AtlasEngine::PaintCursor crashes

[Pxter7777]

Windows Terminal version

1.24.11321.0

Windows build number

10.0.19045.6466

Other Software

The tabs I were running are

• powershell
• cmd
• cmd + claude code
• cmd + openssh

Steps to reproduce

Don't know, it crashed quite randomly.

Expected Behavior

Not crash.

Actual Behavior

Crashed.
It happened when I prompted ssh-add -l in a Windows cmd. It stuck for a few seconds, then poof, Windows Terminal closed.
Though I doubt it's the actual cause, because when I tried ssh-add -l again later it didn't crash anymore. Also this crash happened before at random moments that I can't quite recall.

Info from WinDbg !analyze -v

************* Preparing the environment for Debugger Extensions Gallery repositories **************
   ExtensionRepository : Implicit
   UseExperimentalFeatureForNugetShare : true
   AllowNugetExeUpdate : true
   NonInteractiveNuget : true
   AllowNugetMSCredentialProviderInstall : true
   AllowParallelInitializationOfLocalRepositories : true
   EnableRedirectToChakraJsProvider : false

   -- Configuring repositories
      ----> Repository : LocalInstalled, Enabled: true
      ----> Repository : UserExtensions, Enabled: true

>>>>>>>>>>>>> Preparing the environment for Debugger Extensions Gallery repositories completed, duration 0.000 seconds

************* Waiting for Debugger Extensions Gallery to Initialize **************

>>>>>>>>>>>>> Waiting for Debugger Extensions Gallery to Initialize completed, duration 0.047 seconds
   ----> Repository : UserExtensions, Enabled: true, Packages count: 0
   ----> Repository : LocalInstalled, Enabled: true, Packages count: 46

Microsoft (R) Windows Debugger Version 10.0.29547.1002 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\pxter\AppData\Local\CrashDumps\WindowsTerminal.exe.24948.dmp]
User Mini Dump File: Only registers, stack and portions of memory are available

Symbol search path is: srv*
Executable search path is: 
Windows 10 Version 19045 MP (6 procs) Free x64
Product: WinNt, suite: SingleUserTS Personal
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Debug session time: Wed May 27 04:22:02.000 2026 (UTC + 8:00)
System Uptime: not available
Process Uptime: 2 days 14:25:49.000
................................................................
................................................................
...............
Loading unloaded module list
..............
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr
(6174.5d48): Access violation - code c0000005 (first/second chance not available)
ReadVirtual() failed in GetXStateConfiguration() first read attempt (error == 0.)
Invalid mini-dump Miscellaneous information in InitializeConfiguration()
For analysis of this file, run !analyze -v
ntdll!NtWaitForMultipleObjects+0x14:
00007ffe`0e6ee0f4 c3              ret
0:189> !analyze -v
................................................................
................................................................
...............
Loading unloaded module list
..............
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************


KEY_VALUES_STRING: 1

    Key  : AV.Type
    Value: Read

    Key  : Analysis.CPU.mSec
    Value: 1296

    Key  : Analysis.Elapsed.mSec
    Value: 18791

    Key  : Analysis.IO.Other.Mb
    Value: 101

    Key  : Analysis.IO.Read.Mb
    Value: 1

    Key  : Analysis.IO.Write.Mb
    Value: 138

    Key  : Analysis.Init.CPU.mSec
    Value: 1734

    Key  : Analysis.Init.Elapsed.mSec
    Value: 58614

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 203

    Key  : Analysis.Version.DbgEng
    Value: 10.0.29547.1002

    Key  : Analysis.Version.Description
    Value: 10.2602.27.2 amd64fre

    Key  : Analysis.Version.Ext
    Value: 1.2602.27.2

    Key  : Failure.Bucket
    Value: INVALID_POINTER_READ_c0000005_Microsoft.Terminal.Control.dll!Microsoft::Console::Render::Atlas::AtlasEngine::PaintCursor

    Key  : Failure.Exception.Code
    Value: 0xc0000005

    Key  : Failure.Exception.IP.Address
    Value: 0x7ffc3cb0c924

    Key  : Failure.Exception.IP.Module
    Value: Microsoft_Terminal_Control

    Key  : Failure.Exception.IP.Offset
    Value: 0x2c924

    Key  : Failure.Hash
    Value: {1e1cbcd2-c583-6be2-18ab-d462fefe2321}

    Key  : Failure.ProblemClass.Primary
    Value: INVALID_POINTER_READ

    Key  : Faulting.IP.Type
    Value: Paged

    Key  : Timeline.Process.Start.DeltaSec
    Value: 224749

    Key  : WER.OS.Branch
    Value: vb_release

    Key  : WER.OS.Version
    Value: 10.0.19041.1

    Key  : WER.Process.Version
    Value: 1.24.2605.12001


FILE_IN_CAB:  WindowsTerminal.exe.24948.dmp

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

CONTEXT:  (.ecxr)
rax=0000028f712d8810 rbx=0000028f713d0720 rcx=0000028f713d0720
rdx=0000000000000000 rsi=0000000000000020 rdi=0000028f820d5600
rip=00007ffc3cb0c924 rsp=0000008fe30afa30 rbp=0000028f820d55b8
 r8=0000000000000000  r9=0000000000000000 r10=000000000000001f
r11=0000000000500000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000001 r15=0000000000000000
iopl=0         nv up ei pl zr na pe nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
Microsoft_Terminal_Control!Microsoft::Console::Render::Atlas::AtlasEngine::PaintCursor+0x74:
00007ffc`3cb0c924 44388ac0000000  cmp     byte ptr [rdx+0C0h],r9b ds:00000000`000000c0=??
Resetting default scope

EXCEPTION_RECORD:  (.exr -1)
ExceptionAddress: 00007ffc3cb0c924 (Microsoft_Terminal_Control!Microsoft::Console::Render::Atlas::AtlasEngine::PaintCursor+0x0000000000000074)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 00000000000000c0
Attempt to read from address 00000000000000c0

PROCESS_NAME:  WindowsTerminal.exe

READ_ADDRESS:  00000000000000c0 

ERROR_CODE: (NTSTATUS) 0xc0000005 -      0x%p      O         0x%p    O     C   O           %s C

EXCEPTION_CODE_STR:  c0000005

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  00000000000000c0

STACK_TEXT:  
0000008f`e30afa30 00007ffc`3caee839     : 0000028f`820d55a0 0000028f`820d55a0 00000000`00000000 00000000`00000000 : Microsoft_Terminal_Control!Microsoft::Console::Render::Atlas::AtlasEngine::PaintCursor+0x74
(Inline Function) --------`--------     : --------`-------- --------`-------- --------`-------- --------`-------- : Microsoft_Terminal_Control!Microsoft::Console::Render::Renderer::_PaintCursor+0x23
0000008f`e30afa70 00007ffc`3caef621     : 0000028f`820d55b8 0000028f`820d55a0 0000028f`820d55a0 0000028f`820d5760 : Microsoft_Terminal_Control!Microsoft::Console::Render::Renderer::_PaintFrameForEngine+0x155
0000008f`e30afb10 00007ffc`3caeeab6     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Microsoft_Terminal_Control!Microsoft::Console::Render::Renderer::_PaintFrame+0xd9
(Inline Function) --------`--------     : --------`-------- --------`-------- --------`-------- --------`-------- : Microsoft_Terminal_Control!Microsoft::Console::Render::Renderer::PaintFrame+0x12
0000008f`e30afb80 00007ffe`0dfc7374     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Microsoft_Terminal_Control!Microsoft::Console::Render::RenderThread::_ThreadProc+0x6a
0000008f`e30afbd0 00007ffe`0e69cc91     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0x14
0000008f`e30afc00 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x21


IP_IN_PAGED_CODE: 
Microsoft_Terminal_Control!Microsoft::Console::Render::Atlas::AtlasEngine::PaintCursor+74 [C:\__w\1\s\src\renderer\atlas\AtlasEngine.cpp @ 623]
00007ffc`3cb0c924 44388ac0000000  cmp     byte ptr [rdx+0C0h],r9b

FAULTING_SOURCE_LINE:  C:\__w\1\s\src\renderer\atlas\AtlasEngine.cpp

FAULTING_SOURCE_FILE:  C:\__w\1\s\src\renderer\atlas\AtlasEngine.cpp

FAULTING_SOURCE_LINE_NUMBER:  623

SYMBOL_NAME:  Microsoft_Terminal_Control!Microsoft::Console::Render::Atlas::AtlasEngine::PaintCursor+74

MODULE_NAME: Microsoft_Terminal_Control

IMAGE_NAME:  Microsoft.Terminal.Control.dll

STACK_COMMAND: dt ntdll!LdrpLastDllInitializer BaseDllName ; dt ntdll!LdrpFailureData ; ~189s; .ecxr ; kb

FAILURE_BUCKET_ID:  INVALID_POINTER_READ_c0000005_Microsoft.Terminal.Control.dll!Microsoft::Console::Render::Atlas::AtlasEngine::PaintCursor

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

IMAGE_VERSION:  1.24.2605.12001

FAILURE_ID_HASH:  {1e1cbcd2-c583-6be2-18ab-d462fefe2321}

Followup:     MachineOwner
---------

• dmp file: WindowsTerminal.exe.24948.zip

[danmoseley]

Repro on Windows 11 24H2 (10.0.26100.1) with the same Microsoft.Terminal.Control.dll 1.24.2605.12001 (WindowsTerminal 1.24.11321.0). Identical faulting instruction and source line:

Microsoft_Terminal_Control!AtlasEngine::PaintCursor+0x74   ; src/renderer/atlas/AtlasEngine.cpp:623
00007ff9`dcabc924 44388ac0000000  cmp byte ptr [rdx+0C0h],r9b   ; rdx = NULL, AV reading 0xC0

Registers at fault (render thread):

rax=00000225986f7650 rbx=000002258e95c7a0 rdx=0000000000000000
rsi=000000000000002a rdi=00000225a4211000 r10=0000000000000029

The two preceding instructions are the interesting part:

mov rax,[rbx+2B8h]      ; rax = pointer to array hanging off 'this'
mov rdx,[rax+r10*8]     ; rdx = array[r10]   <-- this slot is NULL

So an 8‑byte pointer array at this+0x2B8 has a NULL entry at index r10 = 0x29 (41). In the original report r10 = 0x1f (31). Different OS build, different index in the same array, same source line — i.e., the array can legitimately contain NULL slots and PaintCursor is dereferencing without a guard. Looks data‑dependent (probably a glyph/cursor cache slot that wasn't populated for the current run), not OS‑dependent.

Happened once after ~11 days of window uptime with a mix of cmd, PowerShell and WSL panes — consistent with the "random, hard to repro" pattern the original reporter described.

[DHowett]

The curious thing from all the dumps we've reviewed is that the window is in the middle of resizing, which happens under the write lock, when the renderer shouldn't be able to render it (because it, too, takes the lock for reading.)

[yuu61]

Another repro on 1.24.11321.0 — reliably triggered by high-throughput TUIs (Claude Code / Codex CLI)

Same AtlasEngine::PaintCursor crash on Windows Terminal 1.24.11321.0 (Stable, x64 / Win11 26100). It happens regularly for me while running coding-agent TUIs that stream a lot of output and repaint the cursor continuously — Claude Code and the Codex CLI. Over ~10 days I have 4 user-mode minidumps; 3 are this exact fault (identical StackHash), the 4th is unrelated. No deterministic steps, but heavy-output TUIs reproduce it far more often than normal interactive use.

Confirming @danmoseley's disassembly — same code shape, src/renderer/atlas/AtlasEngine.cpp:623:

movsxd r10, dword ptr [rdi+4]      ; rdi = CursorOptions*; index r10 = (int)CursorOptions[+4]
mov    rax, qword ptr [rbx+2B8h]   ; rbx = AtlasEngine 'this'; rax = array at this+0x2B8
mov    rdx, qword ptr [rax+r10*8]  ; rdx = array[r10]
cmp    byte ptr [rdx+0C0h], r9b    ; <-- AV dereferencing array[r10]+0xC0

New data point: the slot holds a non-NULL garbage pointer, not NULL.
In this dump r10 = 0x4d (77) and rdx = array[77] = 0x00007ffb4a86bd50, which is unmapped (read of [rdx+0xC0] = 0x00007ffb4a86be10 faults). That value is not a heap object (live objects here are 0x000002c8_xxxxxxxx); it looks like a stale/torn pointer. So the array at AtlasEngine+0x2B8 doesn't just contain unpopulated NULL slots — it can also contain dangling pointers, which points at a realloc/use-after-free race rather than only a missing-guard-on-NULL.

Lock state at crash time (raw observation — I can't determine the lock owner from a minidump, the heap isn't captured):
The faulting render thread (#90 "Rendering Output Thread") is actively inside PaintFrame → _PaintFrameForEngine → PaintCursor (not blocked on the lock), while several threads are queued on til::recursive_ticket_lock:

Thread	Waiting in
#0 (UI)	IslandWindow::MessageHandler → TerminalWindow::WindowActivated → _updateThemeColors → Tab::GetTabColor → ControlCore::TabColor → LockForReading
#20 "ConptyConnection Output Thread"	ConptyConnection::_OutputThread → Terminal::Write → StateMachine::ProcessString → Renderer::SynchronizedOutputChanged → ticket_lock::lock
#86	throttled_func::_timer_callback → ControlCore::_setupDispatcherAndCallbacks lambda → LockForWriting
#87	throttled_func::_timer_callback → ControlCore::_focusChanged → LockForReading

I'm not drawing a mechanism from this (I can't see who holds the lock). Just noting that in this dump the activity in flight is window activation / focus change / synchronized-output (DECSET 2026) toggling rather than a window resize, in case the resize-specific framing from earlier dumps is narrower than the actual trigger.

Faulting stack (render thread, fully symbolized via msdl):

...AtlasEngine::PaintCursor+0x74            [AtlasEngine.cpp:623]
...Renderer::_PaintCursor+0x23   (inlined)
...Renderer::_PaintFrameForEngine+0x155
...Renderer::_PaintFrame+0xd9
...Renderer::PaintFrame+0x12     (inlined)
...RenderThread::_ThreadProc+0x6a
kernel32!BaseThreadInitThunk+0x17
ntdll!RtlUserThreadStart+0x2c

Environment: Windows Terminal 1.24.11321.0 (Stable, x64), module Microsoft.Terminal.Control.dll 1.24.2605.12001, Windows 11 build 26100.1 / 26200, exception 0xC0000005 (read).

I have full minidumps for all 4 crashes (3× this fault + 1 unrelated UiaEngine::NotifyNewText NULL deref) and can share them if useful.