notepad-plus-plus / notepad-plus-plus

Notepad++ official repository
https://notepad-plus-plus.org/
Other
22.99k stars 4.61k forks source link

On forced OS reboot session file is emptied when notepad++ is forced closed #9850

Closed Exrace closed 2 years ago

Exrace commented 3 years ago

Description of the Issue

When Windows 10 security patch reboot is forced on a open notepad++ the session file is emptied on next launch.

Steps to Reproduce the Issue

  1. Open a session and add files to session
  2. Close notepad and open again to see last session restored
  3. Force a restart of computer like security patching does during a "scheduled" reboot

Expected Behavior

Session should be remembered when notepad++ is forced closed by OS

Actual Behavior

Session file rewrote with no entries

Debug Information

Notepad++ v7.9.5 (32-bit) Build time : Mar 21 2021 - 02:09:07 Path : C:\Program Files (x86)\Notepad++\notepad++.exe Admin mode : OFF Local Conf mode : OFF OS Name : Windows 10 Enterprise (64-bit) OS Version : 2009 OS Build : 19042.928 Current ANSI codepage : 1252 Plugins : ComparePlugin.dll DSpellCheck.dll mimeTools.dll NppConverter.dll NppExport.dll

sorin-costea commented 3 years ago

Same here. It happens so often (company policy updates reboots when comp is unattended) that I wrote me a script to regenerate the sessions.xml from the backup dir.

vk5880 commented 3 years ago

Has the issue been fixed? I still has lost session and no session file in backup, and I've enabled all backup options for session. Where is my backup session.xml files?

Notepad++ v8.1.2 (64-bit) Build time : Jul 16 2021 - 01:59:50 Path : C:\Program Files\Notepad++\notepad++.exe Command Line : Admin mode : OFF Local Conf mode : OFF Cloud Config : U:\Backup\NPP OS Name : Windows 10 Pro (64-bit) OS Version : 2009 OS Build : 19043.1288 Current ANSI codepage : 1251 Plugins : ComparePlugin.dll JSMinNPP.dll mimeTools.dll NppConverter.dll NppExport.dll XMLTools.dll

ArkadiuszMichalski commented 3 years ago

It is best to upgrade to version 8.1.9. where the NULL problem should be fixed (related to https://github.com/notepad-plus-plus/notepad-plus-plus/issues/6133).

Exrace commented 3 years ago

I force upgraded to 8.1.9 and the issue looks to be fixed. I tested with shutdown /r /f and session file remained intact.

Exrace commented 3 years ago

I force upgraded to 8.1.9 and the issue looks to be fixed. I tested with shutdown /r /f and session file remained intact.

clcdrn commented 3 years ago

Testing with shutdown /r /f is probably not the same as the forced Windows 10 restarts happening every month. I've just lost my session.xml file again. https://github.com/notepad-plus-plus/notepad-plus-plus/issues/6133#issuecomment-968270646

momala454 commented 2 years ago

the issue still exists on current latest version

alankilborn commented 2 years ago

the issue still exists on current latest version

Provide your Debug Info

momala454 commented 2 years ago

it has also been mentioned there https://github.com/notepad-plus-plus/notepad-plus-plus/issues/6133#issuecomment-980499098

Notepad++ v8.1.9.3 (64-bit) Build time : Dec 6 2021 - 19:21:37 Path : C:\Program Files\Notepad++\notepad++.exe Command Line : Admin mode : OFF Local Conf mode : OFF Cloud Config : OFF OS Name : Windows 10 Pro (64-bit) OS Version : 2009 OS Build : 19042.1415 Current ANSI codepage : 1252 Plugins : ComparePlugin.dll mimeTools.dll NppConverter.dll NppExport.dll NPPJSONViewer.dll XMLTools.dll

ArkadiuszMichalski commented 2 years ago

@momala454 Have you any log as described here https://github.com/notepad-plus-plus/notepad-plus-plus/commit/acb8a9db474f93d6eacdbee9eb287efe29970460?

momala454 commented 2 years ago

no i don't see it on appdata/roaming folder

donho commented 2 years ago

@momala454 Could you provide the content of nppLogNulContentCorruptionIssue.xml which you can find in: "%APPDATA%\Notepad++\" ?

momala454 commented 2 years ago

i don't see this file on %APPDATA%\Notepad++ but there is an empty file of this name here C:\Program Files\Notepad++

sorin-costea commented 2 years ago

Just happened to me again, after NPP update, on W11. The lost files are still in C:\Users{username}\AppData\Roaming\Notepad++\backup but the session.xml forgot all about them.

Notepad++ v8.2.1 (32-bit) Build time : Jan 19 2022 - 18:38:49 Path : C:\Program Files (x86)\Notepad++\notepad++.exe Command Line : Admin mode : OFF Local Conf mode : OFF Cloud Config : OFF OS Name : Windows 11 (64-bit) OS Version : 2009 OS Build : 22000.434 Current ANSI codepage : 1252 Plugins : mimeTools.dll NppConverter.dll NppExport.dll

sorin-costea commented 2 years ago

Here's also the above mentioned logfile. The update happened around 2022-01-31 23:30 - no log entry at this time.

2022-01-16 23:36:47 WM_QUERYENDSESSION ===================================== 2022-01-16 23:36:47 C:\Users{username}\AppData\Roaming\Notepad++\config.xml is opened. 2022-01-16 23:36:47 C:\Users{username}\AppData\Roaming\Notepad++\config.xml 6831/6831 bytes are written. 2022-01-16 23:36:47 C:\Users{username}\AppData\Roaming\Notepad++\config.xml is closed. 2022-01-16 23:36:47 C:\Users{username}\AppData\Roaming\Notepad++\session.xml is opened. 2022-01-16 23:36:47 C:\Users{username}\AppData\Roaming\Notepad++\session.xml 792/792 bytes are written. 2022-01-16 23:36:47 C:\Users{username}\AppData\Roaming\Notepad++\session.xml is closed. 2022-01-16 23:36:47 WM_ENDSESSION 2022-01-16 23:36:47 WM_DESTROY 2022-01-22 23:49:04 WM_QUERYENDSESSION ===================================== 2022-01-22 23:49:04 C:\Users{username}\AppData\Roaming\Notepad++\config.xml is opened. 2022-01-22 23:49:04 C:\Users{username}\AppData\Roaming\Notepad++\config.xml 6948/6948 bytes are written. 2022-01-22 23:49:04 C:\Users{username}\AppData\Roaming\Notepad++\config.xml is closed. 2022-01-22 23:49:04 C:\Users{username}\AppData\Roaming\Notepad++\session.xml is opened. 2022-01-22 23:49:04 C:\Users{username}\AppData\Roaming\Notepad++\session.xml 794/794 bytes are written. 2022-01-22 23:49:04 C:\Users{username}\AppData\Roaming\Notepad++\session.xml is closed. 2022-01-22 23:49:04 WM_ENDSESSION 2022-01-22 23:49:04 WM_DESTROY 2022-01-31 08:18:44 WM_QUERYENDSESSION ===================================== 2022-01-31 08:18:44 C:\Users{username}\AppData\Roaming\Notepad++\config.xml is opened. 2022-01-31 08:18:44 C:\Users{username}\AppData\Roaming\Notepad++\config.xml 6948/6948 bytes are written. 2022-01-31 08:18:44 C:\Users{username}\AppData\Roaming\Notepad++\config.xml is closed. 2022-01-31 08:18:44 C:\Users{username}\AppData\Roaming\Notepad++\session.xml is opened. 2022-01-31 08:18:44 C:\Users{username}\AppData\Roaming\Notepad++\session.xml 792/792 bytes are written. 2022-01-31 08:18:44 C:\Users{username}\AppData\Roaming\Notepad++\session.xml is closed. 2022-01-31 08:18:44 WM_QUERYENDSESSION ===================================== 2022-01-31 08:18:44 C:\Users{username}\AppData\Roaming\Notepad++\config.xml is opened. 2022-01-31 08:18:44 C:\Users{username}\AppData\Roaming\Notepad++\config.xml 7138/7138 bytes are written. 2022-01-31 08:18:44 C:\Users{username}\AppData\Roaming\Notepad++\config.xml is closed. 2022-01-31 08:18:44 C:\Users{username}\AppData\Roaming\Notepad++\session.xml is opened. 2022-01-31 08:18:44 C:\Users{username}\AppData\Roaming\Notepad++\session.xml 193/193 bytes are written. 2022-01-31 08:18:44 C:\Users{username}\AppData\Roaming\Notepad++\session.xml is closed. 2022-01-31 08:18:44 WM_ENDSESSION 2022-01-31 08:18:44 WM_DESTROY

donho commented 2 years ago

@sorin-costea Sorry, I just saw your message. Sorry about your data losing. What is interesting in the log is there are 2 WM_QUERYENDSESSION sent and config.xml & session.xml are written 2 times:

2022-01-31 08:18:44 WM_QUERYENDSESSION =====================================
2022-01-31 08:18:44 C:\Users{username}\AppData\Roaming\Notepad++\config.xml is opened.
2022-01-31 08:18:44 C:\Users{username}\AppData\Roaming\Notepad++\config.xml 6948/6948 bytes are written.
2022-01-31 08:18:44 C:\Users{username}\AppData\Roaming\Notepad++\config.xml is closed.
2022-01-31 08:18:44 C:\Users{username}\AppData\Roaming\Notepad++\session.xml is opened.
2022-01-31 08:18:44 C:\Users{username}\AppData\Roaming\Notepad++\session.xml 792/792 bytes are written.
2022-01-31 08:18:44 C:\Users{username}\AppData\Roaming\Notepad++\session.xml is closed.
2022-01-31 08:18:44 WM_QUERYENDSESSION =====================================
2022-01-31 08:18:44 C:\Users{username}\AppData\Roaming\Notepad++\config.xml is opened.
2022-01-31 08:18:44 C:\Users{username}\AppData\Roaming\Notepad++\config.xml 7138/7138 bytes are written.
2022-01-31 08:18:44 C:\Users{username}\AppData\Roaming\Notepad++\config.xml is closed.
2022-01-31 08:18:44 C:\Users{username}\AppData\Roaming\Notepad++\session.xml is opened.
2022-01-31 08:18:44 C:\Users{username}\AppData\Roaming\Notepad++\session.xml 193/193 bytes are written.
2022-01-31 08:18:44 C:\Users{username}\AppData\Roaming\Notepad++\session.xml is closed.
2022-01-31 08:18:44 WM_ENDSESSION
2022-01-31 08:18:44 WM_DESTROY

My question is, if you have opened 2 instances of Notepad++ in the same time before windows upgrading's restart?

sorin-costea commented 2 years ago

@donho I definitely don't use two notepad++ instances, unless there's something crashed/windowless behind the scenes I have no idea about. Maybe some zombie instance causes the above losses?

jrbecart commented 2 years ago

Same here. It happens so often (company policy updates reboots when comp is unattended) that I wrote me a script to regenerate the sessions.xml from the backup dir.

Here is one script in python that shoud work if anyone need it:


# encoding=utf-8
import os
import tempfile

class SessionRecovery(object):
    xml_prefix = "<?xml version=\"1.0\" encoding=\"UTF-8\" ?> \n<NotepadPlus> \n<Session activeView=\"0\"> \n<mainView activeIndex=\"2\">"
    xml_suffix = "</mainView>\n <subView activeIndex=\"0\" />\n</Session>\n</NotepadPlus>\n"
    xml_entry1 = "<File firstVisibleLine=\"0\" xOffset=\"0\" scrollWidth=\"64\" startPos=\"8\" endPos=\"8\" selMode=\"0\" offset=\"0\" wrapCount=\"1\" lang=\"None (Normal Text)\" encoding=\"-1\" userReadOnly=\"no\" filename=\""
    xml_entry2 = "backupFilePath=\""
    xml_endentry = "originalFileLastModifTimestamp=\"0\" originalFileLastModifTimestampHigh=\"0\" mapFirstVisibleDisplayLine=\"-1\" mapFirstVisibleDocLine=\"-1\" mapLastVisibleDocLine=\"-1\" mapNbLine=\"-1\" mapHigherPos=\"-1\" mapWidth=\"-1\" mapHeight=\"-1\" mapKByteInDoc=\"512\" mapWrapIndentMode=\"-1\" mapIsWrap=\"no\" />"
    xml_full = ""

    def go(self):
        self.determine_directories()
        self.build_xml()
        print(self.xml_full)
        return

    def determine_directories(self):
        cfg_plg_cfg = "H:\\backup\\"
        (cfg_plg, x) = os.path.split(cfg_plg_cfg)
        (self.cfg_dir, x) = os.path.split(cfg_plg)
        self.bkup_dir = os.path.join(self.cfg_dir, 'backup')
        self.xml_full = self.xml_prefix
        self.session_xml_path = os.path.join(self.cfg_dir, 'session.xml')
        return

    def build_xml(self):
        for (root, dirs, files) in os.walk(self.bkup_dir):
            for f in files:
                filepath = os.path.join(root, f)
                posFile = filepath.find(f)
                posAt = filepath.find("@")
                entry_name = filepath[posFile:posAt]
                this_entry = self.xml_entry1 + entry_name + '" ' + self.xml_entry2 + filepath + '" ' + self.xml_endentry + "\n"
                self.xml_full += "\n    " + this_entry
        self.xml_full += self.xml_suffix
        return

SessionRecovery().go()
`
alankilborn commented 2 years ago

@jrbecart Some external code seems a common way to solve it; HERE's a similar one.

xomx commented 2 years ago

@donho

What is interesting in the log is there are 2 WM_QUERYENDSESSION sent and config.xml & session.xml are written 2 times:

Here is the same pattern reported (from the size of the session.xml file is evident that it gets emptied after the 2nd WM_QUERYENDSESSION record): https://community.notepad-plus-plus.org/post/79874

And I have a (unconfirmed yet) theory how to explain that: https://community.notepad-plus-plus.org/post/79892

So if you will agree, I could prepare a simple testing PR, where I simply detect a previous WM_QUERYENDSESSION at the WM_CLOSE time (for that 2nd WM_QUERYENDSESSION log-record is probably responsible the WM_CLOSE, as they are sharing the same switch->case: code...) e.g. at this place, so the session.xml will not be overwritten by an already emptied session.

donho commented 2 years ago

So if you will agree, I could prepare a simple testing PR

@xomx Yes, sure. go ahead please.

sorin-costea commented 2 years ago

Is there ever a need to overwrite an existing session with an empty one? Would be simpler to check for this?

xomx commented 2 years ago

@sorin-costea

Is there ever a need to overwrite an existing session with an empty one?

Of course not, that is the supposed bug I described (at this stage it is not verified/debugged).

Would be simpler to check for this?

That is the solution I mentioned above (detection of that situation).

Maybe my previous explanation was not clear enough, so I try again:

I need also to check if the Windows restart forced by OS itself behaves differently in this situation than the restart initiated by a user.

I will post here my progress on that stuff if any.

sorin-costea commented 2 years ago

@xomx thank you for the explanation! I got it now. You said that during execution of the first close message the files/tabs get saved/closed. But should't then the N++ session get closed as well? Then a second message would find nothing to do... (unless they're async, or N++ can't exist without an open session)

xomx commented 2 years ago

@sorin-costea You are describing one possible way how to fix that assumed bug condition . But do not forget that this is still a Gedankenexperiment only. I tried that to explain the findings from the nppLogNulContentCorruptionIssue logs reported. I need to find a spare time and verify my theory 1st. When true then we can start talking about the best way how to fix it.

xomx commented 2 years ago

I tried different ways to obtain the same relevant pattern (duplication of the WM_QUERYENDSESSION records) in the nppLogNulContentCorruptionIssue.log together with the emptied session.xml, but I have not succeeded yet.

Next to a usual user initiated system restart/shutdown, I tried a lot of different scenarios, namely the:

Unfortunately no real Windows update forced restart while I was away from my PC.

So to continue I will need help from those, who suffers from this issue:

29988122 commented 2 years ago

Yeah unfortunately I encountered one. 10/14. I'll leave others there since IIRC at least 50% of the logs are because of windows update force reboot. Hope it helps!

2022-01-12 14:38:03  WM_QUERYENDSESSION =====================================
2022-01-16 16:52:18  WM_QUERYENDSESSION =====================================
2022-01-16 16:52:18  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml is opened.
2022-01-16 16:52:19  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml  12418/12418 bytes are written.
2022-01-16 16:52:19  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml is closed.
2022-01-16 16:52:19  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml is opened.
2022-01-16 16:52:19  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml  1396/1396 bytes are written.
2022-01-16 16:52:20  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml is closed.
2022-01-16 16:52:20  WM_ENDSESSION
2022-01-16 16:52:20  WM_DESTROY
2022-03-18 16:16:32  WM_QUERYENDSESSION =====================================
2022-03-18 16:16:32  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml is opened.
2022-03-18 16:16:32  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml  12866/12866 bytes are written.
2022-03-18 16:16:32  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml is closed.
2022-03-18 16:16:32  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml is opened.
2022-03-18 16:16:33  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml  800/800 bytes are written.
2022-03-18 16:16:33  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml is closed.
2022-03-18 16:16:33  WM_ENDSESSION
2022-03-18 16:16:33  WM_DESTROY
2022-04-04 17:39:53  WM_QUERYENDSESSION =====================================
2022-04-04 17:39:53  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml is opened.
2022-04-04 17:39:53  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml  12866/12866 bytes are written.
2022-04-04 17:39:54  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml is closed.
2022-04-04 17:39:54  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml is opened.
2022-04-04 17:39:54  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml  804/804 bytes are written.
2022-04-04 17:39:54  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml is closed.
2022-04-04 17:39:54  WM_ENDSESSION
2022-04-04 17:39:54  WM_DESTROY
2022-04-09 12:58:42  WM_QUERYENDSESSION =====================================
2022-04-25 16:21:50  WM_QUERYENDSESSION =====================================
2022-04-25 18:50:37  WM_QUERYENDSESSION =====================================
2022-04-25 18:50:37  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml is opened.
2022-04-25 18:50:37  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml  12827/12827 bytes are written.
2022-04-25 18:50:37  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml is closed.
2022-04-25 18:50:37  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml is opened.
2022-04-25 18:50:37  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml  1399/1399 bytes are written.
2022-04-25 18:50:37  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml is closed.
2022-04-25 18:50:38  WM_ENDSESSION
2022-04-25 18:50:38  WM_DESTROY
2022-05-04 18:04:25  WM_QUERYENDSESSION =====================================
2022-05-04 18:04:26  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml is opened.
2022-05-04 18:04:26  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml  12837/12837 bytes are written.
2022-05-04 18:04:26  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml is closed.
2022-05-04 18:04:26  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml is opened.
2022-05-04 18:04:26  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml  3882/3882 bytes are written.
2022-05-04 18:04:26  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml is closed.
2022-05-04 18:04:26  WM_ENDSESSION
2022-05-04 18:04:27  WM_DESTROY
2022-05-14 06:12:02  WM_QUERYENDSESSION =====================================
2022-05-14 06:12:02  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml is opened.
2022-05-14 06:12:02  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml  13195/13195 bytes are written.
2022-05-14 06:12:02  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml is closed.
2022-05-14 06:12:02  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml is opened.
2022-05-14 06:12:02  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml  5078/5078 bytes are written.
2022-05-14 06:12:02  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml is closed.
2022-05-14 06:45:02  WM_QUERYENDSESSION =====================================
2022-05-14 06:45:02  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml is opened.
2022-05-14 06:45:02  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml  17535/17535 bytes are written.
2022-05-14 06:45:02  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml is closed.
2022-05-14 06:45:02  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml is opened.
2022-05-14 06:45:02  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml  193/193 bytes are written.
2022-05-14 06:45:02  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml is closed.
2022-05-14 13:20:00  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\cloud\choice is opened.
2022-05-14 13:20:00  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\cloud\choice  45/45 bytes are written.
2022-05-14 13:20:00  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\cloud\choice is closed.
2022-05-14 13:23:46  WM_QUERYENDSESSION =====================================
2022-05-14 13:23:46  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml is opened.
2022-05-14 13:23:46  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml  21979/21979 bytes are written.
2022-05-14 13:23:46  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml is closed.
2022-05-14 13:23:46  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml is opened.
2022-05-14 13:23:46  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml  4439/4439 bytes are written.
2022-05-14 13:23:46  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml is closed.
2022-05-14 13:23:46  WM_DESTROY
2022-05-17 15:26:05  WM_QUERYENDSESSION =====================================
2022-05-17 15:26:05  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml is opened.
2022-05-17 15:26:05  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml  12214/12214 bytes are written.
2022-05-17 15:26:06  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml is closed.
2022-05-17 15:26:06  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml is opened.
2022-05-17 15:26:06  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml  1994/1994 bytes are written.
2022-05-17 15:26:06  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml is closed.
2022-05-17 15:26:06  WM_ENDSESSION
2022-05-17 15:26:06  WM_DESTROY
2022-07-25 18:06:20  WM_QUERYENDSESSION =====================================
2022-07-25 18:06:20  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml is opened.
2022-07-25 18:06:21  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml  12095/12095 bytes are written.
2022-07-25 18:06:21  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml is closed.
2022-07-25 18:06:21  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml is opened.
2022-07-25 18:06:21  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml  2630/2630 bytes are written.
2022-07-25 18:06:21  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml is closed.
2022-07-25 18:06:21  WM_ENDSESSION
2022-07-25 18:06:21  WM_DESTROY
2022-08-12 06:23:02  WM_QUERYENDSESSION =====================================
2022-08-12 06:23:03  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml is opened.
2022-08-12 06:23:03  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml  12268/12268 bytes are written.
2022-08-12 06:23:03  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml is closed.
2022-08-12 06:23:03  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml is opened.
2022-08-12 06:23:03  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml  3868/3868 bytes are written.
2022-08-12 06:23:03  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml is closed.
2022-08-12 06:23:08  WM_QUERYENDSESSION =====================================
2022-08-12 06:23:08  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml is opened.
2022-08-12 06:23:08  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml  15681/15681 bytes are written.
2022-08-12 06:23:09  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml is closed.
2022-08-12 06:23:09  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml is opened.
2022-08-12 06:23:09  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml  193/193 bytes are written.
2022-08-12 06:23:09  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml is closed.
2022-08-12 06:23:09  WM_ENDSESSION
2022-08-12 06:23:09  WM_DESTROY
2022-08-12 15:11:58  WM_QUERYENDSESSION =====================================
2022-08-12 15:11:58  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml is opened.
2022-08-12 15:11:58  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml  12305/12305 bytes are written.
2022-08-12 15:11:58  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml is closed.
2022-08-12 15:11:59  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml is opened.
2022-08-12 15:11:59  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml  3781/3781 bytes are written.
2022-08-12 15:11:59  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml is closed.
2022-08-12 15:11:59  WM_ENDSESSION
2022-08-12 15:20:26  WM_QUERYENDSESSION =====================================
2022-08-12 15:20:26  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml is opened.
2022-08-12 15:20:26  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml  12305/12305 bytes are written.
2022-08-12 15:20:26  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml is closed.
2022-08-12 15:20:26  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml is opened.
2022-08-12 15:20:26  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml  3778/3778 bytes are written.
2022-08-12 15:20:26  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml is closed.
2022-08-12 15:20:26  WM_ENDSESSION
2022-08-12 15:20:27  WM_DESTROY
2022-09-17 09:09:12  WM_QUERYENDSESSION =====================================
2022-09-17 09:09:13  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml is opened.
2022-09-17 09:09:13  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml  11375/11375 bytes are written.
2022-09-17 09:09:13  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml is closed.
2022-09-17 09:09:13  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml is opened.
2022-09-17 09:09:13  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml  11644/11644 bytes are written.
2022-09-17 09:09:13  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml is closed.
2022-09-17 09:09:13  WM_ENDSESSION
2022-09-17 09:09:13  WM_DESTROY
2022-09-18 11:37:21  WM_QUERYENDSESSION =====================================
2022-09-18 11:37:21  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml is opened.
2022-09-18 11:37:21  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml  11375/11375 bytes are written.
2022-09-18 11:37:21  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml is closed.
2022-09-18 11:37:21  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml is opened.
2022-09-18 11:37:21  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml  11636/11636 bytes are written.
2022-09-18 11:37:21  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml is closed.
2022-09-18 11:37:22  WM_ENDSESSION
2022-09-18 11:37:22  WM_DESTROY
2022-10-11 15:19:57  WM_QUERYENDSESSION =====================================
2022-10-11 15:19:57  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml is opened.
2022-10-11 15:19:58  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml  11571/11571 bytes are written.
2022-10-11 15:19:58  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml is closed.
2022-10-11 15:19:58  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml is opened.
2022-10-11 15:19:58  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml  12810/12810 bytes are written.
2022-10-11 15:19:58  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml is closed.
2022-10-11 15:19:58  WM_ENDSESSION
2022-10-11 15:19:58  WM_DESTROY
2022-10-14 06:28:02  WM_QUERYENDSESSION =====================================
2022-10-14 06:28:02  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml is opened.
2022-10-14 06:28:02  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml  11571/11571 bytes are written.
2022-10-14 06:28:03  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml is closed.
2022-10-14 06:28:03  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml is opened.
2022-10-14 06:28:03  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml  13393/13393 bytes are written.
2022-10-14 06:28:03  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml is closed.
2022-10-14 06:28:16  WM_QUERYENDSESSION =====================================
2022-10-14 06:28:16  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml is opened.
2022-10-14 06:28:16  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml  14289/14289 bytes are written.
2022-10-14 06:28:16  F:\Google Drive\SyncFolder\Notepad++\Settings\config.xml is closed.
2022-10-14 06:28:16  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml is opened.
2022-10-14 06:28:16  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml  193/193 bytes are written.
2022-10-14 06:28:16  C:\Users\Jerry Ho\AppData\Roaming\Notepad++\session.xml is closed.
2022-10-14 06:28:17  WM_ENDSESSION
2022-10-14 06:28:17  WM_DESTROY
xomx commented 2 years ago

@29988122

Thank you for your log and sorry for the N++ session lost. Your log confirmed the "double WM_QUERYENDSESSION" pattern, when the session is lost. Unfortunately now I need a log from the updated N++ (please see above), it will look like:

2022-10-14 09:48:35  WM_QUERYENDSESSION (lParam: 1073741824 - ENDSESSION_CRITICAL) =====================================
2022-10-14 09:48:35  E:\NPP_TESTS\NPP_shutdown\notepad-plus-plus-8.4.6\PowerEditor\visual.net\x64\Debug\config.xml is opened.
2022-10-14 09:48:35  E:\NPP_TESTS\NPP_shutdown\notepad-plus-plus-8.4.6\PowerEditor\visual.net\x64\Debug\config.xml  7289/7289 bytes are written.
2022-10-14 09:48:35  E:\NPP_TESTS\NPP_shutdown\notepad-plus-plus-8.4.6\PowerEditor\visual.net\x64\Debug\config.xml is closed.
2022-10-14 09:48:35  E:\NPP_TESTS\NPP_shutdown\notepad-plus-plus-8.4.6\PowerEditor\visual.net\x64\Debug\session.xml is opened.
2022-10-14 09:48:35  E:\NPP_TESTS\NPP_shutdown\notepad-plus-plus-8.4.6\PowerEditor\visual.net\x64\Debug\session.xml  2659/2659 bytes are written.
2022-10-14 09:48:35  E:\NPP_TESTS\NPP_shutdown\notepad-plus-plus-8.4.6\PowerEditor\visual.net\x64\Debug\session.xml is closed.
2022-10-14 09:48:35  WM_ENDSESSION (wParam: TRUE, lParam: 1073741824 - ENDSESSION_CRITICAL)
2022-10-14 09:48:35  WM_DESTROY

I still cannot reproduce the problem so I am relying on the other users logs.

pnedev commented 2 years ago

@xomx ,

I don't have much spare time looking into the WM_QUERYENDSESSION code (thanks for working on this :+1: ) but I think that it might be happening when there are several opened programs before the restart (not just Notepad++). So before restarting, Windows sends WM_QUERYENDSESSION to all programs in some pseudo-random order (maybe??? IDK) and maybe it depends if some program delays it's answer or stops the restart temporarily and then another WM_QUERYENDSESSION is coming. So for example Windows sends WM_QUERYENDSESSION to N++ and then to another opened program B which slows a bit the reboot and then maybe Windows sends again WM_QUERYENDSESSION to all programs (including N++ which has already handled it and has already saved the session). Maybe it doesn't happen if WM_QUERYENDSESSION is sent to N++ last (after it is sent to program B). The fact is that for some OS reason WM_QUERYENDSESSION might come several times and maybe the remedy is to have some atomic bool flag in N++ that marks we have already processed the first WM_QUERYENDSESSION and have already stored the session.

BR

sorin-costea commented 2 years ago

Oh oh this might be something. I just had it again yesterday when I let Windows reboot for updates - and as usual, it hung a bit on the screen "can't reboot until these programs are closed, u sure?" (not the exact wording). So Win could have sent a second round of messages right then? No, I didn't install the special npp 🤷‍♂️

xomx commented 2 years ago

@pnedev

Yes, I was thinking that way yesterday, when I saw (as you) this.

But unfortunately I was not able to reproduce it that way. I clicked on Cancel, when it was offered to me by the blue Windows restart screen to interrupt the shutdown and handle some other apps with unfinished business, but N++ has been usually already closed at that time (no session lost).

So I even got the N++ in a state (e.g. I modified externally one of its opened files to bring up the N++ Reload dlg "This file has been modified by another program. Do you want to reload it?"...), where it survived the 1st shutdown round, but after the 2nd shutdown the session file was still ok (not emptied, even if the N++ in such state got crashed...).

It is a little bit crazy that I am not able to lost my N++ session, when many others can :-)

As for the solution - yes, I am prepared to do something like that even in the case I will not be able to reproduce the issue at all.

xomx commented 2 years ago

@sorin-costea

as usual, it hung a bit on the screen "can't reboot until these programs are closed, u sure?" (not the exact wording).

On that Windows screen - did you click on the "Restart anyway" (or "Cancel" and then initiated the restart again)? restart_choice_small

sorin-costea commented 2 years ago

Restart anyway, and NPP was in the app list. On this computer I have 2 tabs open, BOTH unsaved - maybe this is important, that they're not from the filesystem just fresh npp tabs like new3 and new4?

pnedev commented 2 years ago

@xomx ,

Do you have "Enable session snapshot and periodic backup" setting turned on?

The reason I'm asking is this scenario:

Windows wants to install updates and sends WM_QUERYENDSESSION to N++. Then as you said the reboot is interrupted by some other program or by the user and N++ continue working normally (but the session is saved and emptied?). And then the periodic backup thread kicks-in and save the empty session. That is in case WM_QUERYENDSESSION is the time when the session is saved and emptied. That's what might have happened in report https://community.notepad-plus-plus.org/post/80530 as well.

If you haven't done that already you could try enabling "Periodic backup...", set the time period to some pretty small value (3 sec. for instance) and then retry interrupting the Windows force-reboot.

Thanks once again for looking into this!

pnedev commented 2 years ago

Oh, @xomx , one more thing that come to mind - maybe it is best if we force-close Notepad++ from inside in WM_QUERYENDSESSION event case. That way we won't rely on the OS to send the actual close event itself and will be safe even if the reboot is cancelled for some reason. It appears from your tests that Notepad++ is not prepared for the scenario when it acknowledges the WM_QUERYENDSESSION but some other program (or the user) interrupts it - it is not in a state to continue working properly (you mentioned it crashed :( ).

xomx commented 2 years ago

@sorin-costea

Restart anyway, and NPP was in the app list. On this computer I have 2 tabs open, BOTH unsaved - maybe this is important, that they're not from the filesystem just fresh npp tabs like new3 and new4?

Thanks for the additional info.

But there should be something extra, as when I tried your N++ state (two unsaved/unnamed tabs), my N++ was not on the Windows restart screen list, only the other apps like WordPad etc...)

ArkadiuszMichalski commented 2 years ago

@xomx Have you tried with some real system update and reboot? Preferably through a virtual machine because it can be replicated if necessary? https://github.com/notepad-plus-plus/notepad-plus-plus/issues/9850#issuecomment-1261157605

Some note about such confirmation https://github.com/notepad-plus-plus/notepad-plus-plus/issues/9850#issuecomment-1278871526 I noticed that Win11 can force such a restart without user interaction, even when we put the computer to sleep. I had the machine asleep several times and it woke up by itself several times in the morning hours and it does an update, reboot and back to sleep. I just wake up in the morning, wake up the computer, and all programs are closed except Chrome :) This is complete disaster, not all programs are prepared for such situation (some can ruin their settings because of it, which I just experience quite regularly when switch from Win7 to Win11).

On the other hand, I am not 100% sure if it looks like this, maybe when I put the computer to sleep it updates something (but I don't think so, because it goes to sleep quickly, as if these patches are not installed yet). I will examine it more carefully in the next major update that requires a reboot or play with some VM.

Maybe that's why people have such frequent problems with it, because they aren't even aware that they've auto-restarted when they weren't even close to the computer.

Btw., Theoretically, this restart can be turned off with an entry in the registry or via gpedit. I haven't tried it yet, but for the sake of peace, it's better to do it as soon as possible. I don't know if such tricks still works because MS likes to break a lot of things with new updates.

xomx commented 2 years ago

@pnedev

Do you have "Enable session snapshot and periodic backup" setting turned on?

Both ON, tried several periods from 3 to 60 secs.

maybe it is best if we force-close Notepad++ from inside in WM_QUERYENDSESSION event case

Interesting idea.

It appears from your tests that Notepad++ is not prepared for the scenario

Exactly my suspicion.

I have in my mind some enhancement in this area, e,g, this, but we need to fix this issue 1st.

xomx commented 2 years ago

@ArkadiuszMichalski

Have you tried with some real system update and reboot?

No. I stated it somewhere above - no real Windows Update forced restart on my machines, where I tested so far. I know that this system reboot is probably somewhat different, that is why I asked other users here for the logs (with the updated N++ shutdown logging capability).

I noticed that Win11 can force such a restart without user interaction, even when we put the computer to sleep

It seems that the WU becomes a monster not easy to tame :-)

Thanks for the WM tip. I even have started preparation for that before, but did not finish that for some other reason (maybe I should give it another try, I used this in VirtualBox, if someone else would like to help me).

pnedev commented 2 years ago

@ArkadiuszMichalski , @xomx ,

I haven't dug deeply in Windows11 settings but if I recall correctly it had some reboot scheduling like "Restart in inactive hours" and user can set the actual "inactive hours". I might not remember correctly :)

But Windows has reserved the right to force-restart in case of critical updates: (excerpt from https://learn.microsoft.com/en-us/windows/win32/rstmgr/guidelines-for-applications)

"If any applications do not shut down in response to the shutdown messages, installers can use the RmForceShutdown option of the RmShutdown function to force the applications to shut down. When the installer specifies a forced shutdown, Restart Manager attempts to shut down the applications cleanly by sending the shutdown messages, but will force them shut if this fails. GUI applications and console applications can be forced to shut down to enable the installation of a critical security update."

And another interesting guideline (from https://learn.microsoft.com/en-us/windows/win32/shutdown/wm-queryendsession):

"Each application should return TRUE or FALSE immediately upon receiving this message, and defer any cleanup operations until it receives the WM_ENDSESSION message.

Applications can display a user interface prompting the user for information at shutdown, however it is not recommended. After five seconds, the system displays information about the applications that are preventing shutdown and allows the user to terminate them."

xomx commented 2 years ago

@pnedev

Even if we have not received any report with the enhanced version of the nppLogNulContentCorruptionIssue.log yet, we can try another thought-experiment - the problem with "double WM_QUERYENDSESSION" could be now:

Let's now talk about the B) only:

gwinkless commented 2 years ago

So to continue I will need help from those, who suffers from this issue:

  • you can use a separate portable N++ for this test or your current N++ installation (I recommend the portable one, as you can open it, create few new tabs with a content in them and leave it running minimized until the issue reappears...)
  • download N++ AppVeyor executable with enhanced EndSession logging possibility (32-bit, 64-bit)
  • replace your current notepad++.exe
  • run this N++, open few tabs with a content, wait for the issue to reappear
  • then paste here please your nppLogNulContentCorruptionIssue.log

This appveyor executable crashes for me.

Faulting application name: notepad++.exe, version: 8.4.6.0, time stamp: 0x633c57d4 Faulting module name: notepad++.exe, version: 8.4.6.0, time stamp: 0x633c57d4 Exception code: 0xc0000005 Fault offset: 0x0000000000202004 Faulting process ID: 0x%9 Faulting application start time: 0x%10 Faulting application path: %11 Faulting module path: %12 Report ID: %13 Faulting package full name: %14 Faulting package-relative application ID: %15

xomx commented 2 years ago

@gwinkless

This appveyor executable crashes for me.

At Windows restart/shutdown or during a usual use?

xomx commented 2 years ago

Finally - I succeeded in reproduction of this issue in a Win11 WM (a real forced Windows Update there), my N++ session is lost at last :-)

It is a specific combination of two different ENDSESSIONs: ENDSESSION_CLOSEAPP and ENDSESSION_CRITICAL.

I will try a PR for this.

Enhanced log:

2022-10-15 13:24:19  WM_QUERYENDSESSION (lParam: 1 - ENDSESSION_CLOSEAPP) =====================================
2022-10-15 13:24:19  C:\NPP_TESTS\NPP_shutdown\notepad-plus-plus-master_847devel\PowerEditor\visual.net\x64\Debug\config.xml is opened.
2022-10-15 13:24:19  C:\NPP_TESTS\NPP_shutdown\notepad-plus-plus-master_847devel\PowerEditor\visual.net\x64\Debug\config.xml  7215/7215 bytes are written.
2022-10-15 13:24:19  C:\NPP_TESTS\NPP_shutdown\notepad-plus-plus-master_847devel\PowerEditor\visual.net\x64\Debug\config.xml is closed.
2022-10-15 13:24:19  C:\NPP_TESTS\NPP_shutdown\notepad-plus-plus-master_847devel\PowerEditor\visual.net\x64\Debug\session.xml is opened.
2022-10-15 13:24:19  C:\NPP_TESTS\NPP_shutdown\notepad-plus-plus-master_847devel\PowerEditor\visual.net\x64\Debug\session.xml  2152/2152 bytes are written.
2022-10-15 13:24:19  C:\NPP_TESTS\NPP_shutdown\notepad-plus-plus-master_847devel\PowerEditor\visual.net\x64\Debug\session.xml is closed.
2022-10-15 13:24:20  WM_QUERYENDSESSION (lParam: 1073741825 - ENDSESSION_CLOSEAPP - ENDSESSION_CRITICAL) =====================================
2022-10-15 13:24:20  C:\NPP_TESTS\NPP_shutdown\notepad-plus-plus-master_847devel\PowerEditor\visual.net\x64\Debug\config.xml is opened.
2022-10-15 13:24:20  C:\NPP_TESTS\NPP_shutdown\notepad-plus-plus-master_847devel\PowerEditor\visual.net\x64\Debug\config.xml  7215/7215 bytes are written.
2022-10-15 13:24:20  C:\NPP_TESTS\NPP_shutdown\notepad-plus-plus-master_847devel\PowerEditor\visual.net\x64\Debug\config.xml is closed.
2022-10-15 13:24:20  C:\NPP_TESTS\NPP_shutdown\notepad-plus-plus-master_847devel\PowerEditor\visual.net\x64\Debug\session.xml is opened.
2022-10-15 13:24:20  C:\NPP_TESTS\NPP_shutdown\notepad-plus-plus-master_847devel\PowerEditor\visual.net\x64\Debug\session.xml  193/193 bytes are written.
2022-10-15 13:24:20  C:\NPP_TESTS\NPP_shutdown\notepad-plus-plus-master_847devel\PowerEditor\visual.net\x64\Debug\session.xml is closed.
2022-10-15 13:24:20  WM_ENDSESSION (wParam: TRUE, lParam: 1073741825 - ENDSESSION_CLOSEAPP - ENDSESSION_CRITICAL)
2022-10-15 13:24:20  WM_DESTROY
sorin-costea commented 2 years ago

I wonder actually why there's a session OPENING in between 🤔 (when handling a closing message) but either way great news, thank you so much!

gwinkless commented 2 years ago

@xomx

@gwinkless

This appveyor executable crashes for me.

At Windows restart/shutdown or during a usual use?

On opening. Admittedly it's opening a lot of files (150 or so?), is that a contributor?

gwinkless commented 2 years ago

Finally - I succeeded in reproduction of this issue in a Win11 WM (a real forced Windows Update there), my N++ session is lost at last :-)

It is a specific combination of two different ENDSESSIONs: ENDSESSION_CLOSEAPP and ENDSESSION_CRITICAL.

Ah, excellent.

xomx commented 2 years ago

@sorin-costea

I wonder actually why there's a session OPENING in between

No, there is not such opening. I think that N++ has always at least one tab opened by design.

@gwinkless

On opening. Admittedly it's opening a lot of files (150 or so?), is that a contributor?

Should not. But this AppVeyor build is a development snapshot somewhere in between the old v8.4.6 and a possible future v8.4.7. Maybe there is a problem in the new code, IDK.

pnedev commented 2 years ago

@xomx ,

Great news, thank you! :+1:

xomx commented 2 years ago

@pnedev I am nearly finished with the fix, now I just need to reset the testing WM for the final proof by another real forced WU.

For this issue STR purposes:

To reproduce that on a real machine with a real forced Windows Update behind, one has to have at least one more app running, which has some unfinished business (e.g. open Windows WordPad, type there few characters and let it running too, it then answers FALSE to the 1st round of the WM_QUERYENDSESSION messages). Such app effectively causes temporary abort of the shutdown (all running apps then receive WM_ENDSESSION from the system with its WPARAM set to FALSE). Then the system sends another set of the WM_QUERYENDSESSIONs, this time with the ENDSESSION_CRITICAL flag and the apps can no longer interrupt it. N++ executes for the 2nd time its tidy-up code, but at this time all the N++ session files have been already closed, so the result is the emptied session.xml file.