would crash out trying to load the next one - this registry key saved the day. bDisallowDLLUnload - DWORD - 1

Likes

Translate

Translate

Report

Report
Reply
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more