MenuFlyout crashes in Xaml Islands

[sylveon]

Describe the bug
When opening submenus in quick succession in MenuFlyout on Xaml Islands, there is a chance it can crash the whole program.

Steps to reproduce the bug

1. Create a new blank WPF .NET Framework app.
2. Add the Microsoft.Toolkit.Wpf.UI.XamlHost NuGet package.
3. Add a project reference to the UniversalApiContract winmd from the Windows SDK.
4. Add an app manifest to the app, and within <compatibility> add <maxversiontested Id="10.0.19041.0" />
5. In MainWindow.xaml, write the following

   <Window x:Class="WpfApp2.MainWindow"
           xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
           xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
           xmlns:d="http://schemas.microsoft.com/expression/blend/2008"
           xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006"
           xmlns:local="clr-namespace:WpfApp2" xmlns:xamlhost="clr-namespace:Microsoft.Toolkit.Wpf.UI.XamlHost;assembly=Microsoft.Toolkit.Wpf.UI.XamlHost"
           mc:Ignorable="d"
           Title="MainWindow" Height="450" Width="800">
       <Grid>
           <xamlhost:WindowsXamlHost x:Name="host" />
       </Grid>
   </Window>

6. In MainWindow.xaml.cs, write this code

   public partial class MainWindow : Window
   {
       private Windows.UI.Xaml.Controls.MenuFlyoutSubItem MakeSubMenu(int i)
       {
           var sub = new Windows.UI.Xaml.Controls.MenuFlyoutSubItem
           {
               Text = $"Submenu {i}"
           };
   
           foreach (var j in Enumerable.Range(0, 10))
           {
               sub.Items.Add(new Windows.UI.Xaml.Controls.MenuFlyoutItem
               {
                   Text = $"Item {j}"
               });
           }
   
           return sub;
       }
   
       public MainWindow()
       {
           InitializeComponent();
   
           var rect = new Windows.UI.Xaml.Shapes.Rectangle
           {
               Fill = new Windows.UI.Xaml.Media.SolidColorBrush(Windows.UI.Colors.Red),
               Width = 50,
               Height = 50
           };
   
           var flyout = new Windows.UI.Xaml.Controls.MenuFlyout();
           foreach (var i in Enumerable.Range(0, 10))
           {
               flyout.Items.Add(MakeSubMenu(i));
           }
   
           rect.ContextFlyout = flyout;
           host.Child = rect;
       }
   }

7. Launch the app.
8. Right-click on the red square
9. Open different sub-menus in quick succession.

Expected behavior
The app does not crash

Screenshots

Version Info

NuGet package version:
[Microsoft.Toolkit.Wpf.UI.XamlHost 6.1.2]

Windows app type:

UWP	Win32
	Yes

Windows 10 version	Saw the problem?
Insider Build (xxxxx)
May 2020 Update (19041)	Yes
November 2019 Update (18363)
May 2019 Update (18362)
October 2018 Update (17763)
April 2018 Update (17134)
Fall Creators Update (16299)
Creators Update (15063)

Device form factor	Saw the problem?
Desktop	Yes
Xbox
Surface Hub
IoT

Additional context
This also happens in my C++-based XAML islands app, so this is not an issue specific to the WCT WPF host, it just makes reproduction easier.

Here's a video recording of the issue: https://imgur.com/pHTPAB2

[ranjeshj]

Can you please attach a repro app ?

[sylveon]

Sure, here you go: WpfApp2.zip

[sylveon]

After playing a bit with it, it seems this is triggered when a sub-menu is opened while the animation for opening the previous sub-menu hasn't finished playing. I've had a few crashes not triggered like that, but since the crash is the exact same the fix would probably resolve them too.

[zadjii-msft]

FYI this looks related to #3529 and #3530, and is probably the root cause for microsoft/terminal#8238

[StephenLPeters]

@Austin-Lamb and @JesseCol for the XamlIslands perspective

[lyahdav]

I found a workaround: #3529 (comment)

[sylveon]

Seems to be fixed in Windows 11, would appreciate the fix to be backported to Windows 10.

[zadjii-msft]

@Austin-Lamb Any way you could confirm that this is fixed in Win11? the Terminal team would greatly appreciate a backport for that fix to Win10 (if that's even possible). Feel free to ping me on a mail thread if needed.

[sylveon]

At least from my testing, I could reliably get it to crash in 10 and can't no matter how hard it try on 11. I wonder if this fix was prompted by the taskbar dogfooding Xaml islands.

[zadjii-msft]

(fyi Austin is out for the week, maybe @JesseCol can answer in his place)

[JesseCol]

Hi -- sorry, this bug doesn't ring a bell to me. If it's related to the animation, @codendone might recognize it.

[lyahdav]

I believe @gegao18 was the one who fixed this.

[zadjii-msft]

As an update - I think this was MSFT:31809589 internally, which is definitely fixed in Windows 11. I'd reckon that this thread, #3529, and #3530 can all get combined into a single tracking issue, though I'll leave it to the WinUI folks to decide how they want to run their own repo 😛

[krschau]

Duplicate of #3529