NullReferenceException in PopupSecurityHelper started appearing yesterday (with .NET Core 3.1.24 update?) for hundreds of users so far

mol commented 2 years ago

.NET Core Version: 3.1.24.
Windows version: ~~10 and 11 so far.~~ 10.0.22598 (Windows 11 Insider Preview).
Does the bug reproduce also in WPF for .NET Framework 4.8?: Unable to reproduce so far. Just seeing hundreds of bug reports coming in from our users.
Is this bug related specifically to tooling in Visual Studio (e.g. XAML Designer, Code editing, etc...)? No.

Problem description: Yesterday, April 13, coinciding with a number of Windows updates rolling out (in particular I think .NET Core 3.1.24 is the culprit) we started seeing crashes of our application, Mailbird, coming in from first a few users, but today hundreds.

Stack traces are entirely in .NET code and we've released no update to Mailbird in several weeks. Looking at the change log for .NET Core 3.1.24 I see two PR's that make changes that "fit" the stack traces: https://github.com/dotnet/wpf/pull/6020 and https://github.com/dotnet/wpf/pull/6017.

Actual behavior: Since it's the Dispatcher, the application crashes. A few of the stack traces we're seeing (all end the same place):

System.NullReferenceException: Object reference not set to an instance of an object.
  Module "System.Windows.Controls.Primitives.Popup+PopupSecurityHelper", in get_Handle
  Module "System.Windows.Controls.Primitives.Popup+PopupSecurityHelper", in RegisterForTooltipDismissNotification
  Module "System.Windows.Controls.PopupControlService", in CloseToolTip
  Module "System.Windows.Controls.PopupControlService", in OnMouseMove
  Module "System.Windows.Controls.PopupControlService", in OnPostProcessInput
  Module "System.Windows.Input.InputManager", in RaiseProcessInputEventHandlers
  Module "System.Windows.Input.InputManager", in ProcessStagingArea
  Module "System.Windows.Input.InputManager", in ProcessInput
  Module "System.Windows.Input.InputProviderSite", in ReportInput
  Module "System.Windows.Interop.HwndMouseInputProvider", in ReportInput
  Module "System.Windows.Interop.HwndMouseInputProvider", in FilterMessage
  Module "System.Windows.Interop.HwndSource", in InputFilterMessage
  Module "MS.Win32.HwndWrapper", in WndProc
  Module "MS.Win32.HwndSubclass", in DispatcherCallbackOperation
  Module "System.Windows.Threading.ExceptionWrapper", in InternalRealCall
  Module "System.Windows.Threading.ExceptionWrapper", in TryCatchWhen

System.NullReferenceException: Object reference not set to an instance of an object.
  Module "System.Windows.Controls.Primitives.Popup+PopupSecurityHelper", in get_Handle
  Module "System.Windows.Controls.Primitives.Popup+PopupSecurityHelper", in RegisterForTooltipDismissNotification
  Module "System.Windows.Controls.PopupControlService", in CloseToolTip
  Module "System.Windows.Controls.PopupControlService", in OnMouseMove
  Module "System.Windows.Controls.PopupControlService", in OnPostProcessInput
  Module "System.Windows.Input.InputManager", in RaiseProcessInputEventHandlers
  Module "System.Windows.Input.InputManager", in ProcessStagingArea
  Module "System.Windows.Input.InputManager", in ProcessInput
  Module "System.Windows.Input.MouseDevice", in Synchronize
  Module "System.Windows.Input.InputManager", in HitTestInvalidatedAsyncCallback
  Module "System.Windows.Threading.ExceptionWrapper", in InternalRealCall
  Module "System.Windows.Threading.ExceptionWrapper", in TryCatchWhen

System.NullReferenceException: La référence d'objet n'est pas définie à une instance d'un objet.
à System.Windows.Controls.Primitives.Popup.PopupSecurityHelper.get_Handle()
à System.Windows.Controls.Primitives.Popup.PopupSecurityHelper.RegisterForTooltipDismissNotification(UInt32 flag)
à System.Windows.Controls.PopupControlService.CloseToolTip(ToolTip tooltip)
à System.Windows.Controls.PopupControlService.OnPostProcessInput(Object sender, ProcessInputEventArgs e)
à System.Windows.Input.InputManager.RaiseProcessInputEventHandlers(ProcessInputEventHandler postProcessInput, ProcessInputEventArgs processInputEventArgs)
à System.Windows.Input.InputManager.ProcessStagingArea()
à System.Windows.Input.InputManager.ProcessInput(InputEventArgs input)
à System.Windows.Input.MouseDevice.Synchronize()
à System.Windows.Input.MouseDevice.ChangeMouseCapture(IInputElement mouseCapture, IMouseInputProvider providerCapture, CaptureMode captureMode, Int32 timestamp)
à System.Windows.Input.MouseDevice.Capture(IInputElement element, CaptureMode captureMode)
à System.Windows.Controls.Primitives.ButtonBase.OnMouseLeftButtonDown(MouseButtonEventArgs e)
à System.Windows.RoutedEventArgs.InvokeHandler(Delegate handler, Object target)
à System.Windows.RoutedEventHandlerInfo.InvokeHandler(Object target, RoutedEventArgs routedEventArgs)
à System.Windows.EventRoute.InvokeHandlersImpl(Object source, RoutedEventArgs args, Boolean reRaised)
à System.Windows.UIElement.ReRaiseEventAs(DependencyObject sender, RoutedEventArgs args, RoutedEvent newEvent)
à System.Windows.UIElement.OnMouseDownThunk(Object sender, MouseButtonEventArgs e)
à System.Windows.RoutedEventArgs.InvokeHandler(Delegate handler, Object target)
à System.Windows.RoutedEventHandlerInfo.InvokeHandler(Object target, RoutedEventArgs routedEventArgs)
à System.Windows.EventRoute.InvokeHandlersImpl(Object source, RoutedEventArgs args, Boolean reRaised)
à System.Windows.UIElement.RaiseEventImpl(DependencyObject sender, RoutedEventArgs args)
à System.Windows.UIElement.RaiseTrustedEvent(RoutedEventArgs args)
à System.Windows.Input.InputManager.ProcessStagingArea()
à System.Windows.Input.InputManager.ProcessInput(InputEventArgs input)
à System.Windows.Input.InputProviderSite.ReportInput(InputReport inputReport)
à System.Windows.Interop.HwndMouseInputProvider.ReportInput(IntPtr hwnd, InputMode mode, Int32 timestamp, RawMouseActions actions, Int32 x, Int32 y, Int32 wheel)
à System.Windows.Interop.HwndMouseInputProvider.FilterMessage(IntPtr hwnd, WindowMessage msg, IntPtr wParam, IntPtr lParam, Boolean& handled)
à System.Windows.Interop.HwndSource.InputFilterMessage(IntPtr hwnd, Int32 msg, IntPtr wParam, IntPtr lParam, Boolean& handled)
à MS.Win32.HwndWrapper.WndProc(IntPtr hwnd, Int32 msg, IntPtr wParam, IntPtr lParam, Boolean& handled)
à MS.Win32.HwndSubclass.DispatcherCallbackOperation(Object o)
à System.Windows.Threading.ExceptionWrapper.InternalRealCall(Delegate callback, Object args, Int32 numArgs)
à System.Windows.Threading.ExceptionWrapper.TryCatchWhen(Object source, Delegate callback, Object args, Int32 numArgs, Delegate catchHandler)

Expected behavior: No System.NullReferenceException should be thrown.

Minimal repro: As of yet we've been unable to reproduce. It seems random in terms of when and where it happens, but looking at the stack traces it seems to happen when tooltips are closed.

cuiliang commented 2 years ago

Same problem here, Windows 11 10.0.22598.0, .Net framework 4.7.2

stacktrace:

NullReferenceException
   在 System.Windows.Controls.Primitives.Popup.PopupSecurityHelper.get_Handle()
   在 System.Windows.Controls.Primitives.Popup.PopupSecurityHelper.RegisterForTooltipDismissNotification(UInt32 flag)
   在 System.Windows.Controls.PopupControlService.CloseToolTip(ToolTip tooltip)
   在 System.Windows.Controls.PopupControlService.OnPostProcessInput(Object sender, ProcessInputEventArgs e)
   在 System.Windows.Input.InputManager.RaiseProcessInputEventHandlers(ProcessInputEventHandler postProcessInput, ProcessInputEventArgs processInputEventArgs)
   在 System.Windows.Input.InputManager.ProcessStagingArea()
   在 System.Windows.Input.InputManager.ProcessInput(InputEventArgs input)
   在 System.Windows.Input.MouseDevice.Synchronize()
   在 System.Windows.Input.MouseDevice.ChangeMouseCapture(IInputElement mouseCapture, IMouseInputProvider providerCapture, CaptureMode captureMode, Int32 timestamp)
   在 System.Windows.Input.MouseDevice.Capture(IInputElement element, CaptureMode captureMode)
   在 System.Windows.Controls.Primitives.ButtonBase.OnMouseLeftButtonDown(MouseButtonEventArgs e)
   在 System.Windows.RoutedEventArgs.InvokeHandler(Delegate handler, Object target)
   在 System.Windows.RoutedEventHandlerInfo.InvokeHandler(Object target, RoutedEventArgs routedEventArgs)
   在 System.Windows.EventRoute.InvokeHandlersImpl(Object source, RoutedEventArgs args, Boolean reRaised)
   在 System.Windows.UIElement.ReRaiseEventAs(DependencyObject sender, RoutedEventArgs args, RoutedEvent newEvent)
   在 System.Windows.UIElement.OnMouseDownThunk(Object sender, MouseButtonEventArgs e)
   在 System.Windows.RoutedEventArgs.InvokeHandler(Delegate handler, Object target)
   在 System.Windows.RoutedEventHandlerInfo.InvokeHandler(Object target, RoutedEventArgs routedEventArgs)
   在 System.Windows.EventRoute.InvokeHandlersImpl(Object source, RoutedEventArgs args, Boolean reRaised)
   在 System.Windows.UIElement.RaiseEventImpl(DependencyObject sender, RoutedEventArgs args)
   在 System.Windows.UIElement.RaiseTrustedEvent(RoutedEventArgs args)
   在 System.Windows.Input.InputManager.ProcessStagingArea()
   在 System.Windows.Input.InputManager.ProcessInput(InputEventArgs input)
   在 System.Windows.Input.InputProviderSite.ReportInput(InputReport inputReport)
   在 System.Windows.Interop.HwndMouseInputProvider.ReportInput(IntPtr hwnd, InputMode mode, Int32 timestamp, RawMouseActions actions, Int32 x, Int32 y, Int32 wheel)
   在 System.Windows.Interop.HwndMouseInputProvider.FilterMessage(IntPtr hwnd, WindowMessage msg, IntPtr wParam, IntPtr lParam, Boolean& handled)
   在 System.Windows.Interop.HwndSource.InputFilterMessage(IntPtr hwnd, Int32 msg, IntPtr wParam, IntPtr lParam, Boolean& handled)
   在 MS.Win32.HwndWrapper.WndProc(IntPtr hwnd, Int32 msg, IntPtr wParam, IntPtr lParam, Boolean& handled)
   在 MS.Win32.HwndSubclass.DispatcherCallbackOperation(Object o)
   在 System.Windows.Threading.ExceptionWrapper.InternalRealCall(Delegate callback, Object args, Int32 numArgs)
   在 System.Windows.Threading.ExceptionWrapper.TryCatchWhen(Object source, Delegate callback, Object args, Int32 numArgs, Delegate catchHandler)

2

NullReferenceException
   在 System.Windows.Controls.Primitives.Popup.PopupSecurityHelper.get_Handle()
   在 System.Windows.Controls.Primitives.Popup.PopupSecurityHelper.RegisterForTooltipDismissNotification(UInt32 flag)
   在 System.Windows.Controls.PopupControlService.CloseToolTip(ToolTip tooltip)
   在 System.Windows.Controls.PopupControlService.PromotePendingToolTipToCurrent(TriggerAction triggerAction)
   在 System.Windows.Threading.DispatcherTimer.FireTick(Object unused)
   在 System.Windows.Threading.ExceptionWrapper.InternalRealCall(Delegate callback, Object args, Int32 numArgs)
   在 System.Windows.Threading.ExceptionWrapper.TryCatchWhen(Object source, Delegate callback, Object args, Int32 numArgs, Delegate catchHandler)

3

NullReferenceException
   在 System.Windows.Controls.Primitives.Popup.PopupSecurityHelper.get_Handle()
   在 System.Windows.Controls.Primitives.Popup.PopupSecurityHelper.RegisterForTooltipDismissNotification(UInt32 flag)
   在 System.Windows.Controls.PopupControlService.CloseToolTip(ToolTip tooltip)
   在 System.Windows.Controls.PopupControlService.OnPostProcessInput(Object sender, ProcessInputEventArgs e)
   在 System.Windows.Input.InputManager.RaiseProcessInputEventHandlers(ProcessInputEventHandler postProcessInput, ProcessInputEventArgs processInputEventArgs)
   在 System.Windows.Input.InputManager.ProcessStagingArea()
   在 System.Windows.Input.InputManager.ProcessInput(InputEventArgs input)
   在 System.Windows.Input.MouseDevice.Synchronize()
   在 System.Windows.Input.MouseDevice.ChangeMouseCapture(IInputElement mouseCapture, IMouseInputProvider providerCapture, CaptureMode captureMode, Int32 timestamp)
   在 System.Windows.Input.MouseDevice.Capture(IInputElement element, CaptureMode captureMode)
   在 System.Windows.Controls.Primitives.Thumb.OnMouseLeftButtonDown(MouseButtonEventArgs e)
   在 System.Windows.RoutedEventArgs.InvokeHandler(Delegate handler, Object target)
   在 System.Windows.RoutedEventHandlerInfo.InvokeHandler(Object target, RoutedEventArgs routedEventArgs)
   在 System.Windows.EventRoute.InvokeHandlersImpl(Object source, RoutedEventArgs args, Boolean reRaised)

ryanmolden commented 2 years ago

Visual Studio is also seeing this crash now, it is the top crash in our 17.2 Preview 3 release.

singhashish-wpf commented 2 years ago

We are checking this as of now. @mol could you please confirm again if you are seeing this on 3.1.24?

SamBent commented 2 years ago

The stack traces all mention the method System.Windows.Controls.Primitives.Popup.PopupSecurityHelper.RegisterForTooltipDismissNotification(UInt32 flag) which doesn't exist in any version of WPF except for .NET 4.8.1. That hasn't been released yet, but it is included in previews of the next release of Windows 11. So I suspect all these reports are really about .NET Framework apps running on a Win11 preview OS that includes the buggy version of ,NET 4.8.1. (Note: apps that target 4.7.2, or any other version of .NET Framework, use the installed version of the runtime, and hence would see this bug on machines with 4.8.1.)

The bug has been fixed in 4.8.1, but it takes some time for the fix to flow into the Win11 preview packages.

mol commented 2 years ago

We are checking this as of now. @mol could you please confirm again if you are seeing this on 3.1.24?

That was just my assumption after looking through the change log, but I haven't verified this with our users.

The stack traces all mention the method System.Windows.Controls.Primitives.Popup.PopupSecurityHelper.RegisterForTooltipDismissNotification(UInt32 flag) which doesn't exist in any version of WPF except for .NET 4.8.1. That hasn't been released yet, but it is included in previews of the next release of Windows 11. So I suspect all these reports are really about .NET Framework apps running on a Win11 preview OS that includes the buggy version of ,NET 4.8.1. (Note: apps that target 4.7.2, or any other version of .NET Framework, use the installed version of the runtime, and hence would see this bug on machines with 4.8.1.) The bug has been fixed in 4.8.1, but it takes some time for the fix to flow into the Win11 preview packages.

Actually @SamBent you're right. I checked all of our error reports and for all users the version of Windows they're running is Windows 10.0.22598, which is the 11 Insider Preview as I understand it. That would also explain why the number of users experiencing this hasn't skyrocketed :D

pchaurasia14 commented 2 years ago

Since this is not an issue in 3.1.24 and the bug has already been fixed in 4.8.1, we're closing this issue. If you experience the issue again, please raise another ticket.

dotnet / wpf

NullReferenceException in PopupSecurityHelper started appearing yesterday (with .NET Core 3.1.24 update?) for hundreds of users so far #6433