64位ACE OLEDB提供程序在SysFreeString中导致访问冲突

Question

由于遗留原因，我的应用程序使用MS Access mdb文件。它使用以下连接字符串使用ADO连接到数据库:

Provider=Microsoft.Jet.OLEDB.4.0; persistent Security Info=False;数据源=Dummy.mdb

最近我开始将我的应用程序移植到64位。由于Jet OLEDB提供程序在64位系统上不可用，我使用了ACE OLEDB提供程序和以下连接字符串:

Provider=Microsoft.ACE.OLEDB.12.0; persistent Security Info=False;数据源=Dummy.mdb

应用程序还使用MS XML DOM处理XML文件。有时64位版本会因SysFreeString中的访问冲突异常而崩溃，该异常是从MS XML包装器方法之一调用的。32位版本没有这些问题。我将问题提炼到测试应用程序中。

#define _WIN32_WINNT 0x0501
#include <stdio.h>
#include <windows.h>
#include <process.h>
#include <conio.h>
#include <ObjBase.h>
#import <msxml6.dll>
#import <msado15.dll> rename("EOF", "EndOfFile")
using namespace ADODB;
bool s_bRepeat = true;
unsigned __stdcall XmlThreadFunc(void*)
{
  CoInitializeEx(NULL, COINIT_APARTMENTTHREADED);
  MSXML2::IXMLDOMDocumentPtr l_pXMLDom;
  l_pXMLDom.CreateInstance(__uuidof(DOMDocument), NULL, CLSCTX_INPROC_SERVER);
  l_pXMLDom->async = VARIANT_FALSE;
  MSXML2::IXMLDOMElementPtr l_pRoot = l_pXMLDom->createElement("root");
  l_pXMLDom->appendChild(l_pRoot);
  unsigned int l_nCnt = 0;
  while (s_bRepeat)
  {
    if (0 == l_nCnt++ % 1000)
    {
      printf(".");
    }
    l_pRoot->setAttribute("test", "Test1");
    Sleep(0);
  }
  CoUninitialize();
  _endthreadex(0);
  return 0;
} 
unsigned __stdcall DbThreadFunc(void*)
{
  CoInitializeEx(NULL, COINIT_APARTMENTTHREADED);
  _ConnectionPtr l_pConnection;
  l_pConnection.CreateInstance(__uuidof(Connection));
#ifdef _WIN64
  LPCSTR l_cszConnectStr = "Provider=Microsoft.ACE.OLEDB.12.0;Persist Security Info=False;Data Source=Dummy.mdb";
#else
  LPCSTR l_cszConnectStr = "Provider=Microsoft.Jet.OLEDB.4.0;Persist Security Info=False;Data Source=Dummy.mdb";
#endif
  while (s_bRepeat)
  {
    l_pConnection->Open(l_cszConnectStr, "", "", adConnectUnspecified);
    Sleep(1000);
    printf("(");
    l_pConnection->Close();
    printf(")");
  }
  CoUninitialize();
  _endthreadex(0);
  return 0;
} 
int main()
{
  HANDLE l_hXmlThread = reinterpret_cast<HANDLE>(_beginthreadex(NULL, 0, &XmlThreadFunc, NULL, 0, NULL));
  HANDLE l_hDbThread = reinterpret_cast<HANDLE>(_beginthreadex(NULL, 0, &DbThreadFunc, NULL, 0, NULL));
  _getch();
  s_bRepeat = false;
  HANDLE l_Handles[2] = { l_hXmlThread, l_hDbThread };
  WaitForMultipleObjects(2, l_Handles, TRUE, INFINITE);
  CloseHandle(l_hXmlThread);
  CloseHandle(l_hDbThread);
  return 0;
}

崩溃调用堆栈如下:

OLEAUT32!SysFreeString
TestCrash64Lean!_bstr_t::Data_t::_Free
TestCrash64Lean!_bstr_t::Data_t::~Data_t
TestCrash64Lean!_bstr_t::Data_t::`scalar deleting destructor'
TestCrash64Lean!_bstr_t::Data_t::Release
TestCrash64Lean!_bstr_t::_Free
TestCrash64Lean!_bstr_t::~_bstr_t
TestCrash64Lean!MSXML2::IXMLDOMElement::setAttribute
TestCrash64Lean!XmlThreadFunc
MSVCR80D!_callthreadstartex
MSVCR80D!_threadstartex
kernel32!BaseThreadInitThunk
ntdll!RtlUserThreadStart

在崩溃时，DB线程总是处于以下状态:

MSVCR90!memset
mso!Ordinal4118
mso!Ordinal7994
mso!MsoUninitOffice
ACECORE
ACECORE
ACEOLEDB!DllGetClassObject
ACEOLEDB!DllGetClassObject
ACEOLEDB!DllGetClassObject
ACEOLEDB!DllGetClassObject
oledb32!CAcm::FinalRelease
oledb32!ATL::CComPolyObject<CDCM>::~CComPolyObject<CDCM>
oledb32!ATL::CComPolyObject<CDCM>::Release
oledb32!CDCMCreator::DestroyResource
comsvcs!CHolder::SafeDispenserDriver::DestroyResource
comsvcs!CHolder::ProcessDestroyList
comsvcs!CHolder::FreeResource
oledb32!CDCMCreator::ReleaseResource
oledb32!CDPO::ReturnDCMToPool
oledb32!CDPO::FinalRelease
oledb32!ATL::CComPolyObject<CDPO>::`scalar deleting destructor'
oledb32!ATL::CComPolyObject<CDPO>::Release
msado15!CConnection::_Close
msado15!CConnection::Close
TestCrash64Lean!ADODB::Connection15::Close
TestCrash64Lean!DbThreadFunc
MSVCR80D!_callthreadstartex
MSVCR80D!_threadstartex
kernel32!BaseThreadInitThunk
ntdll!RtlUserThreadStart

我发现，作为一种解决方案，如果我保持一个打开连接到一些空数据库文件，我可以打开和关闭连接到实际数据库文件和应用程序不会崩溃。不管怎样，我更想知道坠机的真正原因。如有任何建议，我将不胜感激。

我的配置如下:

Microsoft Visual Studio 2005 Version 8.0.50727.4039 (QFE.050727-4000)
Windows Server 2008 R2标准64位
处理器:Intel(R) Xeon(R) E5645 @ 2.40GHz内存:16.0 GB

Answer 1

看起来这是Microsoft Access Database Engine 2010 Redistributable的ACE OLEDB提供程序的问题。从Microsoft Access 2013 Runtime切换到提供商解决了这个问题。