Crash in finalizer thread after calling `StartDragAsync` on 1.7.X versions

[will-velazquez]

Describe the bug

There's a C++ destructor that needs to run on the main thread for an object called as a result of calling StartDragAsync.

I've made a reproducible example in https://github.com/will-velazquez/StartDragAsyncBug

This repo shows a minimum reproducible crash that happens when StartDragAsync is called, then GC releases some of the temporary objects.
The crash happens in version 1.7.251014001 and 1.7.251107005 of the AppSDK, but not in 1.8.251106002

Why is this important?

Anyone using 1.7.x versions of the AppSDK can't make use of the StartDragAsync API

Steps to reproduce the bug

To replicate:

1. Click on "Drag me" and move the mouse
2. Click on the button to trigger GC

In the output window we get

onecoreuap\windows\moderncore\inputv2\inputhost\components\dragdrop\lib\closeableobject.cpp(86)\Microsoft.UI.Input.dll!00007FFEB433EB7C: (caller: 00007FFEB433CC9B) Exception(1) tid(99dc) 8001010E The application called an interface that was marshalled for a different thread.
    Msg:[API must be called from the owning thread] 
Exception thrown at 0x00007FF80470782A in StartDragAsyncBug.exe: Microsoft C++ exception: wil::ResultException at memory location 0x00000024F1B7CA10.
Unhandled exception at 0x00007FF804D14ACE (ucrtbase.dll) in StartDragAsyncBug.exe: Fatal program exit requested.

Callstack:

 	KernelBase.dll!RaiseException()	Unknown
 	Microsoft.UI.Input.dll!_CxxThrowException()	Unknown
 	Microsoft.UI.Input.dll!wil::details::ThrowResultExceptionInternal(struct wil::FailureInfo const &)	Unknown
 	Microsoft.UI.Input.dll!wil::ThrowResultException(struct wil::FailureInfo const &)	Unknown
 	Microsoft.UI.Input.dll!wil::details::ReportFailure_NoReturn<0>(void *,unsigned int,char const *,char const *,char const *,void *,struct wil::details::ResultStatus const &,unsigned short const *,enum wil::details::ReportFailureOptions)	Unknown
 	Microsoft.UI.Input.dll!wil::details::ReportFailure_Base<0,0>(void *,unsigned int,char const *,char const *,char const *,void *,struct wil::details::ResultStatus const &,unsigned short const *,enum wil::details::ReportFailureOptions)	Unknown
 	Microsoft.UI.Input.dll!wil::details::ReportFailure_Msg<0>(void *,unsigned int,char const *,char const *,char const *,void *,struct wil::details::ResultStatus const &,char const *,char *)	Unknown
 	Microsoft.UI.Input.dll!wil::details::ReportFailure_HrMsg<0>(void *,unsigned int,char const *,char const *,char const *,void *,long,char const *,char *)	Unknown
 	Microsoft.UI.Input.dll!wil::details::in1diag3::Throw_HrMsg(void *,unsigned int,char const *,long,char const *,...)	Unknown
 	Microsoft.UI.Input.dll!CloseableObject::final_release(class std::unique_ptr<class CloseableObject,struct std::default_delete<class CloseableObject> >)	Unknown
 	Microsoft.UI.Input.dll!winrt::implements<struct winrt::Microsoft::UI::Input::DragDrop::implementation::DragDropManager,struct winrt::Microsoft::UI::Input::DragDrop::DragDropManager,struct winrt::Windows::Foundation::IClosable>::Release(void)	Unknown
>	[Inline Frame] Microsoft.ui.xaml.dll!ctl::ComPtr<ABI::Microsoft::UI::Input::DragDrop::IDragOperation>::InternalRelease() Line 258	C++
 	[Inline Frame] Microsoft.ui.xaml.dll!ctl::ComPtr<ABI::Microsoft::UI::Input::DragDrop::IDragOperation>::{dtor}() Line 329	C++
 	Microsoft.ui.xaml.dll!DirectUI::StartDragAsyncOperation::~StartDragAsyncOperation() Line 29	C++
 	Microsoft.ui.xaml.dll!DirectUI::StartDragAsyncOperation::`scalar deleting destructor'(unsigned int)	C++
 	Microsoft.ui.xaml.dll!Microsoft::WRL::Details::RuntimeClassImpl<Microsoft::WRL::RuntimeClassFlags<1>,1,1,0,ABI::Windows::Foundation::IAsyncOperation<enum ABI::Microsoft::UI::Xaml::Controls::ContentDialogResult>,Microsoft::WRL::FtmBase,Microsoft::WRL::AsyncBase<ABI::Windows::Foundation::IAsyncOperationCompletedHandler<enum ABI::Microsoft::UI::Xaml::Controls::ContentDialogResult>,Microsoft::WRL::Details::Nil,1,Microsoft::WRL::AsyncCausalityOptions<&DirectUI::ContentDialogShowAsyncOperationName,&GUID_NULL,0>>,Microsoft::WRL::Details::Nil>::Release() Line 2048	C++
 	[Managed to Native Transition]	
 	System.Private.CoreLib.dll!System.Runtime.InteropServices.Marshal.Release(nint pUnk) Line 155	C#
 	WinRT.Runtime.dll!WinRT.IObjectReference.Release()	Unknown
 	WinRT.Runtime.dll!WinRT.IObjectReference.Dispose()	Unknown
 	WinRT.Runtime.dll!WinRT.IObjectReference.~IObjectReference()	Unknown
 	[Native to Managed Transition]	
 	kernel32.dll!00007ff80567e8d7()	Unknown
 	ntdll.dll!RtlUserThreadStart()	Unknown

Actual behavior

Crash

Expected behavior

No crash

Screenshots

No response

NuGet package version

None

Windows version

No response

Additional context

No response

[ayushjai19]

Hi @will-velazquez , do you see the issue in 1.6.x as well? Also, how many crashes are you seeing? Any reason for not getting upgrade to 1.8.X?

[will-velazquez]

I did not test the issue in 1.6.x, if I do, I'll get back to you with results.

The crash happens every time GC goes to collect after finishing a StartDragAsync operation - it looks like there's a bug in the handling of the underlying temporary objects.

Yes we are updating to 1.8.x in response to this issue in order to support drag & drop, but I wanted to file this issue at the very least for posterity, as I could not find anyone else having reported it and it could save some future person the trouble :)