Windows.UI.Xaml.dll read access violation: TeachingTip & static data source => **cornerRadius** was nullptr

[jp-weber]

Describe the bug
By binding the TeachingTip (IsOpen) to a static data source, the app crashes after navigation to a page if go back and then open the TeachingTip.

Exception thrown: read access violation.
**cornerRadius** was nullptr.

test app to reproduce:
https://github.com/jp-weber/WinUITeachingTipBug

Model

    public class TestModel : BindableBase
    {
        private string _name;

        public string Name 
        { get => _name; set => SetProperty(ref _name, value); }

        private bool _rightClickOpen;
        public bool RightClickOpen { get => _rightClickOpen; set => SetProperty(ref _rightClickOpen, value); }
    }

Data source

public class DataService
    {
        [ThreadStatic]
        private static DataService _instance;
        public ObservableCollection<TestModel> Collection;

        public static DataService Instance => _instance ?? (_instance = new DataService());

        public DataService()
        {
            Collection = new ObservableCollection<TestModel>();
            Collection.Add(new TestModel() { Name = "TestA" });
            Collection.Add(new TestModel() { Name = "TestB" });
            Collection.Add(new TestModel() { Name = "TestC" });
            Collection.Add(new TestModel() { Name = "TestD" });
            Collection.Add(new TestModel() { Name = "TestE" });
            Collection.Add(new TestModel() { Name = "TestF" });
            Collection.Add(new TestModel() { Name = "TestG" });
        }
    }

View

<UserControl.Resources>
                        <muxc:TeachingTip 
                            x:Name="AccountCopyCodeButtonTip"
                            IsLightDismissEnabled="True"
                            BorderBrush="{ThemeResource SystemAccentColor}"
                            Target="{Binding ElementName=Root}"
                            IsOpen="{x:Bind RightClickOpen, Mode=TwoWay}"
                            Title="Test"
                            Subtitle="test">
                        </muxc:TeachingTip>
                    </UserControl.Resources>

Steps to reproduce the bug

Steps to reproduce the behavior:

1. Right click on an item to call up the TeachingTip
2. Navigate to another page (on the bottom left)
3. Go back
4. Right click on an item to call up the TeachingTip
5. The app crashes

Expected behavior

NuGet package version:
2.3.200213001
2.4.0-prerelease.200322001
2.5.0-prerelease.201027002

Windows 10 version	Saw the problem?
Insider Build (xxxxx)
November 2019 Update (18363)	Yes
May 2019 Update (18362)
October 2018 Update (17763)
April 2018 Update (17134)
Fall Creators Update (16299)
Creators Update (15063)

Device form factor	Saw the problem?
Desktop	Yes
Mobile
Xbox
Surface Hub
IoT

[beervoley]

@jp-weber I've run your code and spent some time debbuging the issue, here's what I found: when the first time you open the page and listview is being populated with entries, for each of those elements a TeachingTip is created. When we leave the page and come back to it, same thing happens: listview is being populated with entries and for each of those elements a TeachingTip is created. But - the old Teaching Tips (the ones that were created the first time we entered the page) - are still there. So, when you right click on an element of the list - both teaching tips are trying to open. And for some reason, the old teaching tip is missing some references and we get the following exception : Unhandled exception thrown: read access violation. **cornerRadius** was nullptr.

CornerRadius is probably just top of the iceberg and many other references the teaching tip relies on are being null.
I'm not quite sure why that happens - there's something about binding ListView to ObservableCollection and also binding members of that Collection to RightClickOpen of the TestModel (circular reference or so:)).

So when we are leaving the page - listview doesn't release the items its binded to, teaching tips are still binded and they don't get garbage collected.

The workaround is to remove ItemsSource for list view when you leave the page like this:

And have the ListView bind to a variable using x:Name:

By doing so, all the old teaching tips are getting destroyed and they're not linked to the ListView anymore :)

[jp-weber]

Thank you for investigating the error. In a more complex construction with an adapted navigation, this unfortunately does not work. I am currently using Template10 and I have not yet found a suitable approach to implement the workaround here.

The workaround I currently use is to reload the ObservableCollection with the data

[jp-weber]

@StephenLPeters
I had recently a more detailed error report on my app in the dashboard for the first time.

null_pointer_read_c0000005_windows.ui.xaml.dll!cdependencyobjectvalidatecornerradiusvalue

Frame	Image	Function	Offset
0	Windows.UI.Xaml.dll	CDependencyObject::ValidateCornerRadiusValue	0x0000000000000011	
1	Windows.UI.Xaml.dll	CDependencyObject::SetEffectiveValue	0x00000000000009BA	
2	Windows.UI.Xaml.dll	CDependencyObject::UpdateEffectiveValue	0x00000000000000DF	
3	Windows.UI.Xaml.dll	CDependencyObject::SetValue	0x00000000000000AB	
4	Windows.UI.Xaml.dll	CUIElement::SetValue	0x00000000000000D5	
5	Windows.UI.Xaml.dll	CFrameworkElement::SetValue	0x000000000000009F	
6	Windows.UI.Xaml.dll	CBorder::SetValue	0x0000000000000036	
7	Windows.UI.Xaml.dll	CDependencyObject::UpdateEffectiveValue	0x00000000000001E9	
8	Windows.UI.Xaml.dll	CDependencyObject::SetAnimatedValue	0x00000000000000AB	
9	Windows.UI.Xaml.dll	VisualStateSetterHelper::PerformAnimatedValueOperation	0x0000000000000168	
10	Windows.UI.Xaml.dll	VisualStateManagerDataSource::ApplyPropertySetters	0x00000000000000CC	
11	Windows.UI.Xaml.dll	VisualStateManagerDataSource::SetAndApplyActivePropertySetters	0x000000000000009F	
12	Windows.UI.Xaml.dll	VisualStateManagerActuator::ChangeVisualState	0x0000000000000295	
13	Windows.UI.Xaml.dll	CVisualStateManager2::GoToStateOptimizedImpl	0x000000000000012F	
14	Windows.UI.Xaml.dll	CVisualStateManager::GoToState	0x000000000000014A	
15	Windows.UI.Xaml.dll	DirectUI::VisualStateManager::GoToStateWithDefaultVSM	0x000000000000007D	
16	Windows.UI.Xaml.dll	DirectUI::FrameworkElement::GoToElementStateCoreImpl	0x0000000000000040	
17	Windows.UI.Xaml.dll	DirectUI::FrameworkElementGenerated::GoToElementStateCoreProtected	0x00000000000000BE	
18	Windows.UI.Xaml.dll	DirectUI::VisualStateManager::GoToStateImpl	0x00000000000002CD	
19	Windows.UI.Xaml.dll	DirectUI::VisualStateManagerFactory::GoToState	0x000000000000007C	
20	Microsoft.UI.Xaml.dll	winrt::impl::call_factory_winrt::Windows::UI::Xaml::VisualStateManager,winrt::Windows::UI::Xaml::IVisualStateManagerStatics,_lambda_5fa6541ce9215f1e31f46d0a7bbb38d6_ _	0x0000000000000066	
21	Microsoft.UI.Xaml.dll	TeachingTip::UpdateDynamicHeroContentPlacementToBottomImpl	0x000000000000008F	
22	Microsoft.UI.Xaml.dll	TeachingTip::UpdateDynamicHeroContentPlacementToBottom	0x0000000000000021	
23	Microsoft.UI.Xaml.dll	TeachingTip::UpdateTail	0x0000000000000D7E	
24	Microsoft.UI.Xaml.dll	TeachingTip::PositionTargetedPopup	0x000000000000002D	
25	Microsoft.UI.Xaml.dll	TeachingTip::PositionPopup	0x0000000000000018	
26	Microsoft.UI.Xaml.dll	TeachingTip::OnHeroContentPlacementChanged	0x0000000000000067	
27	Microsoft.UI.Xaml.dll	TeachingTip::OnApplyTemplate	0x000000000000065A	
28	Microsoft.UI.Xaml.dll	winrt::impl::produce_TeachingTip,winrt::Windows::UI::Xaml::IFrameworkElementOverrides_::OnApplyTemplate	0x0000000000000030	
29	Windows.UI.Xaml.dll	DirectUI::FrameworkElementGenerated::OnApplyTemplateProtected	0x000000000000006E	
30	Windows.UI.Xaml.dll	DirectUI::FrameworkElement::OnApplyTemplateFromCore	0x0000000000000087	
31	Windows.UI.Xaml.dll	CFrameworkElement::InvokeApplyTemplate	0x00000000000001AF	
32	Windows.UI.Xaml.dll	DirectUI::FrameworkElementGenerated::InvokeApplyTemplate	0x000000000000005A	
33	Windows.UI.Xaml.dll	DirectUI::Control::ApplyTemplateImpl	0x000000000000006C	
34	Windows.UI.Xaml.dll	DirectUI::ControlGenerated::ApplyTemplate	0x0000000000000058	
35	Microsoft.UI.Xaml.dll	winrt::impl::consume_Windows_UI_Xaml_Controls_IControl_TeachingTip_::ApplyTemplate	0x000000000000005E	
36	Microsoft.UI.Xaml.dll	TeachingTip::IsOpenChangedToOpen	0x000000000000012A	
37	Microsoft.UI.Xaml.dll	std::_Func_impl_no_alloc__lambda_c6728ff03f0d579103b2f67c6f29df49_,void_::_Do_call	0x0000000000000026	
38	Microsoft.UI.Xaml.dll	winrt::impl::delegate_winrt::Windows::Foundation::EventHandler_winrt::Windows::Foundation::IInspectable_,_lambda_0fd1de47fc7bd25b54866e17e8a3d947_ _::Invoke	0x0000000000000050	
39	Windows.UI.Xaml.dll	DirectUI::CEventSourceBase_DirectUI::IUntypedEventSource,Windows::Foundation::IEventHandler_IInspectable *_,IInspectable,IInspectable_::Raise	0x000000000000010E	
40	Windows.UI.Xaml.dll	DirectUI::DXamlCore::OnRenderingEvent	0x0000000000000032	
41	Windows.UI.Xaml.dll	DirectUI::DXamlCore::RaiseEvent	0x000000000000044E	
42	Windows.UI.Xaml.dll	CCoreServices::CallPerFrameCallback	0x00000000000000C3	
43	Windows.UI.Xaml.dll	CCoreServices::NWDrawTree	0x0000000000000CEA	
44	Windows.UI.Xaml.dll	CCoreServices::NWDrawMainTree	0x00000000000000AD	
45	Windows.UI.Xaml.dll	CWindowRenderTarget::Draw	0x000000000000006F	
46	Windows.UI.Xaml.dll	CXcpBrowserHost::OnTick	0x0000000000000096	
47	Windows.UI.Xaml.dll	CXcpDispatcher::Tick	0x000000000000008D	
48	Windows.UI.Xaml.dll	CXcpDispatcher::OnReentrancyProtectedWindowMessage	0x0000000000000042	
49	Windows.UI.Xaml.dll	CXcpDispatcher::WindowProc	0x0000000000000119	
50	Windows.UI.Xaml.dll	CDeferredInvoke::DispatchQueuedMessage	0x00000000000000CB	
51	Windows.UI.Xaml.dll	CXcpDispatcher::MessageTimerCallbackStatic	0x000000000000001C	
52	CoreMessaging.dll	System__Action$CallbackThunk	0x000000000000011B	
53	CoreMessaging.dll	Microsoft::CoreUI::Dispatch::TimeoutManager::Callback_OnDispatch	0x000000000000018B	
54	CoreMessaging.dll	Microsoft::CoreUI::Dispatch::EventLoop::Callback_RunCoreLoop	0x00000000000006FB	
55	CoreMessaging.dll	Microsoft::CoreUI::Dispatch::UserAdapter::OnUserDispatch	0x00000000000001D6	
56	CoreMessaging.dll	Microsoft::CoreUI::Dispatch::UserAdapter_DoWork	0x00000000000000F1	
57	CoreMessaging.dll	Microsoft::CoreUI::Dispatch::UserAdapter_WindowProc	0x00000000000000A3	
58	user32.dll	UserCallWinProcCheckWow	0x00000000000002F8	
59	user32.dll	DispatchMessageWorker	0x0000000000000249	
60	Windows.UI.dll	Windows::UI::Core::CDispatcher::ProcessMessage	0x000000000000018B	
61	Windows.UI.dll	Windows::UI::Core::CDispatcher::WaitAndProcessMessagesInternal	0x00000000000000C0	
62	Windows.UI.dll	Windows::UI::Core::CDispatcher::ProcessEvents	0x000000000000007B	
63	Windows.UI.Xaml.dll	CJupiterWindow::RunCoreWindowMessageLoop	0x000000000000004C	
64	Windows.UI.Xaml.dll	DirectUI::DXamlCore::RunMessageLoop	0x0000000000000047	
65	twinapi.appcore.dll	Windows::ApplicationModel::Core::CoreApplicationView::Run	0x000000000000003A	
66	twinapi.appcore.dll	_lambda_643db08282a766b00cec20194396f531_::operator	0x00000000000001EF	
67	SHCore.dll	_WrapperThreadProc	0x00000000000000E9	
68	kernel32.dll	BaseThreadInitThunk	0x0000000000000014	
69	ntdll.dll	RtlUserThreadStart	0x0000000000000021	

[jp-weber]

The exception is gone with WinUI 2.6. I have now also made the creation of the control in the code behind and deleted it from the XAML.

Now there are no more problems.