Some news - I updated the solution to the latest dotnet-maui 7.0.96 and until now the exception seems to be fixed! Yay!
Irregularly occuring HEAP_CORRUPTION (ntdll.dll) in dotnet-maui Windows App
Hi all,
in our dotnet-maui Windows App (dotnet-maui 7.0.92, WinAppSDK 1.3.230724000) we regularly replace and reconstruct huge parts of the UI without navigating between pages. At some point (sadly not reproducible for sure) an exception occurs that is not handled by our user code. The Event Viewer tells us this, which we identified as a heap corruption:
Faulting application name: asdf.exe, version: 7.0.0.5045, time stamp: 0x64e841c5
Faulting module name: ntdll.dll, version: 10.0.22621.2134, time stamp: 0xeee69ec7
Exception code: 0xc0000374
Fault offset: 0x000000000010c239
Faulting process id: 0x0xB5C4
Faulting application start time: 0x0x1D9FAC654425284
Faulting application path: C:\_src\asdf\bin\Debug\net7.0-windows10.0.19041.0\win10-x64\AppX\asdf.exe
Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll
Report Id: 10e9a2fc-6f1f-4a19-b4b6-79acef025c41
Faulting package full name: asdf.asdf.5045_x64__kasdfasdf3w6r
Faulting package-relative application ID: App
I created a memory dump and analyzed it using WinDbg and came up with this Callstack
ERROR_CODE: (NTSTATUS) 0x80000003 - {EXCEPTION} Breakpoint A breakpoint has been reached.
ntdll!RtlReportFatalFailure+0x9
ntdll!RtlReportCriticalFailure+0x97
ntdll!RtlpHeapHandleError+0x12
ntdll!RtlpHpHeapHandleError+0x7a
ntdll!RtlpLogHeapFailure+0x45
ntdll!RtlpHpLfhSubsegmentFreeBlock+0x80735
ntdll!RtlpFreeHeapInternal+0x3d6
ntdll!RtlpHpFreeWithExceptionProtection+0x1e
ntdll!RtlFreeHeap+0x6d
ucrtbase!_free_base+0x1b
Microsoft_Graphics_Canvas!ABI::Microsoft::Graphics::Canvas::UI::Xaml::CanvasImageSource::`vector deleting destructor'+0x26
Microsoft_Graphics_Canvas!Microsoft::WRL::Details::RuntimeClassImpl<Microsoft::WRL::RuntimeClassFlags<1>,1,1,0,ABI::Microsoft::Graphics::Canvas::UI::Xaml::ICanvasImageSource,Microsoft::WRL::FtmBase,ABI::Microsoft::Graphics::Canvas::ICanvasResourceCreator,ABI::Microsoft::Graphics::Canvas::ICanvasResourceCreatorWithDpi,Microsoft::WRL::ComposableBase<IInspectable> >::Release+0x41
Microsoft_ui_xaml!DirectUI::DependencyObject::OnParentUpdated+0xe3
Microsoft_ui_xaml!CMultiParentShareableDependencyObject::RemoveParent+0x1b8
Microsoft_ui_xaml!CDependencyObject::ResetReferenceFromChild+0xba
Microsoft_ui_xaml!CDependencyObject::ResetReferencesFromChildren+0x12e
Microsoft_ui_xaml!CDependencyObject::Release+0x68
Microsoft_ui_xaml!CShape::~CShape+0x41
Microsoft_ui_xaml!CRectangle::`vector deleting destructor'+0x14
Microsoft_ui_xaml!CDependencyObject::Release+0x9e
Microsoft_ui_xaml!CMediaBase::~CMediaBase+0x5c
Microsoft_ui_xaml!CImage::`vector deleting destructor'+0x14
Microsoft_ui_xaml!CDependencyObject::Release+0x9e
Microsoft_ui_xaml!CDOCollection::Neat+0x22e
Microsoft_ui_xaml!CCollection::Destroy+0x18
Microsoft_ui_xaml!CCollection::Clear+0x1d
Microsoft_ui_xaml!CUIElementCollection::RemoveAllElements+0x65
Microsoft_ui_xaml!CUIElement::~CUIElement+0x2cb
Microsoft_ui_xaml!CFrameworkElement::~CFrameworkElement+0xce
Microsoft_ui_xaml!CCommandingContainer::`vector deleting destructor'+0x14
Microsoft_ui_xaml!CDependencyObject::Release+0x9e
Microsoft_ui_xaml!CDOCollection::Neat+0x22e
Microsoft_ui_xaml!CCollection::Destroy+0x18
Microsoft_ui_xaml!CCollection::Clear+0x1d
Microsoft_ui_xaml!CUIElementCollection::RemoveAllElements+0x65
Microsoft_ui_xaml!CUIElement::~CUIElement+0x2cb
Microsoft_ui_xaml!CFrameworkElement::~CFrameworkElement+0xce
Microsoft_ui_xaml!CAppBarButton::`vector deleting destructor'+0x1e
Microsoft_ui_xaml!CDependencyObject::Release+0x9e
Microsoft_ui_xaml!DirectUI::DependencyObject::DisconnectFrameworkPeerCore+0x9d
Microsoft_ui_xaml!DirectUI::DependencyObject::OnFinalRelease+0x1fd
Microsoft_ui_xaml!ctl::ComBase::ReleaseImpl+0x72
Microsoft_ui_xaml!DirectUI::UIAffinityReleaseQueue::DoCleanup+0xfc
Microsoft_ui_xaml!DirectUI::UIAffinityReleaseQueue::BuildTree+0x1e
Microsoft_ui_xaml!DirectUI::BuildTreeService::BuildTrees+0x16c
Microsoft_ui_xaml!AgCoreCallbacks::FrameworkCallbacks_PhasedWorkDistributor_PerformWork+0x67
Microsoft_ui_xaml!CCoreServices::NWDrawTree+0x4cc
Microsoft_ui_xaml!CCoreServices::NWDrawMainTree+0x14a
Microsoft_ui_xaml!CWindowRenderTarget::Draw+0x6d
Microsoft_ui_xaml!CXcpBrowserHost::OnTick+0x59
Microsoft_ui_xaml!CXcpDispatcher::Tick+0x8a
Microsoft_ui_xaml!CXcpDispatcher::OnReentrancyProtectedWindowMessage+0x223
Microsoft_ui_xaml!CXcpDispatcher::WindowProc+0xa2
Microsoft_ui_xaml!CDeferredInvoke::DispatchQueuedMessage+0xd5
Microsoft_ui_xaml!Microsoft::WRL::Details::DelegateArgTraits<long (__cdecl ABI::Windows::Foundation::ITypedEventHandler_impl<ABI::Windows::Foundation::Internal::AggregateType<ABI::Microsoft::UI::Dispatching::DispatcherQueueTimer *,ABI::Microsoft::UI::Dispatching::IDispatcherQueueTimer *>,IInspectable *>::*)(ABI::Microsoft::UI::Dispatching::IDispatcherQueueTimer *,IInspectable *)>::DelegateInvokeHelper<Microsoft::WRL::Implements<Microsoft::WRL::RuntimeClassFlags<2>,ABI::Windows::Foundation::ITypedEventHandler<ABI::Microsoft::UI::Dispatching::DispatcherQueueTimer *,IInspectable *>,Microsoft::WRL::FtmBase>,`CXcpDispatcher::Init'::`55'::<lambda_1> &,1,ABI::Microsoft::UI::Dispatching::IDispatcherQueueTimer *,IInspectable *>::Invoke+0x79
CoreMessagingXP!Microsoft::WRL::Details::DelegateArgTraits<long (__cdecl Windows::Foundation::ITypedEventHandler_impl<Windows::Foundation::Internal::AggregateType<Microsoft::UI::Dispatching::DispatcherQueueTimer * __ptr64,Microsoft::UI::Dispatching::IDispatcherQueueTimer * __ptr64>,IInspectable * __ptr64>::*)(Microsoft::UI::Dispatching::IDispatcherQueueTimer * __ptr64,IInspectable * __ptr64) __ptr64>::DelegateInvokeHelper<Microsoft::WRL::Implements<Microsoft::WRL::RuntimeClassFlags<2>,Windows::Foundation::ITypedEventHandler<Microsoft::UI::Dispatching::DispatcherQueueTimer * __ptr64,IInspectable * __ptr64>,Microsoft::WRL::FtmBase>,<lambda_82cf8073f4f042d1a68771c460cb9f49>,-1,Microsoft::UI::Dispatching::IDispatcherQueueTimer * __ptr64,IInspectable * __ptr64>::Invoke+0xa8
CoreMessagingXP!Microsoft::WRL::InvokeTraits<-2>::InvokeDelegates<<lambda_1e854da9c9ccd42f6138c3b007a32877>,Windows::Foundation::ITypedEventHandler<Microsoft::UI::Dispatching::DispatcherQueueTimer * __ptr64,IInspectable * __ptr64> >+0x8eCoreMessagingXP!Microsoft::UI::Dispatching::DispatcherQueueTimer::TimerCallback+0xdb
CoreMessagingXP!CFlat::SehSafe::Execute<<lambda_654db17c35df07198786f0867aa10de6> >+0x2cCoreMessagingXP!Microsoft::CoreUI::Dispatch::TimeoutHandler::ImportAdapter$+0x5b
Obviously it doesn't contain any of our code so that's why i wasn't able to determine the exact call that causes the exception and/or needs to be wrapped with a try-catch. Also tried to interpret what happens there and had the idea that WinUI is in some kind of clean up process due to those Clear, Destroy, Neat, Release-calls which end up in a CanvasImageSource that finally causes or detects the corruption. At that point we are kind of stuck. Probably someone that has access to the source code might have a look on that section and provide some ideas on how to track down and fix that issue.
Thank you all very much!