Windows 11 22H2 has a different way of using the JS engine?

Julie Jiang 6

Dear support,

Our company has a solution built on a WebBrowser that will use the JS engine. After upgrading to Windows 11 22H2, we found that the solution behaves differently from before. We did some research, and then found that Windows 11 22H2 has a different way of using the JS engine from the previous versions:

Before Windows 11 22H2, when the WebBrowser calls the JS engine, it loads jscript9.dll and jscript.dll for the job;
In Windows 11 22H2, when when the WebBrowser calls the JS engine, it loads jscript9.dll and jscriptlegacy.dll.

Due to this difference, our solution has practically stopped working. (We tried a few solutions, but the result is not good).

We believe there is little chance for you to change the current behavior of Windows 11 22H2... So, can you advise us how it is possible for us to change our solution to still use the old way in Windows 11 22H2 (when the WebBrowser calls the JS engine, it loads jscript9.dll and jscript.dll)?

Best regards,

Julie

MotoX80 34,511 Reputation points

2022-11-02T19:51:02.497+00:00

I think that you are going to have a challenge loading different dll's, especially since those are in system32. Is this a web based application where users run MSEdge/Chrome/Firefox? Do all browsers have the same problem? Or is it a compiled app that uses a WebBrowser control?

If Javascript is now broken in 22H2, then I would expect that to impact a ton of web sites everywhere. You might have
better luck if you provided some sample code and explain how it used to work and what it now does.

Is the code doing something "unique"?
YujianYao-MSFT 4,291 Reputation points Microsoft Vendor

2022-11-07T06:03:23.52+00:00

Hi @Julie Jiang ,

If you want paid support, you could click this link.
Philippe Majerus 0 Reputation points

2024-09-07T14:17:26.55+00:00

Indeed, JScript (COM Classic) 5.8 has apparently been replaced by a version of Chakra reworked to be compatible with Active Scripting hosts.
Unfortunately, it is not fully compatible. For example, the new engine does not support conditional compilation, and does not support setting an object to a global object property. (when a named object from the host is added as SCRIPTITEM_GLOBALMEMBERS and one of its property supports propputref to assign an object as its value.

I suspect the idea is to take advantage of Chakra to improve the security of the JScript COM Classic engine, and while that is much better news than dropping JScript like VBScript, a bit more work is needed to ensure full compatibility with the previous engine.

I would also argue that the ScriptEngineMajorVersion() and ScriptEngineMinorVersion() functions should return 5 and 8 respectively, and maybe increase the ScriptEngineBuildVersion() number. Because the way it is right now, lot of scripts that use those values to differentiate JScript 5.8 {F414C260-6AC0-11CF-B6D1-00AA00BBBB58} from Chakra (JScript9) {16D51579-A30B-4C8B-A276-0FF4DC41E755} (which is even less compatible with Active Scripting hosts).
Philippe Majerus 0 Reputation points

2024-09-20T16:18:36.4866667+00:00

Another compatibility bug found in the new JScript legacy engine:

The original JScript (COM Classic) engine supported calling new on an object, it would invoke DISPID_VALUE through its IDispatchEx::InvokeEx method with the DISPATCH_CONSTRUCT flag.

The new engine fails with a 0x800A01C0 "Named argument not found" error.
Philippe Majerus 0 Reputation points

2024-11-08T14:21:21.4833333+00:00

And another compatibility bug in the new JScript legacy engine:

VT_I8 and VT_UI8 (64-bit signed and unsigned integers) were kept as it in JScript, handled as opaque "unknown" types that could be passed around between COM objects.
In the new engine, those values are automatically coerced into Numbers (VT_R8), and lose their precision.

For example, an object could return a VT_I8, you could store it in a JScript variable, and pass it to another object's method, keeping the 64-bit integer precision.
Now, they will be converted to VT_R8 (Number/Double/binary64) when received by JScript, and will therefore lose precision (as the mantissa is only 53 bits, not 64).

This makes it impossible to reliably pass around 64-bit integers when using JScript as a glue language between COM objects.

1 answer

Julie Jiang 6 Reputation points

2022-11-03T05:05:15.447+00:00

Yes, I believe there is something unique about our product. It is based on COM, and uses Webbrowser control to load JavaScript. There are many JavaScript objects in the application. Each JavaScript object is associated with a C++ object. The C++ object stores the IDispath pointer of the JavaScript object, so that it is possible for the C++ object to directly call the JavaScript object.
Before 22H2, the JavaScript object that IDispatch points to stays valid during the lifetime of the JavaScript object.
However in 22H2, the JavaScript object becomes a temp object, and gets destroyed by the JavaScript engine after it is passed as parameter to the C++ object. And then if the C++ object wants to call the JavaScript object, the call would fail because it cannot find the JavaScript object.
Then we tracked the calls, and found that there is a difference in the files being loaded when the WebBrowser calls the JavaScript engine (as provided in the earlier description, from jscript9.dll and jscript.dll, to jscript9.dll and jscriptlegacy.dll).

Best regards,
Julie
Please sign in to rate this answer.
MotoX80 34,511 Reputation points

2022-11-03T13:11:09.803+00:00

I've written COM code before but this, as they say, is beyond my pay grade. I would recommend that you add these tags to this post to try to reach forum users who might have coding experience at that level.

c++
dotnet-csharp
ms-edge
windows-api

Have you tried copying the old jscript dll's into your program's bin folder? I don't see jscript listed in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs so Windows shouldn't force them to be loaded from system32.

Julie Jiang 6 Reputation points

2022-11-04T07:04:43.62+00:00

Thanks! I have added the tags you suggested.

We hope to reach a paid support from the Microsoft team for this issue, can you direct me to the channel for the paid support?

Best regards,
Julie

Viorel 118.2K Reputation points

2022-11-04T08:17:31.137+00:00

Maybe you should obtain an IUnknown from IDispatch (which inherits from IUnknown) and call AddRef before storing the object in C++?

MotoX80 34,511 Reputation points

2022-11-04T20:19:46.34+00:00

I don't work for MS. (Retired sysadmin.) I did a search and found these links.

https://support.microsoft.com/en-us/topic/premium-software-support-option-27f783d4-ce63-463c-e765-7a6de4ae1084

https://support.microsoft.com/en-us/topic/support-for-business-1f4c4d09-9047-28ac-bb3b-618757e3bffd

Microsoft Professional Support (pay-per-incident) looks to be what you would need.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Windows 11 22H2 has a different way of using the JS engine?

1 answer

Your answer