heap corruption windows 10

Question

In our Windows 10 UWP app we are suffering from Heap corruption during random page navigations. The timing and location is always different yet the same result is there, Heap corruption when Native debugging is turned on and an immediate crash when it's turned off.

Below is the callstack at the time of the heap corruption with as much info as we've been able to gather from Visual Studio.

ntdll.dll!_RtlReportCriticalFailure@8()
ntdll.dll!_RtlpHeapHandleError@4()
ntdll.dll!_RtlpLogHeapFailure@24()
ntdll.dll!RtlSizeHeap()
Windows.UI.Xaml.dll!XcpAllocation::OSMemoryFree(void * pAddress=0x0b4164f0)
Windows.UI.Xaml.dll!ctl::SupportErrorInfo::`scalar deleting destructor'(unsigned int)
Windows.UI.Xaml.dll!ctl::ComBase::OnFinalRelease()
Windows.UI.Xaml.dll!ctl::ComBase::ReleaseImpl()
Windows.UI.Xaml.dll!DirectUI::UIAffinityReleaseQueue::DoCleanup(unsigned char bSync='\0', unsigned char * pbCompleted=0x058ff5af)
Windows.UI.Xaml.dll!DirectUI::UIAffinityReleaseQueue::BuildTree(unsigned char * returnValue=0x058ff5f2)
Windows.UI.Xaml.dll!DirectUI::BuildTreeService::BuildTrees(bool * pWorkLeft=0x058ff62b)
Windows.UI.Xaml.dll!AgCoreCallbacks::FrameworkCallbacks_PhasedWorkDistributor_PerformWork(unsigned int * pWorkleft=0x058ff6a4)
Windows.UI.Xaml.dll!CCoreServices::NWDrawTree(HWWalk * pHWWalk=0x0082cab8, ICoreRenderTarget * pIRenderTarget=0x008fb444, VisualTree * pVisualTree=0x00886668, unsigned int forceRedraw=0, XRECT_WH * prcDirtyRect=0x058ff7f8)
Windows.UI.Xaml.dll!CCoreServices::NWDrawMainTree(ICoreRenderTarget * pIRenderTarget=0x008fb444, bool fForceRedraw=false, XRECT_WH * prcDirtyRect=0x058ff7f8)
Windows.UI.Xaml.dll!CWindowRenderTarget::Draw(CCoreServices * pCore=0x008f2ea0, unsigned int fForceRedraw=0, XRECT_WH * prcDirtyRect=0x058ff7f8)
Windows.UI.Xaml.dll!CXcpBrowserHost::OnTick()
Windows.UI.Xaml.dll!CXcpDispatcher::Tick()
Windows.UI.Xaml.dll!CXcpDispatcher::OnReentrancyProtectedWindowMessage(HWND__ * msg=1026, unsigned int lParam=0, unsigned int hr=0x058ff41c, long reentrancyGuard)
Windows.UI.Xaml.dll!CXcpDispatcher::WindowProc(HWND__ * hwnd=0x001906aa, unsigned int msg=1026, unsigned int wParam=0, long lParam=0)
user32.dll!__InternalCallWinProc@20()
user32.dll!UserCallWinProcCheckWow()
user32.dll!DispatchMessageWorker()
user32.dll!_DispatchMessageW@4()
Windows.UI.dll!Windows::UI::Core::CDispatcher::ProcessMessage(int bDrainQueue=1, int * pbAnyMessages=0x00000000)
Windows.UI.dll!Windows::UI::Core::CDispatcher::WaitAndProcessMessages(void * hEventWait=0x00000000)
Windows.UI.dll!Windows::UI::Core::CDispatcher::ProcessEvents(Windows::UI::Core::CoreProcessEventsOption options=CoreProcessEventsOption_ProcessUntilQuit)
Windows.UI.Xaml.dll!CJupiterWindow::RunCoreWindowMessageLoop()
Windows.UI.Xaml.dll!CJupiterControl::RunMessageLoop()
Windows.UI.Xaml.dll!DirectUI::DXamlCore::RunMessageLoop()
Windows.UI.Xaml.dll!DirectUI::FrameworkView::Run()
twinapi.appcore.dll!Windows::ApplicationModel::Core::CoreApplicationView::Run(void)
twinapi.appcore.dll!Microsoft::WRL::Details::Make<struct Microsoft::WRL::Details::InvokeHelper<struct Windows::Foundation::IAsyncActionCompletedHandler,class <lambda_e4b1934750ab38adfb74f12296e81f29>,2>,class <lambda_e4b1934750ab38adfb74f12296e81f29> &>(class <lambda_e4b1934750ab38adfb74f12296e81f29> &)
SHCore.dll!CallerIdentity::GetCallingProcessHandle(unsigned long,enum RUNTIMEBROKER_CALLERIDENTITY_CHECK,void * *)
kernel32.dll!@BaseThreadInitThunk@12()
ntdll.dll!__RtlUserThreadStart()
ntdll.dll!__RtlUserThreadStart@8()

Any chance anyone has encountered this exact, or close to issue and managed to resolve it? Thanks in advance.

EDIT! Got some new info! sadly no fix yet but progress... :)

Turns out the issue is caused by the VisualStateGroups used to create an adaptive interface seen below:

<Style TargetType="controls:CollectionView">
    <Setter Property="RelativePanel.AlignLeftWithPanel" Value="True"/>
    <Setter Property="RelativePanel.AlignRightWithPanel" Value="True"/>
    <Setter Property="Template">
        <Setter.Value>
            <ControlTemplate TargetType="controls:CollectionView">
                <Grid>
                    <Grid.RowDefinitions>
                        <RowDefinition Height="Auto"/>
                        <RowDefinition Height="*"/>
                    </Grid.RowDefinitions>

                    <GridView x:Name="List" 
                              Grid.Row="1" 
                              BorderBrush="Black" 
                              ItemsSource="{TemplateBinding ItemsSource}"
                              ItemTemplate="{TemplateBinding ItemTemplate}"
                              SelectedItem="{Binding RelativeSource={RelativeSource TemplatedParent}, Path=SelectedItem, Mode=TwoWay}"
                              ShowsScrollingPlaceholders="False"
                              Background="Transparent"
                              RelativePanel.AlignLeftWithPanel="True"
                              RelativePanel.AlignRightWithPanel="True">
                    </GridView>

                    <VisualStateManager.VisualStateGroups>
                        <VisualStateGroup>
                            <VisualState x:Name="UnSelectable">
                                <VisualState.StateTriggers>
                                    **<StateTrigger IsActive="{Binding RelativeSource={RelativeSource TemplatedParent}, Path=IsNotSelectable}"/>**
                                </VisualState.StateTriggers>

                                <VisualState.Setters>
                                    <Setter Target="List.Background" Value="#AAAAAA"/>
                                    <Setter Target="List.IsHitTestVisible" Value="False"/>
                                </VisualState.Setters>
                            </VisualState>
                        </VisualStateGroup>
                    </VisualStateManager.VisualStateGroups>
                </Grid>
            </ControlTemplate>
        </Setter.Value>
    </Setter>
</Style>

if i disable the above statetrigger the app will not crash, sadly i need the logic inside this state... any work arounds possible or an explanation what i am doing wrong?

Answer 1

For your scenario, ItemContainerStyleSelector may solve the problem, or you can use ItemTemplateSelector to design two different Datatemplate for your GridView.

Here is a sample in the answer uses ItemTemplateSelector for ItemsControl.