Knowledge base KB0207

Excel crashes when using add-ins based on Add-in Express

Problem

I experience Excel crashes and I have another add-in installed, which uses Add-in Express

Add-ins based on Add-in Express show the adxloader.dll in the Excel Options dialog (FileOptionsAdd-Ins).

Cause

A known bug in Add-in Express may cause Excel to crash when using additional third-party add-ins like think-cell. You can find a summary and a detailed explanation of the problem below.

We have reported this problem to Add-in Express. If you want to contact the Add-in Express support and ask for a fix, you may refer to bug tracking number #9291.

Summary

After Add-in Express unsubclasses a window, it still uses the stored window procedure address to send a message, assuming it is still current. If in between its unsubclassing and its usage of the stored window procedure address another unsubclassing happens, the window procedure address is no longer current and thus the wrong window procedure is called.

Details

In this reproduction, the problem is caused by subclassing an EXCEL7 window, in this trace HWND=004301e4.

Window opening

First think-cell subclasses with SetWindowSubclass. The SetWindowLong call comes out of the central authority COMCTL32, changing the window procedure from EXCEL to COMCTL32:

TRACE 2016-08-04T09:36:21Z thread 9052 tcaddin\detour\win\safesubclassimpl.cpp(215): 
Module C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.7601.18837_NONE_41E855142BD5705D\COMCTL32.DLL 6.10.7601.18837+0x1410A 
is subclassing window HWND 004301E4 Caption "Book2" Class EXCEL7 WndProc 
C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE15\EXCEL.EXE 15.0.4841.1000+0x21A55 Style 0x570B0000 ExStyle 0x00000000 
to C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.7601.18837_NONE_41E855142BD5705D\COMCTL32.DLL 6.10.7601.18837+0x2F45C

Then Add-in Express subclasses by calling SetWindowLong directly, changing the window procedure from COMCTL32 to Add-in Express JITed C# code (no module name, got JITed into memory):

TRACE 2016-08-04T09:36:21Z thread 9052 tcaddin\detour\win\safesubclassimpl.cpp(215): 
Module 0x06B7FB84 is subclassing window HWND 004301E4 Caption "Book2" Class EXCEL7 
WndProc C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.7601.18837_NONE_41E855142BD5705D\COMCTL32.DLL 6.10.7601.18837+0x2F45C Style 0x570B0000 ExStyle 0x00000000 to 0x1D47BD7E

Window closing

Add-in Express came last, so it is last in the chain. It can unsubclass cleanly by calling SetWindowLong directly, changing the window procedure from Add-in Express JITed C# code back to COMCTL32:

TRACE 2016-08-04T09:36:27Z thread 9052 tcaddin\detour\win\safesubclassimpl.cpp(215): 
Module 0x090CD19C is subclassing window HWND 004301E4 Caption "Book2" Class EXCEL7 
WndProc 0x1D47BD7E Style 0x470B0000 ExStyle 0x00000000 to 
C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.7601.18837_NONE_41E855142BD5705D\COMCTL32.DLL 6.10.7601.18837+0x2F45C

Then think-cell unsubclasses with RemoveWindowSubclass. The SetWindowLong call comes out of the central authority COMCTL32, changing the window procedure from COMCTL32 to EXCEL:

TRACE 2016-08-04T09:36:37Z thread 9052 tcaddin\detour\win\safesubclassimpl.cpp(215): 
Module C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.7601.18837_NONE_41E855142BD5705D\COMCTL32.DLL 6.10.7601.18837+0x1438F 
is subclassing window HWND 004301E4 Caption "Book2" Class EXCEL7 WndProc 
C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.7601.18837_NONE_41E855142BD5705D\COMCTL32.DLL 6.10.7601.18837+0x2F45C Style 0x470B0000 ExStyle 0x00000000 
to C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE15\EXCEL.EXE 15.0.4841.1000+0x21A55

So far so good. But here it comes: COMCTL32 again changes the window procedure, this time from EXCEL.EXE to the address of DefWindowProc:

TRACE 2016-08-04T09:36:41Z thread 9052 tcaddin\detour\win\safesubclassimpl.cpp(215): 
Module C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.7601.18837_NONE_41E855142BD5705D\COMCTL32.DLL 6.10.7601.18837+0xDEC4C 
is subclassing window HWND 004301E4 Caption "Book2" Class EXCEL7 WndProc 
C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE15\EXCEL.EXE 15.0.4841.1000+0x21A55 Style 0x470B0000 ExStyle 0x00000000 
to C:\WINDOWS\SYSWOW64\NTDLL.DLL 6.1.7601.23455+0x22FBD (=DefWindowProc)

With think-cell alone, this does not happen. The question is: Why does COMCTL32 do that? It is clearly wrong to rip the window procedure away from EXCEL.EXE. So here is the call stack that leads to COMCTL32 calling SetWindowLong:

tcaddin.dll!SetWindowLongPtrW (HWND__ * __formal, int __formal, long __formal) 
with hWnd=004301e4, which is our EXCEL7 window, and dwNewLong= 77102FBD=DefWindowProc
comctl32.dll!_SubclassDeath@16 () Unknown
COMCTL32 realizes that it gets called for a window that it is no longer associated 
with. It must think this is happening from a subclassing chain and reacts in panic by SetWindowLong(DefWindowProc) to ensure this never happens again.

comctl32.dll!_MasterSubclassProc@16 () Unknown
user32.dll!_InternalCallWinProc@20 () Unknown
user32.dll!_UserCallWinProcCheckWow@32 () Unknown
user32.dll!_CallWindowProcAorW@24 () Unknown

user32.dll!_CallWindowProcW@20 () Unknown
Someone (presumably Add-in Express) calls CallWindowProc with lpPrevWndFunc=6e32f45c, which is COMCTL::MasterSubclassProc hWnd=004301e4, which is our EXCEL7 window, Msg=00000002=WM_DESTROY, wParam=00000000, lParam=00000000
This is clearly wrong, COMCTL32 is no longer associated with our EXCEL7 window.

090c6dba() Unknown
[Frames below may be incorrect and/or missing]
090c1cce() Unknown
06b7fe7c() Unknown

081dd1ce() Unknown
code with no module is entered here from the CLR, probably JIT'ed code of 
Add-in Express

clr.dll!UM2MThunk_Wrapper(void *) Unknown
clr.dll!Thread::DoADCallBack(struct ADID,void (*)(void *),void *,int) Unknown
clr.dll!_UM2MDoADCallBack@16 () Unknown
081dd227() Unknown
user32.dll!_InternalCallWinProc@20 () Unknown
user32.dll!_UserCallWinProcCheckWow@32 () Unknown
user32.dll!_DispatchClientMessage@24 () Unknown
user32.dll!___fnDWORD@4 () Unknown
ntdll.dll!_KiUserCallbackDispatcher@12 () Unknown
user32.dll!_NtUserDestroyWindow@4 () Unknown

Conclusion

After Add-in Express unsubclasses the window, it uses the stored window procedure address to send a message, assuming it is still current. If in between its unsubclassing and its usage of the stored window procedure address another unsubclassing happens, the window procedure address is no longer current and thus the wrong window procedure is called.

Contact Support

Please temporarily deactivate the add-in which uses Add-in Express, as explained in KB0091.

  • If the problem only occurs when the add-in using Add-In Express is activated, contact the vendor of this add-in. Usually it is most effective if you as the customer open a support case with the vendor.

  • Please contact our support team if you are still experiencing any issues with think-cell after deactivating the other add-in

    Please send us the think-cell log files. For this, open PowerPoint and go to Insertthink-cellMoreRequest Support. The log files will be automatically attached to a new email.

    If this does not work, you can find the log files as explained below:

    • Open a new Windows Explorer window and type

      %LOCALAPPDATA%\think-cell

      into the address field and press Enter.

    • If you want to browse to these directories but cannot see them, they are probably set to invisible. You can change that in Windows Explorer by checking:

      • Windows Vista and Windows 7:
        OrganizeFolder and search optionsViewShow hidden files and folders.
      • Windows 8, Windows 8.1 and Windows 10:
        ViewShow/hideHidden Items.
    • Please send all files with the extension .log contained in this folder to our support team. This may be any of the following files: POWERPNT[_log].log, EXCEL[_log].log, TCMAIL[_log].log, setup_think-cell_xxxxx[_log].log.