0xc0000409 buffer overrun at startup under AOT

[mqudsi]

Describe the bug

I'm unable to run the AOT-published output of my .NET 9 + Windows App SDK 1.7250401001 due to startup errors initializing COM or interacting with WinRT apis.

(853c.d500): Security check failure or stack buffer overrun - code c0000409 (!!! second chance !!!)
Subcode: 0x48 (unknown subcode)
PrayerGuardian!WinRT_Runtime_WinRT_ActivationFactory__Get_0+0x167:

with the following stack:

Current frame: PrayerGuardian!WinRT_Runtime_WinRT_ActivationFactory__Get_0 + 0x167
Child-SP         RetAddr          Caller, Callee
00000020A22FF680 00007ff83952af29 combase!CoInitializeEx + 0x49 [onecore\com\combase\class\compobj.cxx:3781], calling combase!_CoInitializeEx [onecore\com\combase\class\compobj.cxx:3527]
00000020A22FF720 00007ff7e551418e PrayerGuardian!Microsoft_WinUI_Microsoft_UI_Xaml_Application__get__objRef_global__Microsoft_UI_Xaml_IApplicationStatics + 0x3e, calling PrayerGuardian!WinRT_Runtime_WinRT_ActivationFactory__Get_0
00000020A22FF728 00007ff7e570604a PrayerGuardian!S_P_CoreLib_System_Threading_Thread__InitializeCom + 0x8a [/_/src/coreclr/nativeaot/System.Private.CoreLib/src/System/Threading/Thread.NativeAot.Windows.cs:341], calling PrayerGuardian!RhpPInvoke [D:\a\_work\1\s\src\coreclr\nativeaot\Runtime\amd64\PInvoke.asm:19]
00000020A22FF730 00007ff7e569aa77 PrayerGuardian!S_P_CoreLib_System_Delegate__InitializeClosedInstance + 0x17 [/_/src/coreclr/nativeaot/System.Private.CoreLib/src/System/Delegate.cs:118], calling PrayerGuardian!RhpAssignRefAVLocation [D:\a\_work\1\s\src\coreclr\nativeaot\Runtime\amd64\WriteBarriers.asm:184]
00000020A22FF760 00007ff7e556d25b PrayerGuardian!PrayerGuardian_PrayerGuardian_Program__StartApp + 0x4b [D:\GIT\PrayerGuardian\PrayerGuardian\Program.cs:65], calling PrayerGuardian!Microsoft_WinUI_Microsoft_UI_Xaml_Application__get__objRef_global__Microsoft_UI_Xaml_IApplicationStatics
00000020A22FF790 00007ff7e5705509 PrayerGuardian!S_P_CoreLib_System_Threading_Thread__StartThread + 0x109 [/_/src/coreclr/nativeaot/System.Private.CoreLib/src/System/Threading/Thread.NativeAot.cs:448]
00000020A22FF7F0 00007ff7e5705bba PrayerGuardian!S_P_CoreLib_System_Threading_Thread__ThreadEntryPoint + 0x1a [/_/src/coreclr/nativeaot/System.Private.CoreLib/src/System/Threading/Thread.NativeAot.Windows.cs:226], calling PrayerGuardian!S_P_CoreLib_System_Threading_Thread__StartThread [/_/src/coreclr/nativeaot/System.Private.CoreLib/src/System/Threading/Thread.NativeAot.cs:413]
00000020A22FF830 00007ff83a06e8d7 KERNEL32!BaseThreadInitThunk + 0x17, calling 00007ff83b4a30c0
00000020A22FF860 00007ff83b2fbf6c ntdll!RtlUserThreadStart + 0x2c, calling 00007ff83b4a30c0

Manually calling into Microsoft.Windows.AppLifecycle.AppInstance.GetCurrent().GetActivatedEventArgs() or AppInstance.GetActivatedEventArgs() at the top of Program::Main() after a (successful) call to global::WinRT.ComWrappersSupport.InitializeComWrappers() similarly produces the following:

onecoreuap\base\appmodel\execmodel\client\applicationinstance\applicationinstance.cpp(58)\execmodelclient.dll!00007FF813463703: (caller: 00007FF76C90473D) ReturnHr(1) tid(e288) D0000225     CallContext:[\GetActivatedEventArgsClient] 
(a4cc.e288): Security check failure or stack buffer overrun - code c0000409 (!!! second chance !!!)
Subcode: 0x48 (unknown subcode)
PrayerGuardian!WinRT_Runtime_WinRT_ExceptionHelpers___ThrowExceptionForHR_g__Throw_38_0+0x3c:
00007ff7`6cc8245c cc              int     3

with the following stack trace:

Current frame: PrayerGuardian!WinRT_Runtime_WinRT_ExceptionHelpers___ThrowExceptionForHR_g__Throw_38_0 + 0x3c
Child-SP         RetAddr          Caller, Callee
0000001E3E97F920 00007ff76cb04bbd PrayerGuardian!S_P_CoreLib_System_Runtime_CompilerServices_ClassConstructorRunner__CheckStaticClassConstructionReturnGCStaticBase + 0xd [/_/src/coreclr/nativeaot/System.Private.CoreLib/src/System/Runtime/CompilerServices/ClassConstructorRunner.cs:36], calling PrayerGuardian!S_P_CoreLib_System_Runtime_CompilerServices_ClassConstructorRunner__EnsureClassConstructorRun [/_/src/coreclr/nativeaot/System.Private.CoreLib/src/System/Runtime/CompilerServices/ClassConstructorRunner.cs:55]
0000001E3E97F930 00007ff76ce8d4c6 PrayerGuardian!S_P_CoreLib_System_Collections_Generic_List_1<System___Canon>__set_Capacity + 0x76 [/_/src/libraries/System.Private.CoreLib/src/System/Collections/Generic/List.cs:123], calling PrayerGuardian!RhpAssignRefAVLocation [D:\a\_work\1\s\src\coreclr\nativeaot\Runtime\amd64\WriteBarriers.asm:184]
0000001E3E97F940 00007ff76c904753 PrayerGuardian!Microsoft_Windows_SDK_NET_ABI_Windows_ApplicationModel_IAppInstanceStaticsMethods__GetActivatedEventArgs + 0x73, calling PrayerGuardian!WinRT_Runtime_WinRT_ExceptionHelpers___ThrowExceptionForHR_g__Throw_38_0
0000001E3E97F980 00007ff76c904733 PrayerGuardian!Microsoft_Windows_SDK_NET_ABI_Windows_ApplicationModel_IAppInstanceStaticsMethods__GetActivatedEventArgs + 0x53, calling PrayerGuardian!RhpPInvoke [D:\a\_work\1\s\src\coreclr\nativeaot\Runtime\amd64\PInvoke.asm:19]
0000001E3E97F9F0 00007ff76c92e09f PrayerGuardian!PrayerGuardian_PrayerGuardian_Program__Main + 0x4f [D:\GIT\PrayerGuardian\PrayerGuardian\Program.cs:38], calling PrayerGuardian!Microsoft_Windows_SDK_NET_ABI_Windows_ApplicationModel_IAppInstanceStaticsMethods__GetActivatedEventArgs
0000001E3E97FA20 00007ff76cb33680 PrayerGuardian!S_P_CoreLib_Internal_Runtime_CompilerHelpers_StartupCodeHelpers__GetMainMethodArguments + 0x50 [/_/src/coreclr/nativeaot/System.Private.CoreLib/src/Internal/Runtime/CompilerHelpers/StartupCode/StartupCodeHelpers.Extensions.cs:54], calling PrayerGuardian!S_P_CoreLib_System_Array__Copy_2 [/_/src/libraries/System.Private.CoreLib/src/System/Array.cs:392]
0000001E3E97FA60 00007ff76cf1df91 PrayerGuardian!PrayerGuardian__Module___StartupCodeMain + 0x111 [<stdin>:15732480], calling PrayerGuardian!PrayerGuardian__Module___MainMethodWrapper [<stdin>:15732480]
0000001E3E97FA70 00007ff76d010b31 PrayerGuardian!RhRegisterOSModule + 0xb1 [D:\a\_work\1\s\src\coreclr\nativeaot\Runtime\windows\CoffNativeCodeManager.cpp:1200], calling PrayerGuardian!RegisterUnboxingStubs [D:\a\_work\1\s\src\coreclr\nativeaot\Runtime\RuntimeInstance.cpp:260]
0000001E3E97FAB0 00007ff76d005992 PrayerGuardian!wmain + 0xb2 [D:\a\_work\1\s\src\coreclr\nativeaot\Bootstrap\main.cpp:226], calling PrayerGuardian!PrayerGuardian__Module___StartupCodeMain [<stdin>:15732480]
0000001E3E97FB00 00007ff76d0c2f34 PrayerGuardian!__scrt_common_main_seh + 0x10c [D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288], calling PrayerGuardian!wmain [D:\a\_work\1\s\src\coreclr\nativeaot\Bootstrap\main.cpp:220]
0000001E3E97FB40 00007ff83a06e8d7 KERNEL32!BaseThreadInitThunk + 0x17, calling 00007ff83b4a30c0
0000001E3E97FB70 00007ff83b2fbf6c ntdll!RtlUserThreadStart + 0x2c, calling 00007ff83b4a30c0

As simply calling GetActivatedEventArgs() reproduces the issue, I am opening this here rather than against the WinUI repo.

Steps to reproduce the bug

1. Create a .NET 9 application configured with <PublishAot>true</PublishAot>
2. Call into the runtime at startup, either with the XAML-generated main or manually with the following:

    public static class Program
    {
        [MTAThread]
        static void Main(string[] args)
        {
            global::WinRT.ComWrappersSupport.InitializeComWrappers();

            // var activationArgs = Microsoft.Windows.AppLifecycle.AppInstance.GetCurrent().GetActivatedEventArgs();
            var activationArgs = AppInstance.GetActivatedEventArgs();
    }

Expected behavior

It should run successfully the same way it does when executing the non-published AOT-ready app normally.

Screenshots

No response

NuGet package version

Windows App SDK 1.7.1: 1.7.250401001

Packaging type

Unpackaged

Windows version

Windows 11 version 24H2 (22621, October 2024 Update)

IDE

Visual Studio 2022-preview

Additional context

No response