Sublime Forum

Sublime Text 4 Does not start

#65

Having this issue as well, reverting back to build 4152 fixes the issue. Also a corporate environment. Builds 4169 and 4180 are affected, though I haven’t checked 4166 yet. Running as local admin makes no difference.

Checked our security software, it’s not alerting on Sublime Text or plugin_host*.*.exe as far as I can tell. I’ll ask our sysadmins on Monday.

Interestingly I can induce a positive race-condition of sorts and somewhat launch Sublime Text, though with plugin-hosts non-functional (as they crash outright), by (rather stupidly) launching Sublime Text a bunch of times. Usually three launches in quick succession does it, though sometimes more. Sublime Text eventually launches doing this, though without plugin support.

Running through ProcMon (Process Monitor) is showing both plugin_host executables generating crash dumps. Hunting through Event Viewer is showing both Sublime Text and each plugin_host generating crashes of their own, mostly with access violation exceptions in ntdll.dll.

0 Likes
#66

Just to add more fuel… I’ve had the same problem. Can’t run the latest Sublime Text at all. Unclear if it is AV or not, but AV is Trend Micro.

Reverting to 4152 brings it back to life.

0 Likes
#67

AFAIK, devs suggested to provide custom builds to narrow the root cause down to someone willing to help debugging.

But it needs someone who’s really suffering this issue, I guess.

A crash in a OS core library such as ntdll just right at/after application start is suspicious.

I would help debugging, but all builds are running just fine on all my boxes.

0 Likes
#68

So after some further digging, and with some help from one of our sysadmins, I believe I have found a lead.

(Apologies if I’m vague, security and all that jazz. @bschaaf, I’ll follow up in an email to you directly).

Our anti-virus software seems to be the culprit from builds 4166 onwards, particularly the real-time and malicious behaviour functions, though it isn’t generating specific logs when it interjects in sublime_text.exe or plugin_host-3.*.exe.

Installing and opening builds 4166 to 4180 work without issue when these two particular functions are turned off, suggesting that something has changed in these applications since build 4152 that looks suspicious to our AV software.

The crashes in ntdll.dll appear to be caused when our AV interjects, perhaps when scanning to see if plugin_host-3.*.exe is suspect, causing it to crash though I’m only speculating here.

Interestingly, submitting each of those executables to VirusTotal doesn’t flag an issue in almost all of their AV solutions they use, a line of inquiry I tried in my initial investigations. There was one exception though, which I can’t recall the name of (seemingly relatively unknown AV solution, at least to me) that flagged one of the plugin host executables. That said, I gather they’re only checking for malicious files based on signatures and not actual behaviour using ‘real-time’ engines.

Its interesting that I can launch the affected builds eventually, by launching sublime_text.exe a bunch of times in quick succession, sans plugin functionality. Perhaps this could be a fail-graceful condition? (On launch, test if plugin_host-3.*.exe crashes, then warn on visible in sublime_text.exe, as sometimes it will just fail to launch/crash silently).

0 Likes
#69

Benjamin,

As a developer and ex-configuration manager, I have to say I don’t like this answer much. I understand that there’s nothing more frustrating than a bug you can’t reproduce yourselves, but there are plenty of people here who can, and have pinpointed very clearly when the bug was introduced. There’s something in your code that anti-virus software doesn’t like, and I think it is your responsibility to find it and do something about it. I have two machines myself - a Win10 at work which I have zero control over, and a Win11 at home. I get the same issue in both places with versions after 4152 - Sublime doesn’t start, plugin host 3.3 and 3.8 suddenly crash, and the error is ultimately somewhere in ntdll.dll. And I’ve whitelisted everything I can think of on my home machine.

But the point is it’s something y’all changed after 4152, which shouldn’t be all that hard to find if you’re using any sort of version control at all.

Thanks,
Doug

0 Likes
#70

Incidentally, I get the same failure to start issue in Sublime Merge with the same error in ntdll.dll.

0 Likes
#71

I’ve got some good news: we’ve had someone reach out who has this issue and was also able to debug it and we’ll be shipping a fix in the next build. The latest Sublime Merge dev build already has this fix.

But the point is it’s something y’all changed after 4152, which shouldn’t be all that hard to find if you’re using any sort of version control at all.

Version control tells me that that issue was introduced in Sublime Text 3148 back in 2017.

3 Likes
#72

Excellent news. But now I’m curious how it seemingly remained latent for so long. But thanks for working it out - I have serious FOMO about al the stuff I’m missing from the later versions. :smiley:

0 Likes
#73

The latest Sublime Merge dev build works great, thank you! Can you please ship the fix for Sublime Text as a new dev build? The fix is vital.

0 Likes
#74

We’ve shipped that fix in the latest dev build 4181.

0 Likes
#75

Just found this thread for the first time after not being able to get Sublime Text to work in a new corporate environment at a new job.

First, thank you for the fix!

Do you have an estimate for when the fix will make it into the normal/stable build for those of us that would prefer to be on that branch but need the fix to get Sublime Text to work at all?

Also, now that the fix is out, are you willing to share details about what was going on and what the fix is? This is a really strange one, seeing as there was apparently a bug in Sublime Text that has been latent for a long time, but only recent builds were affected, and the bug is only brought out in an environment with anti-virus. The fact that the access violation apparently happens in ntdll.dll is even stranger.

I think we would all be interested in the details.

0 Likes
#76

We don’t know the actual cause. We suspect dll injection or CreateRemoteThread cause some bad behavior in the memory allocator when initializing thread local storage. In any case the fix was to not allocate memory when initializing thread local storage.

1 Like
#77

Hi,
I just landed here after this happening to me for the last two days after never having an issue before.
Home user. No corporate lockdowns or anything.

The keyword that cottoned me onto this here is the term dll injection.
It made me remember I installed 0patch 2 days ago.

Stopping 0patch service does not fix the problem, nor does that app do any patching of sublime text directly.
However I am willing to bet that one of the in-memory patches that 0patch uses on a windows component is leading to this behaviour - and it will probably remain patched until I reboot even if I stop any new patching happening.

I bet after a reboot with 0patch turned off it will work again.
Not totally sure yet but maybe this will help other users and the devs cotton onto the issue.

Since W11 is trash and W10 is coming to end of life, I expect there will be more and more people running 0patch

0 Likes