Acess Violation on IHTMLDocument2::write() in a thread

Question

Hello,
I have a working code, but it crashes with "Access Violation"  on IHTMLDocument2::write() asa I put it in a thread.
(tested on Windows 7 SP1)
What could be the reason ?
Thanks.
Test sample  (just set a text in a HTML window created with ATL) with a simple win32 app =>
#include <windows.h>
#include <tchar.h>
#include <exdisp.h> // IWebBrowser2
#include <Mshtml.h> // IHTMLDocument2
#include <process.h> /* _beginthread, _endthread */
HINSTANCE hATLDLL;
typedef BOOL(__stdcall *PAAWI)(void);
PAAWI pAtlAxWinInit;
typedef HRESULT(__stdcall *PAAGC) (HWND hWnd, IUnknown** pUnknown);
PAAGC pAtlAxGetControl;
static HWND hHTMLWindow;
HANDLE g_hThread = NULL;
HANDLE g_hEvent = NULL;
static UINT WINAPI ChildThreadProc(LPDWORD lpData);
BOOL g_bContinue = 1;
// At the beginning of program :
hATLDLL = LoadLibrary(_T("atl.dll"));
pAtlAxWinInit = (PAAWI)GetProcAddress(hATLDLL, "AtlAxWinInit");
if (pAtlAxWinInit)
pAtlAxWinInit();
pAtlAxGetControl = (PAAGC)GetProcAddress(hATLDLL, "AtlAxGetControl");
// in WM_CREATE of main window :
case WM_CREATE:
hHTMLWindow = CreateWindow(_T("AtlAxWin"), _T("about:blank"), WS_CHILD | WS_VISIBLE | WS_BORDER | WS_VSCROLL | WS_HSCROLL,
100, 100, 500, 300, hWnd, (HMENU)100, hInst, 0);
g_hEvent = CreateEvent(NULL, TRUE, FALSE, NULL);
if (g_hEvent)
g_bContinue = TRUE;
SetEvent(g_hEvent);
UINT idItemInfo;
g_hThread = (HANDLE)_beginthreadex(NULL, 0, (unsigned int (WINAPI *)(void *))ChildThreadProc, (HANDLE)NULL, 0, &idItemInfo);
break;
// Thread
static UINT WINAPI ChildThreadProc(LPDWORD lpdwData)
DWORD dwWait;
while (g_bContinue)
dwWait = WaitForSingleObject(g_hEvent, 1000);
if (dwWait == WAIT_OBJECT_0 || dwWait == WAIT_TIMEOUT)
if (!g_bContinue)
break;
// Block of code working if not in a thread
IUnknown* pUnknown;
IWebBrowser2 *pWebBrowser;
WCHAR wsHTMLText[255] = L"Test";
HRESULT hr;
//HRESULT hr = CoInitializeEx(NULL, COINIT_MULTITHREADED);
CoInitialize(NULL);
//if (SUCCEEDED(CoInitializeEx(NULL, COINIT_APARTMENTTHREADED | COINIT_DISABLE_OLE1DDE)))
hr = pAtlAxGetControl(hHTMLWindow, &pUnknown);
if (SUCCEEDED(hr))
hr = pUnknown->QueryInterface(__uuidof(IWebBrowser2), (void**)&pWebBrowser);
if (SUCCEEDED(hr))
IDispatch* pDispatch = NULL;
IHTMLDocument2* pDocument = NULL;
hr = pWebBrowser->get_Document(&pDispatch);
// S_FALSE
if (SUCCEEDED(hr) && pDispatch != NULL)
hr = pDispatch->QueryInterface(IID_IHTMLDocument2, (void**)&pDocument);
if (SUCCEEDED(hr))
VARIANT *param;
SAFEARRAY *sfArray = NULL;
BSTR bstr = SysAllocString(wsHTMLText);
sfArray = SafeArrayCreateVector(VT_VARIANT, 0, 1);
if (sfArray)
SafeArrayAccessData(sfArray, (LPVOID*)&param);
param->vt = VT_BSTR;
param->bstrVal = bstr;
SafeArrayUnaccessData(sfArray);
HWND hWndFocus = GetFocus();
// Crashes here, only if the block of code is in a thread !
pDocument->write(sfArray);
pDocument->close();
SetFocus(hWndFocus);
SafeArrayDestroy(sfArray);
pDocument->Release();
//if (bstr)
// SysFreeString(bstr);
pDispatch->Release();
pWebBrowser->Release();
pUnknown->Release();
CoUninitialize();
g_bContinue = FALSE;
//ResetEvent(g_hEvent);
CloseHandle(g_hEvent);
return 0;

Answer 1

On 4/3/2015 3:14 PM, Jeff666 wrote:
I have a working code, but it crashes with "Access Violation"  on IHTMLDocument2::write() asa I put it in a thread.
What could be the reason ?
You are effectively passing a COM pointer between threads, with no marshaling. Don't do that. It's in violation of COM threading model rules.
WebBrowser and MSHTML are single-threaded. It's pointless to try to use them from a worker thread, even if you do marshal the pointer and it doesn't crash. Every call would be marshaled to the main thread, executed there, and results marshaled back.
Your worker thread won't actually be doing any work, it'll just spend most of its time waiting for the cross-apartment calls to complete.
Igor Tandetnik