AV in WinUI 3 apps due to usage to COM object without calling AddRef #1834
Comments
Sergio0694
added
gc
|
What is an AV? |
|
|
|
The reference count being reported as 0 might be expected. WinUI should be holding onto a tracker reference (see TrackerSupport) on the object which !dumpccw doesn't report. But it seems WinUI must be no longer be seeing the object as referenced in the xaml tree and is not keeping the tracker reference alive during their GC reference walk if the object is going away and is still being accessed. It might also be that if this is happening on the custom property from the previous page being navigated away from, WinUI might need a check to ensure the tracker reference is still alive. Is this easy to repro? |
It requires a lot of times of navigation. But you can try cloning this branch: https://github.com/files-community/Files/tree/ya/wasdk, and keep navigating between folders. It will crash eventually after a lot of times of navigation. Better to use WinDBG instead of VS to debug it as the navigation perf is awful with VS debugger attached. I also have a dump on the AV happens, if you would like I can send it to you. |
|
@manodasanW This is the dump on access violation: https://1drv.ms/u/s!ApWNk8G_rszRg9AsZlWOwdRZO_cnXg?e=a9UGqu |
|
We recently converted a large Xamarin app to MAUI and the WinUI3 app appears to be running this bug relatively frequently. After navigating many times back and forth or hiding and showing views many times the app will hard crash with an AccessViolation. Occasionally the crash will say it is from exit code 3221226356 (Heap corruption) |
|
I was able to repro this. Looking at collecting traces to figure out what might be happening here. It is a bit tricky due to the number of navigations that are needed. |
Describe the bug
We encountered a weird bug where an AV can happen randomly at
PropertyChangedevent, where the code is:The full stack trace:
The AV usually happens on page navigation where the properties need to be updated, and the invalid address is accessed at
Microsoft.ui.xaml.dll!DirectUI::PropertyProviderPropertyAccess::GetValue(IInspectable * * ppValue=0x0000001b0157a2c0) line 103 : C:\__w\1\s\dxaml\xcp\dxaml\lib\PropertyProviderPropertyAccess.cpp(103)where the code is
Normally, the
m_tpPropertyhere is supposed to be the CCW ofABI.Microsoft.UI.Xaml.Data.ManagedCustomProperty, and them_tpSourceis the CCW of the binding value object.But running
!dumpccw <address of m_tpProperty>with windbg gives:you can see although we are using
m_tpProperty, the ref count of it is 0 so that the managed object can be released by someone else and resulting in AV.This can be observed when the AV happens, where dumping the CCW of
m_tpPropertygives:This may be the root cause of the long standing WinUI 3 crashing issue on page navigation, and the issue may not be limited to
ABI.Microsoft.UI.Xaml.Data.ManagedCustomPropertyonly. We should callAddRefto make sure the object won't be released while we are still using it.The text was updated successfully, but these errors were encountered: