Runtime 100.0.1185.29: Crash of Office application when dialog opens from VSTO Add-in with WebView2 using HostObject

[estet]

Description
Starting with version 100.0.1185.29(Evergreen) Powerpoint VSTO Add-in crashes when open Form with webView2 on it

Application Error:

Faulting application name: POWERPNT.EXE, version: 16.0.15028.20160, time stamp: 0x6243d0da
Faulting module name: EmbeddedBrowserWebView.dll, version: 100.0.1185.29, time stamp: 0x6245ceb8
Exception code: 0x80000003
Fault offset: 0x0007e9f2
Faulting process id: 0x3c20
Faulting application start time: 0x01d848b793399bc9
Faulting application path: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
Faulting module path: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\100.0.1185.29\EBWebView\x86\EmbeddedBrowserWebView.dll
Report Id: 884ca2b5-63dc-42fc-9ef9-6aeee7d62f6b
Faulting package full name: 
Faulting package-relative application ID: 

=========

 	VstoAddIns.dll!VstoAddIns.WebBrowser.OnNavigationCompleted(object sender, Microsoft.Web.WebView2.Core.CoreWebView2NavigationCompletedEventArgs e) Line 70	C#	Symbols loaded.
 	[Native to Managed Transition]		Annotated Frame
 	[Managed to Native Transition]		Annotated Frame
 	System.Windows.Forms.dll!System.Windows.Forms.Application.ThreadContext.LocalModalMessageLoop(System.Windows.Forms.Form form)	Unknown	Non-user code. Skipped loading symbols.
 	System.Windows.Forms.dll!System.Windows.Forms.Application.ThreadContext.RunMessageLoopInner(int reason, System.Windows.Forms.ApplicationContext context)	Unknown	Non-user code. Skipped loading symbols.
 	System.Windows.Forms.dll!System.Windows.Forms.Application.ThreadContext.RunMessageLoop(int reason, System.Windows.Forms.ApplicationContext context)	Unknown	Non-user code. Skipped loading symbols.
 	System.Windows.Forms.dll!System.Windows.Forms.Form.ShowDialog(System.Windows.Forms.IWin32Window owner)	Unknown	Non-user code. Skipped loading symbols.

Version
SDK: 1.0.1150.38/1.0.1054.31
Runtime: 100.0.1185.29
Framework: WinForms
OS: Win10, Office 365 (Version 2203 Build 16.0.15028.20152) 64-bit

Repro Steps

Call Form.ShowDialog with WebView2 Component on it via Host Object (VSTO)
Navigate to a page with several redirects (f.e. authentication provider, tried on MS sharepoint)

Expected behavior: Successfully navigate to a page like in previous version of WebView2.

Actual behavior: After first/second redirect getting several ConnectionAborted in NavigationCompleted event and crash of PowerPoint without any exceptions thrown.

Screenshots

Additional context

AB#38875823

[MysteriousGreenBean]

I have similar issue with Outlook VSTO Add-in.
I didn't crack exact situation yet, but it seems that if webview window is closed soon after running ExecuteScriptAsync, Outlook crashes, restarts itself and below error is logged in Event Viewer:

Faulting application name: outlook.exe, version: 16.0.15028.20160, time stamp: 0x6243da53
Faulting module name: EmbeddedBrowserWebView.dll, version: 101.0.1210.2, time stamp: 0x6246c2d2
Exception code: 0x80000003
Fault offset: 0x000000000009c6d3
Faulting process id: 0x202c
Faulting application start time: 0x01d848ed805ba940
Faulting application path: C:\Program Files\Microsoft Office\root\Office16\outlook.exe
Faulting module path: C:\Program Files (x86)\Microsoft\Edge Dev\Application\101.0.1210.2\EBWebView\x64\EmbeddedBrowserWebView.dll
Report Id: 9cbb47cc-48b9-497a-a917-6753c09cf6e5
Faulting package full name: 
Faulting package-relative application ID: 

[MysteriousGreenBean]

Just to add - it started happening after some recent runtime update. I tested with Fixed version 99.0.1150.55 and the issue was not there.

[avaneerd]

I have similar issue with Outlook VSTO Add-in. I didn't crack exact situation yet, but it seems that if webview window is closed soon after running ExecuteScriptAsync, Outlook crashes, restarts itself and below error is logged in Event Viewer:

We're observing the same behaviour as well, we open a popup for (OAuth2) authentication-flow, this goes through a few redirects and then automatically closes.
In the last step we're getting ConnectionAborted errors and then it retries the authentication-flow, to then hard crash Word/Powerpoint.

[estet]

@champnic, we have issue in production with high impact.
Is there a way to give it a priority(if it's not yet already)?

[champnic]

Hey all - thanks for bringing this to our attention. I've opened this as a P0 bug on our team and we'll dig into this right away. I'll let you know when I know more. Thanks!

[yildirimcagri-msft]

Hi @estet , is this for an existing public add-in or one that's in development? If this is one in development, could upload a VS solution that reproes this crash so I can take a look and otherwise point me to the public add-in I can repro the crash from? Thanks!

[champnic]

We believe this may be caused by changes in the code for handling host object method calls (AddHostObjectToScript). Is anyone seeing this crash without using host objects?

[BlueBasher]

Hi @estet , is this for an existing public add-in or one that's in development? If this is one in development, could upload a VS solution that reproes this crash so I can take a look and otherwise point me to the public add-in I can repro the crash from? Thanks!

Hi @yildirimcagri,
I'm a colleague of @estet. We get the issue in our existing public add-on so its not really possible to share this VS solution. It's part of our SaaS offering and it needs a tenant in our backed as well, which is not that easy to provide unfortunately.

[champnic]

We have the issue root caused and are testing out a fix now. Assuming it resolves the issue, we'll get it checked in and then it should rollout soon, over the next few days (I'll try and get a better timeline).

[champnic]

We're still looking for an Office add-in or other sample app that is reproducing the problem so that we can verify we have actually fixed your problem. Please let me know if you have something you are able to share.

[estet]

@champnic we are preparing a sample

[estet]

@champnic @yildirimcagri Sample is ready here https://github.com/estet/WebView2AddinCrashSample

[StephaneZ]

Following this issue. We are also affected by this issue... Major crash now with all of our customers who received the 100.0 upgrades! No issues with 99.0.

Similar flow to what was described by @MysteriousGreenBean and @avaneerd above. We have an Outlook VSTO Add-in with a popup for OAuth and use HostObject/Scripting ... a few redirects and Outlook crashes.

[StephaneZ]

@champnic - if you are looking for another Outlook add-in to test a fix, our release package is public and could be relatively easy to test.

[estet]

@StephaneZ that sounds very much like what we experience, you can check the sample I added.

[champnic]

Thanks a bunch for the repro @estet! We have the fix checked in and are working on bringing it back to the previous releases (100 and 101). I'm checking with our release team to see if we can fast-track another 100 release.

@StephaneZ If you could share your public repro as well that would be helpful!

[LiangTheDev]

@estet could you look at the "Windows Error Reporting" events after the Application Error event and share the "Hashed bucket" value from those events? That would help the investigation.

[snedabyte]

@champnic Once fix is released what is the best way for customers to get the latest version. Thanks for getting this out quickly.

[champnic]

@estet We're having trouble getting your repro to crash in the way described in this thread. When we click the "crash me" button there's an expected debugbreak for re-entrancy, but that only fires when we have the debugger attached, and is related to the fact that it is calling "ShowDialog" from within a WebView2 call.

@StephaneZ Just checking again to see if you can share the public repro you mentioned?

@avaneerd / @MysteriousGreenBean - Do you have a way for us to reproduce the issue?

We have checked in what we think is a fix (and at least fixes #2333) but we haven't been able to verify it for this issue yet. The fix should be available in tomorrow's Canary build and so you'll all be able to try it on your own machines and setups. Thanks!

[avaneerd]

@champnic I work with @estet so the repo he provided is the one.

For this issue I have observed different behaviors:

• 70% immediate crash
• 25% Few reloads/hanging, then crash
• 5% works

Could this be a race condition?

[estet]

@LiangTheDev I only have this:

Fault bucket , type 0
Event Name: APPCRASH
Response: Not available
Cab Id: 0

Problem signature:
P1: powerpnt.exe
P2: 16.0.15028.20160
P3: 6243d3c4
P4: EmbeddedBrowserWebView.dll
P5: 100.0.1185.29
P6: 6245ceb8
P7: c000041d
P8: 000000000026fa7d
P9: 
P10: 

Attached files:

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_powerpnt.exe_3fef1ab9fdfd6ed0f7d117c373ec51b91e4ee3a3_6ac0de0d_76c9e1df-aa27-4a0b-9ee1-9fffc41b3321

Analysis symbol: 
Rechecking for solution: 0
Report Id: 2fd800a4-e741-4f59-ab4f-08ea5ceb2420
Report Status: 4
Hashed bucket: 
Cab Guid: 0

[avaneerd]

@LiangTheDev I find this "Windows Error Reporting" Entry:

Fault bucket 1964249242043040252, type 4
Event Name: APPCRASH
Response: Not available
Cab Id: 0

Problem signature:
P1: WINWORD.EXE
P2: 16.0.15028.20160
P3: 6243d351
P4: EmbeddedBrowserWebView.dll
P5: 100.0.1185.29
P6: 6245ceb8
P7: 80000003
P8: 00000000000905d3
P9: 
P10: 

Attached files:
\\?\C:\Users\ALEXAN~1\AppData\Local\Temp\{1B9F4129-3519-4637-AF8D-8615C8B4813A} - OProcSessId.dat
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERBE60.tmp.dmp
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERC2C6.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERC2E6.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERC2F8.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERC347.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_WINWORD.EXE_5279d8443f56e983ade9c13728d5d94b15f8c_04d95bc6_117a7dd1-c9ca-40c4-bd23-61673631eb32

Analysis symbol: 
Rechecking for solution: 0
Report Id: 506e6c19-71d5-4e10-a9d0-261946dfc9d2
Report Status: 268435456
Hashed bucket: 6e12818460f338fceb426a47524e41fc
Cab Guid: 0

[estet]

@champnic it is easier when VSTO add-in runs in debug (at least for me), also you need to wait a bit longer (up to 30 seconds) also disable all the break points.

[estet]

Also where to get canary webView2 runtime? To verify the fix

[AndyT-MS]

The hashed bucket provided by @avaneerd matches up to the issue that we checked in a fix for yesterday, so the fix should indeed resolve this issue. The fix is included in the latest release of Edge Canary from a few hours ago, version 102.0.1220.0. To test your app against Edge Canary you'll need to have it installed (and updated to at least that version) and then follow these instructions. An easy way to verify which runtime your app is using is to observe the corresponding msedgewebview2.exe processes in the Details tab of Task Manager; turn on the Command Line column and check the exe's path. The fix has also gone into the 101.* (currently in Dev) and 100.* (currently in Stable and Beta) branches but isn't yet included in any releases from them because those releases are slower.

[AndyT-MS]

@estet In your sample there is a WV2 containing JavaScript that calls a .NET host object method, which invokes a modal (synchronous/blocking) dialog box that contains a second WV2. Does your real add-in also invoke a modal WV2 dialog box from inside a host object method called by a different WV2? If so, was that working okay with earlier runtimes (e.g. 99)?

For anyone else experiencing this issue (e.g. @StephaneZ), does your app/add-in do the same thing?

[StephaneZ]

Our team just retested with the Canary release. Initial testing looks good. 👍

Thank you to the whole team for the quick turnaround time.

Any indications on rollout timing? We have thousands of end users that either are or about to be impacted.

[StephaneZ]

Regarding your previous question about having multiple WV2 components sharing a host object... I'll have to confirm.

We have our installer publicly available and can provide test app credentials details in DM.

[champnic]

@StephaneZ Rollout will be around next Thurs for the 100 release. We're currently investigating if we can speed up that process.

If you could email me the installer info for your scenario to champnic@microsoft.com that would be appreciated, thanks!

[nickdekesel]

Hi @champnic, I am a colleague of @estet. I just tested the Demo project he provided with the new canary build and it still crashes the office application. So for us it does not seem to fix the issue.

[drlandau]

@champnic We have the same issue with a plugin from a supplier. They advise to downgrade to 99.0.1150.55.
When you say "next Thursday" (without speeding up - which would be very much appreciated) is that the 14th or 21st?

[nickdekesel]

Hi @champnic, I just tested it with our actual application and there it seems to work. So there probably is some other issue in the demo project we provided. So the fix seems to work!

@AndyT-MS our add-in does indeed invoke a modal WV2 dialog box from inside a host object method called by a different WV2 and this was working fine before.

[champnic]

@nickdekesel Glad to hear the fix is working!

@drlandau This Thursday, 4/14.

[NataliaKravcheniaTR]

@champnic Is this fix available in 101.0.1210.53?

[champnic]

@NataliaKravcheniaTR Yes, that version should have the fix.