AccessViolationException thrown when updating bindings

[WamWooWam]

Describe the bug
In certain scenarios, bindings to .NET objects cause AccessViolationExceptions to be thrown within the binding system, seemingly related to string corruption when marshaling? It seems to be possible at any time but appears to occur most often in ListViews with large amounts of items and string bindings, where the contents of each ListViewItem is it's own control.

Steps to reproduce the bug
Create a ListView populated with a large amount of items with large amounts of string bindings, and scroll through the view by dragging the scroll bar as fast as possible.

See the repo repository here: https://github.com/WamWooWam/WinUIBugRepros/

Expected behavior
The app doesn't crash

Version Info

NuGet package version: Microsoft.WinUI 3.0.0-preview3.201113.0

Windows app type:

UWP	Win32
No	Yes

Windows 10 version	Saw the problem?
Insider Build (19042)	Yes
May 2020 Update (19041)
November 2019 Update (18363)
May 2019 Update (18362)
October 2018 Update (17763)
April 2018 Update (17134)
Fall Creators Update (16299)
Creators Update (15063)

Device form factor	Saw the problem?
Desktop	Yes
Xbox
Surface Hub
IoT

Additional context
This could be a CSWinRT related issue, but I haven't been able to repro this elsewhere

[WamWooWam]

I've just now learnt that the repro app can also cause heap corruption (HR 0xC0000374) with a similar call stack

[dotMorten]

@sonnemaf Is this what you were hitting too? https://twitter.com/fonssonnemans/status/1330853246206873603

[sonnemaf]

I think it is. Not 100% sure. I have loaded the symbols on KernelBase and combase. It shows the CompareString thing. It might be a string coruption problem.

I can't load the Symbols for Microsoft.ui.xaml.dll. They are not on the Symbol server.

[sonnemaf]

Just tried the Repo app from @WamWooWam. It seems the same problem. See Call Stack below.

[WamWooWam]

Just tried the Repo app from @WamWooWam. It seems the same problem. See Call Stack below.

Yeah this is the same thing I see, for a full stack trace with all symbols: https://paste.mod.gg/ivehuqajog.cpp

[WamWooWam]

So some extra investigation, by which I mean bodging WinUI 3 into running on .NET Core 3.1 via classic WinRT interop (i.e. without CSWinRT), I've found that these crashes don't happen there, so I'm left wondering if this is a CSWinRT issue after all?

Maybe CSWinRT is somehow corrupting the heap or certain string pointers causing these crashes to happen? It's hard to investigate further while WinUI 3 is still closed source.

[sonnemaf]

Any news on this. It is a blocking feature for me. I can't really use WinUI 3.0 preview 3 due to this.

[evelynwu-msft]

Thanks for the report! The fix for this will be included in the next WinUI 3 Preview. In the meantime, you can work around this issue by installing .NET SDK >= 5.0.101 and adding the following lines to your project file:

  <ItemGroup>
    <FrameworkReference Update="Microsoft.Windows.SDK.NET.Ref" RuntimeFrameworkVersion="10.0.19041.12" />
    <FrameworkReference Update="Microsoft.Windows.SDK.NET.Ref" TargetingPackVersion="10.0.19041.12" />
  </ItemGroup>