Crash occurs when building RichTextBox instances in the NetCore 3.1 environment on Windows 11

[gaojun-lin]

Description

I am developing a project that requires creating a Richtextbox in the DataGridCell control. When I run the following code on Windows 10, everything works fine, but when I switch to Windows 11, a crash occurs

Reproduction Steps

`

protected override FrameworkElement GenerateEditingElement(DataGridCell cell, object dataItem) { RichtextBox cb = new RichtextBox(cell) { HorizontalAlignment = HorizontalAlignment.Stretch, HorizontalContentAlignment = HorizontalAlignment.Stretch, VerticalAlignment = VerticalAlignment.Stretch }; var bb = this.Binding as Binding;

        var row = (cell.DataContext as DataRowView).Row.ItemArray[1].ToString();
        //if (string.IsNullOrEmpty(row))
        //{
        //    return null;
        //}
        string col = cell.Column.Header.ToString();
        string value = (cell.DataContext as DataRowView).Row[col].ToString();
        Run r = new(value);
        (cb.Document.Blocks.FirstBlock as Paragraph).Inlines.Add(r);
        Run rr = new Run("", cb.Document.ContentEnd);

        cb.CaretPosition = cb.Document.ContentStart;
        Binding rowbackground = new Binding("Background");
        rowbackground.RelativeSource = new RelativeSource(RelativeSourceMode.FindAncestor, typeof(DataGridRow), 1);
        cb.SetBinding(RichTextBox.BackgroundProperty, rowbackground);
        cb.SetValue(RichTextBox.ForegroundProperty, Application.Current.FindResource("DataGridCellBackground"));
        cb.TextChanged += Cb_TextChanged;
        cb.Dispatcher.BeginInvoke(new Action(() =>
        {
            cb.Focus();
        }));
        return cb;
    }

`

Expected behavior

supports modification with cursor movement, and so on.

Actual behavior

Regression?

No response

Known Workarounds

No response

Impact

No response

Configuration

No response

Other information

No response

[gaojun-lin]

Sometimes it shows the problem that it can't be cast, and sometimes it shows the problem that the start of the textpointer is greater than the end

[gaojun-lin]

Im chinese. And I've found that Microsoft Pinyin also has such a problem when typing in richtextbox, but not with an American keyboard

[gaojun-lin]

WpfApp1.zip this code contains the bug If you comment it out, the data can be displayed, but it crashes when you enter in the middle of the text using Microsoft Pinyin, but the American keyboard does not

[lindexi]

Reference https://github.com/dotnet/wpf/issues/6463#issuecomment-1110383908 but not the same issues.

And reference https://github.com/dotnet/wpf/issues/3630

[gaojun-lin]

参考 #6463（注释），但不是相同的问题。

他的环境是win10，我在win10上是正常的，win11上崩溃，我可以参考一下，谢谢

[gaojun-lin]

Reference #6463 (comment) but not the same issues.

And reference #3630

大佬可以运行下我发的程序吗？代码很简单的，我比较疑惑的是为什么会崩溃在两个地方？而且崩溃的地方提示flowdocument不是继承自framework，是不是微软拼音输入法在windows11下对richtextbox不兼容啊

[lindexi]

@gaojun-lin Sorry, and I run your code but I can not repeat your issues. Am I doing something wrong?

我运行你的代码，但是不能复现问题，是不是我的操作哪里错了？我用的是 win11 的输入法，下面动图是我的录屏

[gaojun-lin]

@gaojun-lin Sorry, and I run your code but I can not repeat your issues. Am I doing something wrong?

我运行你的代码，但是不能复现问题，是不是我的操作哪里错了？我用的是 win11 的输入法，下面动图是我的录屏

这个是我本地的情况，我想问一下这个会和系统语言有关吗，我默认是英文的，另外这个是我IME设置 另外，我发现您注释了一行，如果把注释去掉，会崩溃吗 我注释那行后，可以显示，但是输入时会崩溃，如下图 抱歉忘记补充，我录屏的时候是使用QQ拼音，我后来用搜狗和微软拼音都出现一样的问题，也崩溃在同一个地方

[gaojun-lin]

@gaojun-lin Sorry, and I run your code but I can not repeat your issues. Am I doing something wrong?

我运行你的代码，但是不能复现问题，是不是我的操作哪里错了？我用的是 win11 的输入法，下面动图是我的录屏

我的天，我好像发现原因了，我换新系统后，把这个打开了 我关掉后就不会崩了，您可以试试把这个打开试试会不会崩溃

[lindexi]

@gaojun-lin Thank you and I can repeat your issues. It is the UIAutomation issues not the IME issues.

>   PresentationFramework.dll!MS.Internal.Automation.TextRangeAdaptor.TextRangeAdaptor(MS.Internal.Automation.TextAdaptor textAdaptor = {MS.Internal.Automation.TextAdaptor}, System.Windows.Documents.ITextPointer start = {System.Windows.Documents.TextPointer}, System.Windows.Documents.ITextPointer end = {System.Windows.Documents.TextPointer}, System.Windows.Automation.Peers.AutomationPeer textPeer = {System.Windows.Automation.Peers.RichTextBoxAutomationPeer}) line 466 C#
    PresentationFramework.dll!MS.Internal.Automation.TextRangeAdaptor.System.Windows.Automation.Provider.ITextRangeProvider.Clone() line 1581   C#
    PresentationCore.dll!MS.Internal.Automation.TextRangeProviderWrapper.Clone(object unused) line 230  C#
    PresentationCore.dll!MS.Internal.Automation.ElementUtil.Invoke.AnonymousMethod__0(object unused) line 211   C#
    WindowsBase.dll!System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate callback, object args, int numArgs)
    WindowsBase.dll!System.Windows.Threading.ExceptionWrapper.TryCatchWhen(object source = {System.Windows.Threading.Dispatcher}, System.Delegate callback, object args, int numArgs, System.Delegate catchHandler = null)
    WindowsBase.dll!System.Windows.Threading.DispatcherOperation.InvokeImpl()
    WindowsBase.dll!MS.Internal.CulturePreservingExecutionContext.CallbackWrapper(object obj)
    System.Private.CoreLib.dll!System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext executionContext, System.Threading.ContextCallback callback, object state)
    WindowsBase.dll!MS.Internal.CulturePreservingExecutionContext.Run(MS.Internal.CulturePreservingExecutionContext executionContext = {MS.Internal.CulturePreservingExecutionContext}, System.Threading.ContextCallback callback, object state)
    WindowsBase.dll!System.Windows.Threading.DispatcherOperation.Invoke()
    WindowsBase.dll!System.Windows.Threading.Dispatcher.ProcessQueue()
    WindowsBase.dll!System.Windows.Threading.Dispatcher.WndProcHook(nint hwnd, int msg, nint wParam, nint lParam, ref bool handled)
    WindowsBase.dll!MS.Win32.HwndWrapper.WndProc(nint hwnd = 0x0000000004ab1638, int msg, nint wParam = 0x0000000000000000, nint lParam = 0x0000000000000000, ref bool handled = false)
    WindowsBase.dll!MS.Win32.HwndSubclass.DispatcherCallbackOperation(object o)
    WindowsBase.dll!System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate callback, object args, int numArgs)
    WindowsBase.dll!System.Windows.Threading.ExceptionWrapper.TryCatchWhen(object source = {System.Windows.Threading.Dispatcher}, System.Delegate callback, object args, int numArgs, System.Delegate catchHandler = null)
    WindowsBase.dll!System.Windows.Threading.Dispatcher.LegacyInvokeImpl(System.Windows.Threading.DispatcherPriority priority, System.TimeSpan timeout, System.Delegate method, object args, int numArgs)
    WindowsBase.dll!MS.Win32.HwndSubclass.SubclassWndProc(nint hwnd = 0x0000000004ab1638, int msg, nint wParam = 0x0000000000000000, nint lParam = 0x0000000000000000)
    WindowsBase.dll!System.Windows.Threading.Dispatcher.PushFrameImpl(System.Windows.Threading.DispatcherFrame frame = {System.Windows.Threading.DispatcherFrame})
    PresentationFramework.dll!System.Windows.Application.RunDispatcher(object ignore) line 2407 C#
    PresentationFramework.dll!System.Windows.Application.RunInternal(System.Windows.Window window) line 1695    C#
    WpfApp1.dll!WpfApp1.App.Main()

[gaojun-lin]

谢谢你，我可以重复你的问题。这是 UIAutomation 问题。

> PresentationFramework.dll!MS.Internal.Automation.TextRangeAdaptor.TextRangeAdaptor(MS.Internal.Automation.TextAdaptor textAdaptor = {MS.Internal.Automation.TextAdaptor}, System.Windows.Documents.ITextPointer start = {System.Windows.Documents.TextPointer}, System.Windows.Documents.ITextPointer end = {System.Windows.Documents.TextPointer}, System.Windows.Automation.Peers.AutomationPeer textPeer = {System.Windows.Automation.Peers.RichTextBoxAutomationPeer}) line 466 C#
  PresentationFramework.dll!MS.Internal.Automation.TextRangeAdaptor.System.Windows.Automation.Provider.ITextRangeProvider.Clone() line 1581   C#
  PresentationCore.dll!MS.Internal.Automation.TextRangeProviderWrapper.Clone(object unused) line 230  C#
  PresentationCore.dll!MS.Internal.Automation.ElementUtil.Invoke.AnonymousMethod__0(object unused) line 211   C#
  WindowsBase.dll!System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate callback, object args, int numArgs)
  WindowsBase.dll!System.Windows.Threading.ExceptionWrapper.TryCatchWhen(object source = {System.Windows.Threading.Dispatcher}, System.Delegate callback, object args, int numArgs, System.Delegate catchHandler = null)
  WindowsBase.dll!System.Windows.Threading.DispatcherOperation.InvokeImpl()
  WindowsBase.dll!MS.Internal.CulturePreservingExecutionContext.CallbackWrapper(object obj)
  System.Private.CoreLib.dll!System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext executionContext, System.Threading.ContextCallback callback, object state)
  WindowsBase.dll!MS.Internal.CulturePreservingExecutionContext.Run(MS.Internal.CulturePreservingExecutionContext executionContext = {MS.Internal.CulturePreservingExecutionContext}, System.Threading.ContextCallback callback, object state)
  WindowsBase.dll!System.Windows.Threading.DispatcherOperation.Invoke()
  WindowsBase.dll!System.Windows.Threading.Dispatcher.ProcessQueue()
  WindowsBase.dll!System.Windows.Threading.Dispatcher.WndProcHook(nint hwnd, int msg, nint wParam, nint lParam, ref bool handled)
  WindowsBase.dll!MS.Win32.HwndWrapper.WndProc(nint hwnd = 0x0000000004ab1638, int msg, nint wParam = 0x0000000000000000, nint lParam = 0x0000000000000000, ref bool handled = false)
  WindowsBase.dll!MS.Win32.HwndSubclass.DispatcherCallbackOperation(object o)
  WindowsBase.dll!System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate callback, object args, int numArgs)
  WindowsBase.dll!System.Windows.Threading.ExceptionWrapper.TryCatchWhen(object source = {System.Windows.Threading.Dispatcher}, System.Delegate callback, object args, int numArgs, System.Delegate catchHandler = null)
  WindowsBase.dll!System.Windows.Threading.Dispatcher.LegacyInvokeImpl(System.Windows.Threading.DispatcherPriority priority, System.TimeSpan timeout, System.Delegate method, object args, int numArgs)
  WindowsBase.dll!MS.Win32.HwndSubclass.SubclassWndProc(nint hwnd = 0x0000000004ab1638, int msg, nint wParam = 0x0000000000000000, nint lParam = 0x0000000000000000)
  [本机到托管的转换]  
  [托管到本机的转换]  
  WindowsBase.dll!System.Windows.Threading.Dispatcher.PushFrameImpl(System.Windows.Threading.DispatcherFrame frame = {System.Windows.Threading.DispatcherFrame})
  PresentationFramework.dll!System.Windows.Application.RunDispatcher(object ignore) line 2407 C#
  PresentationFramework.dll!System.Windows.Application.RunInternal(System.Windows.Window window) line 1695    C#
  WpfApp1.dll!WpfApp1.App.Main()

是的，和我崩溃时的堆栈一样，另外我测试了Win10环境也有一样的问题，看来是一个老bug了

[lindexi]

The main issues is break in TextRangeAdaptor clone. And the argument will assert fail, because start is greater than end, see

https://github.com/dotnet/wpf/blob/1b673503bc443f8272c50c4c14493fadb08a376f/src/Microsoft.DotNet.Wpf/src/PresentationFramework/System/Windows/Controls/TextRangeAdaptor.cs#L464

[gaojun-lin]

主要问题是 TextRangeAdaptor 克隆中的中断。并且该参数将失败，因为 大于 ，请参阅start``end

https://github.com/dotnet/wpf/blob/1b673503bc443f8272c50c4c14493fadb08a376f/src/Microsoft.DotNet.Wpf/src/PresentationFramework/System/Windows/Controls/TextRangeAdaptor.cs#L464

是的，应该是鼠标光标个性化设置后引入的bug