Access violation in CoreMessaging!Windows::System::DispatcherQueue::CompleteShutdown

[jhert0]

Describe the bug

Program crashed due to access violation. I'm not sure what was happening before this, I just found this crash dump on a computer we were using for testing.

0:000> dt ntdll!LdrpLastDllInitializer BaseDllName ; dt ntdll!LdrpFailureData ; ~0s; .ecxr ; kb
Symbol ntdll!LdrpLastDllInitializer not found.
Symbol ntdll!LdrpFailureData not found.
CoreMessaging!Windows::System::DispatcherQueue::CompleteShutdown+0x79:
00007ffd`d099227d 4883a7a000000000 and     qword ptr [rdi+0A0h],0 ds:0000000e`5017d1a0=????????????????
rax=0000000000000000 rbx=0000000e5017d5f0 rcx=00007ffdd0a60af0
rdx=0000000000000110 rsi=0000000000000000 rdi=0000000e5017d100
rip=00007ffdd099227d rsp=0000000e5017d8a0 rbp=0000000e5017d8d0
 r8=0000000000000001  r9=0000000000000001 r10=00000fffba13cc36
r11=5555555555555555 r12=0000000000000000 r13=000000000000001c
r14=00007ffdd0991fe0 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010200
CoreMessaging!Windows::System::DispatcherQueue::CompleteShutdown+0x79:
00007ffd`d099227d 4883a7a000000000 and     qword ptr [rdi+0A0h],0 ds:0000000e`5017d1a0=????????????????
  *** Stack trace for last set context - .thread/.cxr resets it
 # RetAddr               : Args to Child                                                           : Call Site
00 00007ffd`d0991fe9     : 00000000`00000000 0000016f`71f43020 00000000`00000000 0000016f`1f7082d0 : CoreMessaging!Windows::System::DispatcherQueue::CompleteShutdown+0x79
01 00007ffd`d09a529b     : 0000016f`1f7082d0 0000016f`ac6a5390 0000016f`1f7082d0 0000016f`ac6a5390 : CoreMessaging!Windows::System::DispatcherQueue::QueueDrainedCallback+0x9
02 00007ffd`d0999d34     : 00000000`00000003 0000016f`1f708520 0000016f`ac6a5390 0000016f`58d4e4f0 : CoreMessaging!Microsoft__CoreUI__Dispatch__TimeoutHandler$CallbackThunk+0x11b
03 00007ffd`d09995de     : 0000016f`58d4e4f0 0000016f`5f068820 0000016f`58d4e4f0 0000016f`1f7083b0 : CoreMessaging!Microsoft::CoreUI::Dispatch::DeferredCall::Callback_Dispatch+0x2c4
04 00007ffd`d09a9d84     : 00000000`00000004 0000016f`220f8160 0000016f`220f8160 00000000`00000004 : CoreMessaging!Microsoft::CoreUI::Dispatch::DeferredCallDispatcher::Callback_OnDispatch+0x15e
05 00007ffd`d09a8d36     : 00000000`00000001 00000000`00000000 0000016f`1f70d350 0000016f`42969190 : CoreMessaging!Microsoft::CoreUI::Dispatch::EventLoop::Callback_RunCoreLoop+0xc04
06 00007ffd`d09a6f71     : 0000016f`42969190 0000016f`1f713170 00000000`00000000 00000000`00000000 : CoreMessaging!Microsoft::CoreUI::Dispatch::UserAdapter::OnUserDispatch+0x1d6
07 00007ffd`d09a6d9c     : 0000016f`1f713170 00000000`00000000 0000016f`00000000 0000016f`40000c02 : CoreMessaging!Microsoft::CoreUI::Dispatch::UserAdapter_DoWork+0xf1
08 00007ffd`d403e858     : 0000016f`1f708348 00000000`00000001 00000000`00000001 00000000`00000000 : CoreMessaging!Microsoft::CoreUI::Dispatch::UserAdapter_WindowProc+0xfc
09 00007ffd`d403e3dc     : 00000000`00000060 00007ffd`d09a6ca0 00000000`0008079e 00007ffd`00000060 : user32!UserCallWinProcCheckWow+0x2f8
0a 00007ffd`d4050c93     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : user32!DispatchClientMessage+0x9c
0b 00007ffd`d6070e64     : 00000001`00000009 00000000`00000009 00000000`0000000a 00007ffd`c5c5ea47 : user32!_fnDWORD+0x33
0c 00007ffd`d3b81064     : 00007ffd`d403a5c3 ffffffff`ffffffff 00007ffd`d403e703 00007ffd`d403eb96 : ntdll!KiUserCallbackDispatcherContinue
0d 00007ffd`d403a5c3     : ffffffff`ffffffff 00007ffd`d403e703 00007ffd`d403eb96 00000000`0000000a : win32u!NtUserPeekMessage+0x14
0e 00007ffd`d403a523     : 00000000`00000000 0000016f`1fba4930 00000000`00000001 00000000`00000000 : user32!_PeekMessage+0x43
0f 00007ffd`c5c5e9f4     : 00000000`00000001 0000000e`5017e379 00000000`00000000 0000000e`5017e379 : user32!PeekMessageW+0x143
10 00007ffd`c5c21886     : 0000016f`1f632490 0000016f`220f9700 00000000`00000001 00007ffd`c5c7152d : CoreMessagingXP!Microsoft::CoreUI::Dispatch::UserAdapter::DispatchNextUserQueueItemNative+0xb4
11 00007ffd`c5c210d3     : 0000016f`1f638c58 0000016f`1f638c58 0000016f`1f638c40 0000016f`1f638c40 : CoreMessagingXP!Microsoft::CoreUI::Dispatch::UserAdapter::RunIntegratedLoop+0x1a2
12 00007ffd`c5c2a7a6     : 0000016f`22059cc0 0000016f`1f638c40 0000016f`220f7360 00000000`00000000 : CoreMessagingXP!Microsoft::CoreUI::Dispatch::UserAdapter::Callback_HostModeRun+0xdb
13 00007ffd`c5c1eb79     : 0000016f`220f9700 0000016f`220f7360 00000000`00000000 0000016f`1f638c40 : CoreMessagingXP!Microsoft::CoreUI::Dispatch::Win32EventLoopBridge::Callback_Run+0x236
14 00007ffd`c5c245d0     : 0000016f`00000000 0000016f`1f632490 0000016f`429850a0 00000000`00000000 : CoreMessagingXP!Microsoft::CoreUI::Dispatch::EventLoop::Callback_Run+0x10d
15 00007ffd`c5c9e783     : 0000016f`1f632490 0000016f`220f07a4 00007ffd`99cf7c20 0000016f`220f9700 : CoreMessagingXP!Microsoft::CoreUI::IExportMessageLoopExtensions::ExportAdapter$::RunUntilExitFlag+0xb0
16 00007ffd`c5c98b5d     : 0000016f`429850a0 0000016f`220f0680 00000000`00000000 00000000`00000012 : CoreMessagingXP!Microsoft::UI::Dispatching::DispatcherQueue::Run+0x67
17 00007ffd`99ca08c7     : 00000000`00000000 00000000`00000000 0000016f`220f82a8 00007ffd`43509768 : CoreMessagingXP!Microsoft::UI::Dispatching::DispatcherQueueController::ShutdownQueue+0xfd
18 00007ffd`99bffc2e     : 0000016f`220f9678 0000016f`1f656630 0000016f`220f9678 0000000e`5017e7a8 : Microsoft_ui_xaml!DirectUI::FrameworkApplication::StartDesktop+0x357 [D:\a\_work\1\s\dxaml\xcp\dxaml\lib\FrameworkApplication_Partial.cpp @ 238] 
19 (Inline Function)     : --------`-------- --------`-------- --------`-------- --------`-------- : Microsoft_ui_xaml!DirectUI::FrameworkApplicationFactory::StartImpl+0x49 [D:\a\_work\1\s\dxaml\xcp\dxaml\lib\FrameworkApplication_Partial.cpp @ 183] 
1a 00007ffd`4352067d     : 0000000e`5017ec48 00007ffd`a30aba6e 0000016f`00000057 0000000e`5017e8a0 : Microsoft_ui_xaml!DirectUI::FrameworkApplicationFactory::Start+0x6e [D:\a\_work\1\s\dxaml\xcp\dxaml\lib\winrtgeneratedclasses\FrameworkApplication.g.cpp @ 789] 
1b 0000000e`5017ec48     : 00007ffd`a30aba6e 0000016f`00000057 0000000e`5017e8a0 0000016f`2222b368 : 0x00007ffd`4352067d
1c 00007ffd`a30aba6e     : 0000016f`00000057 0000000e`5017e8a0 0000016f`2222b368 000094b2`6827cda8 : 0x0000000e`5017ec48
1d 00007ffd`4350a452     : 0000016f`1f656630 0000016f`220f9678 00000000`00000000 0000016f`220f95e0 : coreclr!GenericPInvokeCalliGenILStub+0x5e
1e 0000016f`1f656630     : 0000016f`220f9678 00000000`00000000 0000016f`220f95e0 0000000e`5017e7f0 : 0x00007ffd`4350a452
1f 0000016f`220f9678     : 00000000`00000000 0000016f`220f95e0 0000000e`5017e7f0 00000000`00000000 : 0x0000016f`1f656630
20 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x0000016f`220f9678

Steps to reproduce the bug

Do not know how to reproduce.

Expected behavior

No crashes

Screenshots

No response

NuGet package version

WinUI 3 - Windows App SDK 1.4.2: 1.4.231008000

Windows version

Windows 10 (21H2): Build 19044, Windows 10 (20H2): Build 19042

Additional context

App is packaged.

[codendone]

This is fixed for 1.5 (internal bug).