DataGridView and its elements accessible objects are leaking in memory

[MelonWang1]

.NET version

.NET 9.0.100-alpha.1.23606.1 + private dlls(build from main branch of WinForms repo)

Did it work in .NET Framework?

Not tested/verified

Did it work in any of the earlier releases of .NET Core or .NET 5+?

Yes, this issue cannot repro in .NET 9.0.100-alpha.1.23606.1, it may be caused by PR: 10407.

Issue description

The original issue is 7347.
DataGridView and its elements accessible objects are left in memory after the DataGridView control instance with its rows was inspected with accessibility tool (like Accessibility Insights/Inspect/Narrtor) and the form with DataGridView is closed, garbage is collected, but accessibility tool is still opened.

Report from WinDbg:

Steps to reproduce

Tested sample application:
DataGridView Sample.zip

1.Create a parent form with two buttons: one will be opening a child form with the DataGridView control and the other will collect the garbage.
2. Start project without debugging(Ctrl+F5).
3. Attaching project to WinDbg and adding symbols folder.
4. Start the Accessibility Insights tool.
5. Press the second button to open the child form with DatGridView.
6. Automatic checks for the DataGridView control using Accessibility Insight.
7. Close the child form.
8. Clear memory with the first button of the parent form.
9. Don't close the Accessibility Insights tool.
10. Look for DataGridView accessible objects left in memory (using WinDbg).

[Tanya-Solyanik]

@MelonWang1 - thank you for incorporating the leak detection tests in your regular testing!

[Tanya-Solyanik]

I see DGV column arrays rooted to an array before and after PR #10407, but these are expected

> dumpheap -type DataGridViewColumn[]
         Address               MT     Size
0000019280313ba0 00007ffd889b0bf8       24

Statistics:
              MT    Count    TotalSize Class Name
00007ffd889b0bf8        1           24 System.Windows.Forms.DataGridViewColumn[]
Total 1 objects
> gcroot 0000019280313ba0
HandleTable:
    00000192BACB13E8 (strong handle)
    -> 00000192BB000028 System.Object[]
    -> 0000019280313BA0 System.Windows.Forms.DataGridViewColumn[]

Found 1 unique roots (run '!gcroot -all' to see all roots).

[Tanya-Solyanik]

Though I see crashes on application shutdowns related to UIA providers that were not disposed after their objects were -

KernelBase.dll!RaiseException() + 108 bytes	Unknown
ucrtbase.dll!_CxxThrowException() + 154 bytes	Unknown
UIAutomationCore.dll!wil::details::ThrowResultExceptionInternal(const wil::FailureInfo & failure) Line 3056	C++
UIAutomationCore.dll!wil::ThrowResultException(const wil::FailureInfo & failure) Line 2712	C++
UIAutomationCore.dll!wil::details::ReportFailure_NoReturn<0>(void * callerReturnAddress, unsigned int lineNumber, const char * fileName, const char * returnAddress=0x00007ffe2acb5a3c, const char * resultPair={...}, void * message=0x0000000000000000, const wil::details::ResultStatus &) Line 3713	C++
UIAutomationCore.dll!wil::details::ReportFailure_Base<0,0>(void * callerReturnAddress, unsigned int lineNumber, const char * fileName, const char * returnAddress=0x00007ffe2acb5a3c, const char * resultPair={...}, void * message=0x0000000000000000, const wil::details::ResultStatus & functionName, const wchar_t * code, wil::details::ReportFailureOptions options) Line 3727	C++
UIAutomationCore.dll!wil::details::ReportFailure_Hr<0>(void * callerReturnAddress, unsigned int lineNumber, const char * fileName, const char * returnAddress=0x00007ffe2acb5a3c, const char * hr=0x80040201, void * functionName, HRESULT code) Line 3888	C++
UIAutomationCore.dll!wil::details::in1diag3::_Throw_Hr(void * callerReturnAddress, unsigned int lineNumber, const char * fileName, HRESULT hr) Line 5627	C++
UIAutomationCore.dll!`anonymous namespace'::ProcessIncomingRequestNoThrow(const UIAutomationCoreProto::UiaCoreRequestMsg & request={...}, UIAutomationCoreProto::UiaCoreResponseMsg & response={...}, IServerConnection * connection=0x000001c050371150, unsigned int requestId=542, Protocol_MethodId methodId, ReleaseCollection * releaseCollection=0x0000000000000000) Line 2664	C++
[Inline Frame] UIAutomationCore.dll!ProcessIncomingRequest(const UIAutomationCoreProto::UiaCoreRequestMsg &) Line 2772	C++
[Inline Frame] UIAutomationCore.dll!ChannelBasedServerConnection::ProcessOneMessage(const UIAutomationCoreProto::UiaCoreRequestMsg &) Line 830	C++
UIAutomationCore.dll!ChannelBasedServerConnection::OnData(unsigned char * data=0x0000000000000062, int dataLength=37705684) Line 772	C++
UIAutomationCore.dll!ReadWriteChannelInfo::Service(int * pUpdateEvents=0x00000039175ffee0) Line 633	C++
UIAutomationCore.dll!OverlappedIOManager::IoThreadProc() Line 1306	C++
UIAutomationCore.dll!OverlappedIOManager::StaticIoThreadProc(void * lpParameter) Line 1269	C++
kernel32.dll!BaseThreadInitThunk() + 29 bytes	Unknown
ntdll.dll!RtlUserThreadStart() + 40 bytes	Unknown

This happens when opening and closing form with a DGV with 2 columns and 3 rows, clicking within the DGV does not make a difference.

[Tanya-Solyanik]

Row header and Column header accessible objects are the difference between NET8(or main with 10407 reverted) and the tip of the main NET9. These accessible objects are holding their respective rows, columns and cells.

D:\winforms>dotnet-dump analyze dump_20231214_112700.dmp
Loading core dump: dump_20231214_112700.dmp ...
Ready to process analysis commands. Type 'help' to list available commands or 'help [command]' to get detailed help on a command.
Type 'quit' or 'exit' to exit the session.
> dumpheap -type DataGridViewColumnHeaderCellAccessibleObject
         Address               MT     Size
000001da69458600 00007ffd88b43b10       88
000001da69458af8 00007ffd88b43b10       88
000001da6945af88 00007ffd88b43b10       88
000001da6945b408 00007ffd88b43b10       88
000001da6945c7c8 00007ffd88b43b10       88
000001da6945cc48 00007ffd88b43b10       88

Statistics:
              MT    Count    TotalSize Class Name
00007ffd88b43b10        6          528 System.Windows.Forms.DataGridViewColumnHeaderCell+DataGridViewColumnHeaderCellAccessibleObject
Total 6 objects
> gcroot 000001da69458600
HandleTable:
    000001DA66F621B0 (ref counted handle)
    -> 000001DA69458600 System.Windows.Forms.DataGridViewColumnHeaderCell+DataGridViewColumnHeaderCellAccessibleObject

Found 1 unique roots (run '!gcroot -all' to see all roots).