[dotnet-sdk-10.0.100-preview.5.25266.36] Some WinUI applications crash with exception code 0xc000027b during runtime

[Junjun-zhao]

Description

When running the 3rd party applications with the latest .NET 10 build, app stop working with exception code 0xc000027b during executing operations.

Reproduction Steps

Debugging Repro steps:
The machine has dotnet-sdk-10.0.100-preview.5.25266.36 installed. Please refer to the repro machine information from devdiv bug.

1.Open "C:\Users\test01\Desktop\AppSource\AskDB\AskDB.sln" with Visual Studio 2022 Preview.
2. Build AskDB.App solution.
3. Update bin\x64\Debug\net8.0 windows10.0.19041.0\AskDB.runtimeconfig.json to run against with dotnet-sdk-10.0.0-preview.5.25265.101:

{
  "runtimeOptions": {
    "tfm": "net8.0",
    "framework": {
      "name": "Microsoft.NETCore.App",
      "version": "10.0.0-preview.5.25265.101"
    },
    "configProperties": {
      "System.Runtime.Serialization.EnableUnsafeBinaryFormatterSerialization": false,
      "CSWINRT_USE_WINDOWS_UI_XAML_PROJECTIONS": false
    }
  }
}

4. Press F5 to start the app.
5. Maximize this app
   6.Click “Connect”.
   7.Select “SQLite”.
   8.Input “Data Source=C:\Users\test01\Desktop\Ombi.db”.
   9.Click “Connect”.
   10.Checked “AspNetRoles” item.
   11.Click “START”.
   12.Input “select name” in Textbox.
   13.Press the Enter key.
   14.Input “list all roles” in Textbox.
   15.Press the Enter key.

App Repro steps:
1.Update the "C:\Users\test01\Desktop\App\AskDB\AskDB.runtimeconfig.json" to run against with .NET 10:

{
  "runtimeOptions": {
    "tfm": "net8.0",
    "framework": {
      "name": "Microsoft.NETCore.App",
      "version": "10.0.0-preview.5.25265.101"
    },
    "configProperties": {
      "System.Runtime.Serialization.EnableUnsafeBinaryFormatterSerialization": false
    }
  }
}

2. Launch application from "C:\Users\test01\Desktop\App\AskDB\AskDB.exe " and maximize.
   3.Click “Connect”.
   4.Select “SQLite”.
   5.Input “Data Source=C:\Users\test01\Desktop\Ombi.db”.
   6.Click “Connect”.
   7.Checked “AspNetRoles” item.
   8.Click “START”.
   9.Input “select name” in Textbox.
   10.Press the Enter key.
   11.Input “list all roles” in Textbox.
   12.Press the Enter key.

Expected behavior

Search successful.

Actual behavior

App crashed and here is error showing during debugging:

   at ABI.Microsoft.UI.Xaml.IDependencyObjectMethods.GetValue(IObjectReference _obj, DependencyProperty dp)

   at CommunityToolkit.WinUI.UI.Controls.DataGridRow.get_IsValid()
   at CommunityToolkit.WinUI.UI.Controls.DataGridRow.ApplyState(Boolean animate)
   at CommunityToolkit.WinUI.UI.Controls.DataGridRow.OnApplyTemplate()
   at Microsoft.UI.Xaml.FrameworkElement.Microsoft.UI.Xaml.IFrameworkElementOverrides.OnApplyTemplate()
   at ABI.Microsoft.UI.Xaml.IFrameworkElementOverrides.Do_Abi_OnApplyTemplate_2(IntPtr thisPtr)
--- End of stack trace from previous location ---
   at WinRT.ExceptionHelpers.<ThrowExceptionForHR>g__Throw|38_0(Int32 hr)
   at ABI.Microsoft.UI.Xaml.IUIElementMethods.Measure(IObjectReference _obj, Size availableSize)
   at Microsoft.UI.Xaml.UIElement.Measure(Size availableSize)
   at CommunityToolkit.WinUI.UI.Controls.DataGrid.InsertDisplayedElement(Int32 slot, UIElement element, Boolean wasNewlyAdded, Boolean updateSlotInformation)
   at CommunityToolkit.WinUI.UI.Controls.DataGrid.OnAddedElement_Phase1(Int32 slot, UIElement element)
   at CommunityToolkit.WinUI.UI.Controls.DataGrid.AddSlotElement(Int32 slot, UIElement element)
   at CommunityToolkit.WinUI.UI.Controls.DataGrid.AddSlots(Int32 totalSlots)
   at CommunityToolkit.WinUI.UI.Controls.DataGrid.RefreshRows(Boolean recycleRows, Boolean clearRows)
   at CommunityToolkit.WinUI.UI.Controls.DataGrid.OnColumnCollectionChanged_PreNotification(Boolean columnsGrew)
   at CommunityToolkit.WinUI.UI.Controls.DataGridColumnCollection.InsertItem(Int32 columnIndex, DataGridColumn dataGridColumn)
   at AskDB.App.MainPage.<SendButton_Click>d__11.MoveNext() in C:\Users\test01\Desktop\AppSource\AskDB\AskDB.App\MainPage.xaml.cs:line 235

Regression?

Yes

1). Windows 10 21H2 AMD64 + dotnet-sdk-10.0.100-preview.5.25270.5: Fail
2). Windows 10 21H2 AMD64 + dotnet-sdk-10.0.100-preview.5.25266.36: Fail
3). Windows 10 21H2 AMD64 + dotnet-sdk-10.0.100-preview.5.25263.2: Pass
4). Windows 10 21H2 AMD64 + dotnet-sdk-9.0.300: Pass
5). Windows 10 21H2 AMD64 + dotnet-sdk-8.0.409: Pass

Known Workarounds

No response

Configuration

Application Name: AskDB, CountdownNumberPuzzleSolver, lively
OS: Windows 10 22H2
CPU: X64
.NET Build Number: dotnet-sdk-10.0.100-preview.5.25266.36
App, App Source Location and repro machine information checking at: https://devdiv.visualstudio.com/DevDiv/_workitems/edit/2483254
Github Link：
https://github.com/phanxuanquang/AskDB
https://github.com/rocksdanister/lively
https://github.com/DHancock/Countdown

Other information

Findings:

When we run the published application executor and do some operations, the application will crash. And there will be an error in Event Viewer:

Faulting application name: AskDB.exe, version: 2.5.0.0, time stamp: 0x67d40000
Faulting module name: Microsoft.ui.xaml.dll, version: 3.1.5.0, time stamp: 0xcd7cc268
Exception code: 0xc000027b
Fault offset: 0x00000000004051c5
Faulting process id: 0xbec
Faulting application start time: 0x01dbca271c09482b
Faulting application path: C:\Users\test01\Desktop\App\AskDB\AskDB.exe
Faulting module path: C:\Users\test01\Desktop\App\AskDB\Microsoft.ui.xaml.dll
Report Id: 9298ce44-049c-43dc-87c8-04b4f5ac247a
Faulting package full name:
Faulting package-relative application ID:

Here is the log from Windbg:

(43a0.50b0): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
00007ffa`24da726b 488b5810        mov     rbx,qword ptr [rax+10h] ds:00000000`00000010=????????????????
0:000> g
(43a0.50b0): CLR exception - code e0434352 (first chance)
(43a0.50b0): Windows Runtime Originate Error - code 40080201 (first chance)
Microsoft.UI.Xaml.dll!00007FF9D9720117: CallContext:[\ImageDecodeActivity] 80004003 - Invalid pointer
(43a0.50b0): CLR exception - code e0434352 (first chance)
(43a0.50b0): Windows Runtime Originate Error - code 40080201 (first chance)
Microsoft.UI.Xaml.dll!00007FF9D9DE4830: CallContext:[\ImageDecodeActivity] 80004003 - Invalid pointer
(43a0.50b0): Unknown exception - code c000027b (!!! second chance !!!)
ntdll!RtlRaiseNoncontinuableException+0xf:
00007ffa`f30b1e1f 488b542428      mov     rdx,qword ptr [rsp+28h] ss:000000b1`afd798e8=000000b1afd79ff0

@dotnet-actwx-bot @dotnet/compat

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/interop-contrib
See info in area-owners.md if you want to be subscribed.

[jkotas]

@jkoritzinsky could you please take a look?

[jkoritzinsky]

Current progress:

Looks like the handle from the ManagedObjectWrapper to the target object is getting released while the ManagedObjectWrapper is still alive.

Still figuring out exactly when or why it's happening.

[hez2010]

Looks like the handle from the ManagedObjectWrapper to the target object is getting released while the ManagedObjectWrapper is still alive.

This is a long-standing issue that has always been there for years. It just popped up more and more frequently recently.
See microsoft/CsWinRT#1834, and our workaround to this issue by stopping updating any reference type objects in the view model: files-community/Files#16793