Crash in WinUI3 / SDK 1.6 in Microsoft_UI_Input!InputSiteHwndWinRT::PeekKeyboardMessageTime_Callback+0xd8

[wbokkers]

Describe the bug

Users of our WinUI3/AppSDK1.6 based app, report crashes that could not be handled within our app.

The call stack is always:

STACK_TEXT:
0000007166bab3d0 00007ff8ba325194 : 0000000000000000 00007ff9172839e0 0000000000000000 0000007166babbe0 : KERNELBASE!RaiseFailFastException+0x152
0000007166bab9b0 00007ff8ba325273 : 0000007166babb00 000000000000009e 0000007166babb69 0000000000000000 : Microsoft_UI_Input!wil::details::WilDynamicLoadRaiseFailFastException+0x54
0000007166bab9e0 00007ff8ba325252 : 0000000100000001 000001b1cb7d0000 0000000000000001 00007ff9191d0167 : Microsoft_UI_Input!wil::details::WilRaiseFailFastException+0x17
0000007166baba10 00007ff8ba31a6ce : 0000007166bad0a0 0000007166babbe0 000000000000009e 00007ff8ba32b643 : Microsoft_UI_Input!wil::details::WilFailFast+0xa6
0000007166babae0 00007ff8ba31a0f8 : 0000000000000000 00007ff917155a23 0000007166bad060 0000000000000000 : Microsoft_UI_Input!wil::details::ReportFailure_NoReturn<3>+0x296
0000007166bacff0 00007ff8ba31a36a : 0000000000000000 00007ff8ba35a449 0000000000000000 00007ff8ba460f48 : Microsoft_UI_Input!wil::details::ReportFailure_Base<3,0>+0x30
0000007166bad050 00007ff8ba31df94 : 0000000000000000 000001f272b6d4b0 0000007166bad230 00007ff8a90b4277 : Microsoft_UI_Input!wil::details::ReportFailure_Hr<3>+0x5a
0000007166bad0d0 00007ff8ba333df8 : 0000007166bad470 00007ff8e19d87ff 0000007166bad470 0000000000000004 : Microsoft_UI_Input!wil::details::in1diag3::FailFast_Unexpected+0x24
0000007166bad130 00007ff8ba32b643 : 000001f26a914bc0 000001f271fd3610 00007ff800000100 0000000000000101 : Microsoft_UI_Input!InputSiteHwndWinRT::PeekKeyboardMessageTime_Callback+0xd8
0000007166bad1d0 00007ff8ba3574eb : 000001f27eff5378 0000007166bad2d0 0000007166bad260 0000000000000000 : Microsoft_UI_Input!IslandInputSiteWinRT::PeekKeyboardMessageTime_Callback+0x53
0000007166bad210 00007ff8ba3567b2 : 0000007166bad360 0000010064700824 0000000066bad380 0000000000000000 : Microsoft_UI_Input!PointerInputObserverWinRT::PointerAndKeyboardMessageOrderMediator::GetNextKeyboardMessageTimeInMs_Callback+0x47
0000007166bad280 00007ff8ba35b5d6 : 0000007166bad578 0000000000000000 000001f280c07e20 00007ff8bae7c920 : Microsoft_UI_Input!PointerInputObserverWinRT::DeliverInputMessage+0x1c2
0000007166bad520 00007ff8d5e9b282 : 000001f264700824 000001f280c07e20 0000000040a000c0 000001f280c07e20 : Microsoft_UI_Input!IIndependentInputTargetPrincipal_ReceiveBamoImpl::BamoIndependentInputTargetPrincipalImpl::Thunk_DeliverInputMessage_17+0xd6
0000007166bad5c0 00007ff8ba35887f : 0000000000000000 00007ff8ba33550c 000001b1cb7d0000 0000000000000001 : CoreMessagingXP!CoreUICallReceive+0xa2
0000007166bad7d0 00007ff8ba3eda13 : 0000007166bad870 000001f271afdd50 000001f280c07e20 000001f202400010 : Microsoft_UI_Input!BamoImpl::BamoIndependentInputTargetPrincipalImpl::OnMessage+0x3f
0000007166bad820 00007ff8d5e4fb68 : 000001f271afdd40 0000007166bad8f0 0000007166bad930 0000000040a000c0 : Microsoft_UI_Input!Microsoft::BamoImpl::ConnectionIndirector::OnItemMessage+0xb3
0000007166bad870 00007ff8d5e4fe5f : 000001b1cd4905a0 00007ff8d5ebe288 0000007166bad950 000001f2724d8510 : CoreMessagingXP!CFlat::SehSafe::Execute<<lambda_de6cc8128f8f9f99144226758963eeb9> >+0x4c
0000007166bad8c0 00007ff8d5e448eb : 000001f2724d8510 000001f280c07e20 000001f200000001 0000007140a000c0 : CoreMessagingXP!Microsoft::CoreUI::ICallbackMessageConversationHost::Interface$::ImportDispatcher::OnItemMessage+0xbf
0000007166bad940 00007ff8d5e45890 : 000001f2724d8510 0000007166bad9f0 000001f2720ffbd0 0000000000000000 : CoreMessagingXP!Microsoft::CoreUI::ICallbackMessageConversationHost::OnItemMessage<CFlat::InterfacePtrMicrosoft::CoreUI::ICallbackMessageConversationHost >+0x5f
0000007166bad990 00007ff8d5e91f46 : 000001f2720ffbd0 000001f26a71c510 000001f280c07e20 000001f2724d8510 : CoreMessagingXP!Microsoft::CoreUI::Conversations::Conversation::Callback_OnItemMessage+0x130
0000007166bada20 00007ff8d5e3b330 : 000001f2720ffbd0 000001b1cd499d20 0000000000000000 000001b1cb8bdd50 : CoreMessagingXP!Microsoft::CoreUI::Conversations::ItemMessageDispatcher::Callback_OnMessageCore+0x36
0000007166bada70 00007ff8d5e320ba : 000001f2724d7d30 000001b1cb8ff650 000001f2724d7d30 00007ff8d5ea7541 : CoreMessagingXP!Microsoft::CoreUI::Messaging::MessageEndpoint::Callback_OnMessage+0x80
0000007166badb20 00007ff8d5e32279 : 000001b1cb8ff650 000001b100000100 0000007166badc70 0000000000000001 : CoreMessagingXP!Microsoft::CoreUI::Messaging::MessageSession::Callback_DeliverMessage+0x2be
0000007166badc00 00007ff8d5e5ef90 : 0000000000000000 000001b1cb8ff650 0000007166badd40 000000000001ffff : CoreMessagingXP!Microsoft::CoreUI::Messaging::MessageSession::Callback_DeliverMessageBatch+0x109
0000007166badcd0 00007ff8d5e23e0d : 000001b1cb873ef0 000001b1cb873ef0 0000000000000001 000001b1cd48fdd0 : CoreMessagingXP!Microsoft::CoreUI::Messaging::InterconnectMessageAdapter::InterfaceImplementation$::_Cn_Threading_IInterconnectBufferHandler::Dispatcher::Callback_ReceiveBuffer+0xf0
0000007166baddd0 00007ff8d5e77840 : 000001b1cd48fdd0 000001b1cb8ffaa0 0000000000000000 0000000000006626 : CoreMessagingXP!Cn::Threading::InterconnectQueue::Callback_ProcessNextItem+0x1d1
0000007166bade70 00007ff8d5e683ce : 000001b1cb8ffaa0 000001b1cb873d10 0000000000000000 00007ff8d5e22dc1 : CoreMessagingXP!Microsoft::CoreUI::Messaging::InterconnectMessageAdapter::Callback_OnReceive+0x4c
0000007166badeb0 00007ff8d5e2c880 : 000001b1cd4a6120 0000000000000000 000001b1cb8fec20 000001b1cb8ffa40 : CoreMessagingXP!Microsoft::CoreUI::Dispatch::OffThreadReceiver::Callback_OnDispatch+0x2be
0000007166badf50 00007ff8d5e2c5ed : 0000000000000000 0000000000000000 0000000000000000 000001b1cb8ffa40 : CoreMessagingXP!Microsoft::CoreUI::Dispatch::Dispatcher::Callback_DispatchNextItem+0x1bc
0000007166badff0 00007ff8d5e1fd7c : 0000000000000000 fffffffffffffffe 000001b1cb8fec20 00007ff9195a9877 : CoreMessagingXP!Microsoft::CoreUI::Dispatch::Dispatcher::Callback_DispatchLoop+0x1b9
0000007166bae0b0 00007ff8d5e22c66 : 000001b1cb8fec20 000001b1cd4044d0 000001b100000000 000001b1cb8fed00 : CoreMessagingXP!Microsoft::CoreUI::Dispatch::EventLoop::Callback_RunCoreLoop+0x164
0000007166bae110 00007ff8d5e22fdc : 000001b1cd4905a0 000001b1cd494d70 0000000000000000 00007ff8d5e1f1f1 : CoreMessagingXP!Microsoft::CoreUI::Dispatch::UserAdapter::DrainCoreMessagingQueue+0x15a
0000007166bae1d0 00007ff8d5e636a3 : 00000000000a0b6c 0000007166bae590 0000000000000000 00000000000a0b6c : CoreMessagingXP!Microsoft::CoreUI::Dispatch::UserAdapter::OnUserDispatch+0x98
0000007166bae220 00007ff8d5e63836 : 000001b1cd4993e0 00000000000a0b6c 00000000000a0b6c 000001b1cb8fed00 : CoreMessagingXP!Microsoft::CoreUI::Dispatch::UserAdapter::DoWork+0xa7
0000007166bae280 00007ff8d5e63dae : 0000000000000000 0000000000000060 0000e3902a1d3c7b 0000000000000006 : CoreMessagingXP!Microsoft::CoreUI::Dispatch::UserAdapter::HandleDispatchNotifyMessage+0x132
0000007166bae2e0 00007ff918f2ef5c : 0000000000000070 0000000000000001 0000000000000001 00000000000a0b6c : CoreMessagingXP!Microsoft::CoreUI::Dispatch::UserAdapter::WindowProc+0x5e
0000007166bae310 00007ff918f2e684 : 0000000000000000 00007ff8d5e63d50 0000007166c7b800 00007ff918f4210e : user32!UserCallWinProcCheckWow+0x50c
0000007166bae4a0 00007ff8a961facd : 00007ff8d5e63d50 0000000000000000 0000000000000000 00007ff85b071701 : user32!DispatchMessageWorker+0x494
0000007166bae520 00007ff8a961d9e2 : 0000000000000000 0000007166bae5d9 0000000000000000 00007ff8d5ea0f60 : Microsoft_UI_Xaml!DirectUI::FrameworkApplication::RunDesktopWindowMessageLoop+0x99
0000007166bae5a0 00007ff8a92cf1b8 : 000001b1cb8600e0 0000007166bae918 0000007166baeab8 00007ff85b0716ec : Microsoft_UI_Xaml!DirectUI::FrameworkApplication::StartDesktop+0x3c2
0000007166bae640 00007ff85b068bc5 : 0000000000000000 0000007166bae740 00004c8a2cd6946b 0000007166bae398 : Microsoft_UI_Xaml!DirectUI::FrameworkApplicationFactory::Start+0x108
0000007166bae690 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : Microsoft_WinUI!ABI.Microsoft.UI.Xaml.IApplicationStaticsMethods.Start+0x145

Steps to reproduce the bug

1. Run our Xelion app
2. Use it .... and wait for it...
3. Crash

Expected behavior

No crashes...

Screenshots

No response

NuGet package version

WinUI 3 - Windows App SDK 1.6.1: 1.6.240923002

Windows version

All Window versions (Windows 10 and 11)

[github-actions]

Hi I'm an AI powered bot that finds similar issues based off the issue title.

Please view the issues below to see if they solve your problem, and if the issue describes your problem please consider closing this one. Thank you!

Open similar issues:

• Reentrancy crash destroying a TextBox due to its ShutdownTextServices() call (#9070), similarity score: 0.83
• Unable to launch application when published in store (#8577), similarity score: 0.82

Closed similar issues:

• Using touch with WinUI3 crashes the app (#8145), similarity score: 0.83
• Bug: Random app crash mentions AnimatedIcon, which I'm not directly using anywhere (#6625), similarity score: 0.83
• Stowed 8007007E (0xc000027b) on some systems upon instantiating Microsoft.UI.Xaml.Window (#8446), similarity score: 0.81

Note: You can give me feedback by thumbs upping or thumbs downing this comment.

[wbokkers]

This happens on all supported Windows versions.

[karkarl]

Please upload stand-alone repro.

[wbokkers]

@karkarl It happens on unexpected times, when our clients use our Xelion app. We have about 52k users and we get many crash reports, but all I have are crash dump. All crash dumps show the same stack.
Should I send you a crash dump?

On Windows App SDK 1.5.7 our users see no crashes.

[wbokkers]

@karkarl It looks like that this method does not return a valid return value:

Microsoft_UI_Input!InputSiteHwndWinRT::PeekKeyboardMessageTime_Callback

This is the reported failure that makes it 'failing fast':
Microsoft_UI_Input!wil::details::ReportFailure_NoReturn

[karkarl]

A crash dump works, though a standalone repo will be best to debug.

[Lightczx]

It seems happens when closing a window, and if the window has a webview2 control in it's content tree it happens more often.

[wbokkers]

@karkarl How can I send a crash dump?

[wbokkers]

@karkarl I really want this to be solved. We depend on a stable SDK. How can I send a crash dump?

[wbokkers]

@karkarl I put a dump in my share point https://xelionnl-my.sharepoint.com/:f:/g/personal/wim_bokkers_xelion_com/Ek_Esn3fnotKpSqDq7krVTUBS1X__1_BKJ3b9vlybE4Snw?e=b46D7O

[codendone]

It looks like this is already being tracked internally as this internal bug. I've notified the owner of that bug.

[wbokkers]

@codendone Thank you!