Using touch with WinUI3 crashes the app

[wbokkers]

Describe the bug

When using touch in the app, the app crashes.
It seems to happen when using other Window instances.

The crash happens in this method: Microsoft_ui_xaml!CInputServices::UnregisterCrossSlideViewport+73

This method tries to read from address 0000

EXCEPTION_RECORD:  (.exr -1)
ExceptionAddress: 00007ff828416b17 (Microsoft_ui_xaml!CInputServices::UnregisterCrossSlideViewport+0x0000000000000073)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000001
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 0000000000000000
Attempt to read from address 0000000000000000

Here's the stack:

Microsoft_ui_xaml!CInputServices::UnregisterCrossSlideViewport+0x73
Microsoft_ui_xaml!CInputServices::UnRegisterDMViewportsOnPointerUp+0x1463c8
Microsoft_ui_xaml!CInputServices::CleanPointerProcessingState+0x190
Microsoft_ui_xaml!ContentRootInput::PointerInputProcessor::ProcessPointerInput+0x67c
Microsoft_ui_xaml!CInputServices::ProcessInput+0xbd
Microsoft_ui_xaml!CXcpBrowserHost::HandleInputMessage+0x159
Microsoft_ui_xaml!CJupiterControl::HandlePointerMessage+0xd6
Microsoft_ui_xaml!CJupiterWindow::OnIslandPointerMessage+0xc5
Microsoft_ui_xaml!CXamlIslandRoot::InjectPointerMessage+0xd6
Microsoft_ui_xaml!Microsoft::WRL::Details::DelegateArgTraits<long (__cdecl ABI::Windows::Foundation::ITypedEventHandler_impl<ABI::Windows::Foundation::Internal::AggregateType<ABI::Microsoft::UI::Input::InputPointerSource *,ABI::Microsoft::UI::Input::IInputPointerSource *>,ABI::Windows::Foundation::Internal::AggregateType<ABI::Microsoft::UI::Input::PointerEventArgs *,ABI::Microsoft::UI::Input::IPointerEventArgs *> >::*)(ABI::Microsoft::UI::Input::IInputPointerSource *,ABI::Microsoft::UI::Input::IPointerEventArgs *)>::DelegateInvokeHelper<Microsoft::WRL::Implements<Microsoft::WRL::RuntimeClassFlags<2>,ABI::Windows::Foundation::ITypedEventHandler<ABI::Microsoft::UI::Input::InputPointerSource *,ABI::Microsoft::UI::Input::PointerEventArgs *>,Microsoft::WRL::FtmBase>,`CXamlIslandRoot::SubscribeToInputPointerSourceEvents'::`43'::<lambda_6> &,1,ABI::Microsoft::UI::Input::IInputPointerSource *,ABI::Microsoft::UI::Input::IPointerEventArgs *>::Invoke+0x56
Microsoft_UI_Input!Microsoft::WRL::Details::DelegateArgTraits<long (__cdecl Windows::Foundation::ITypedEventHandler_impl<Windows::Foundation::Internal::AggregateType<Microsoft::UI::Input::InputPointerSource *,Microsoft::UI::Input::IInputPointerSource *>,Windows::Foundation::Internal::AggregateType<Microsoft::UI::Input::PointerEventArgs *,Microsoft::UI::Input::IPointerEventArgs *> >::*)(Microsoft::UI::Input::IInputPointerSource *,Microsoft::UI::Input::IPointerEventArgs *)>::DelegateInvokeHelper<Microsoft::WRL::Implements<Microsoft::WRL::RuntimeClassFlags<2>,Windows::Foundation::ITypedEventHandler<Microsoft::UI::Input::InputPointerSource *,Microsoft::UI::Input::PointerEventArgs *>,Microsoft::WRL::FtmBase>,`Microsoft::WRL::Details::CreateAgileHelper<Windows::Foundation::ITypedEventHandler<Microsoft::UI::Input::InputPointerSource *,Microsoft::UI::Input::PointerEventArgs *> >'::`2'::<lambda_1>,-1,Microsoft::UI::Input::IInputPointerSource *,Microsoft::UI::Input::IPointerEventArgs *>::Invoke+0x85
Microsoft_UI_Input!Microsoft::WRL::InvokeTraits<-2>::InvokeDelegates<`Microsoft::WRL::EventSource<Windows::Foundation::ITypedEventHandler<Microsoft::UI::Input::InputPointerSource *,Microsoft::UI::Input::PointerEventArgs *>,Microsoft::WRL::InvokeModeOptions<-2> >::InvokeAll<PointerInputObserverWinRT::Api *,Microsoft::UI::Input::IPointerEventArgs *>'::`2'::<lambda_1>,Windows::Foundation::ITypedEventHandler<Microsoft::UI::Input::InputPointerSource *,Microsoft::UI::Input::PointerEventArgs *> >+0x8a
Microsoft_UI_Input!Microsoft::WRL::EventSource<Windows::Foundation::ITypedEventHandler<Microsoft::UI::Input::InputPointerSource * __ptr64,Microsoft::UI::Input::PointerEventArgs * __ptr64>,Microsoft::WRL::InvokeModeOptions<-2> >::DoInvoke<`Microsoft::WRL::EventSource<Windows::Foundation::ITypedEventHandler<Microsoft::UI::Input::InputPointerSource * __ptr64,Microsoft::UI::Input::PointerEventArgs * __ptr64>,Microsoft::WRL::InvokeModeOptions<-2> >::InvokeAll<PointerInputObserverWinRT::Api * __ptr64,Microsoft::UI::Input::IPointerEventArgs * __ptr64>'::`2'::<lambda_1> >+0x7d
Microsoft_UI_Input!Microsoft::WRL::EventSource<Windows::Foundation::ITypedEventHandler<Microsoft::UI::Input::InputPointerSource * __ptr64,Microsoft::UI::Input::PointerEventArgs * __ptr64>,Microsoft::WRL::InvokeModeOptions<-2> >::InvokeAll<PointerInputObserverWinRT::Api * __ptr64,Microsoft::UI::Input::IPointerEventArgs * __ptr64>+0x28
Microsoft_UI_Input!`PointerInputObserverWinRT::InvokeEventDirectlyHelper_Callback'::`9'::<lambda_2>::operator()+0x49d
Microsoft_UI_Input!Microsoft::WRL2::ContextSession::LeaveSession_Callback<`PointerInputObserverWinRT::InvokeEventDirectlyHelper_Callback'::`9'::<lambda_2> >+0x92
Microsoft_UI_Input!PointerInputObserverWinRT::InvokeEventDirectlyHelper_Callback+0x24f
Microsoft_UI_Input!PointerInputObserverWinRT::DeliverInputMessage+0x6bc
Microsoft_UI_Input!IIndependentInputTargetPrincipal_Receive<BamoImpl::BamoIndependentInputTargetPrincipalImpl>::Thunk_DeliverInputMessage_17+0xed
CoreMessagingXP!CoreUICallReceive+0xa7
Microsoft_UI_Input!BamoImpl::BamoIndependentInputTargetPrincipalImpl::OnMessage+0x3f
Microsoft_UI_Input!Microsoft::BamoImpl::ConnectionIndirector::OnItemMessage+0xf3
CoreMessagingXP!CFlat::SehSafe::Execute<<lambda_de6cc8128f8f9f99144226758963eeb9> >+0x5c
CoreMessagingXP!Microsoft::CoreUI::ICallbackMessageConversationHost::Interface$::ImportDispatcher::OnItemMessage+0xb5
CoreMessagingXP!Microsoft::CoreUI::ICallbackMessageConversationHost::OnItemMessage<CFlat::InterfacePtr<Microsoft::CoreUI::ICallbackMessageConversationHost> >+0x6a
CoreMessagingXP!Microsoft::CoreUI::Conversations::Conversation::Callback_OnItemMessage+0x1a6
CoreMessagingXP!Microsoft::CoreUI::Conversations::ItemMessageDispatcher::Callback_OnMessageCore+0x36
CoreMessagingXP!Microsoft::CoreUI::Messaging::MessageEndpoint::Callback_OnMessage+0x84
CoreMessagingXP!Microsoft::CoreUI::Messaging::MessageSession::Callback_DeliverMessage+0x271
CoreMessagingXP!Microsoft::CoreUI::Messaging::MessageSession::Callback_DeliverMessageBatch+0x11f
CoreMessagingXP!Microsoft::CoreUI::Messaging::InterconnectMessageAdapter::InterfaceImplementation$::_Cn_Threading_IInterconnectBufferHandler::Dispatcher::Callback_ReceiveBuffer+0xf6
CoreMessagingXP!Cn::Threading::InterconnectQueue::Callback_ProcessNextItem+0x1df
CoreMessagingXP!Microsoft::CoreUI::Messaging::InterconnectMessageAdapter::Callback_OnReceive+0x4c
CoreMessagingXP!Microsoft::CoreUI::Dispatch::OffThreadReceiver::Callback_OnDispatch+0x2ac
CoreMessagingXP!Microsoft::CoreUI::Dispatch::Dispatcher::Callback_DispatchNextItem+0x1e4
CoreMessagingXP!Microsoft::CoreUI::Dispatch::Dispatcher::Callback_DispatchLoop+0x180
CoreMessagingXP!Microsoft::CoreUI::Dispatch::EventLoop::Callback_RunCoreLoop+0x16b
CoreMessagingXP!Microsoft::CoreUI::Dispatch::UserAdapter::DrainCoreMessagingQueue+0x138
CoreMessagingXP!Microsoft::CoreUI::Dispatch::UserAdapter::OnUserDispatch+0xaf
CoreMessagingXP!Microsoft::CoreUI::Dispatch::UserAdapter::OnUserDispatchRaw+0x80
CoreMessagingXP!Microsoft::CoreUI::Dispatch::UserAdapter::DoWork+0x59
CoreMessagingXP!Microsoft::CoreUI::Dispatch::UserAdapter::HandleDispatchNotifyMessage+0x13e
CoreMessagingXP!Microsoft::CoreUI::Dispatch::UserAdapter::WindowProc+0x73
user32!UserCallWinProcCheckWow+0x2d1
user32!DispatchClientMessage+0x9c
user32!_fnDWORD+0x3d

Steps to reproduce the bug

1. Run our WinUI3 app
2. Mouse input works flawless
3. Try to use touch (opening windows, closing windows, minimize/maximize windows)
4. Crash

Expected behavior

No crash

Screenshots

No response

NuGet package version

WinUI 3 - Windows App SDK 1.2.3: 1.2.230118.102

Windows version

Windows 11 (22H2): Build 22621

Additional context

No response

[wbokkers]

The context:

CONTEXT:  (.ecxr)
rax=0000000000000000 rbx=000000eaac19be70 rcx=0000000000000000
rdx=000002ecd59a8010 rsi=0000000000000000 rdi=000000eaac19b980
rip=00007ff820736b17 rsp=000000eaac19c0b0 rbp=000002ecb8bb8450
 r8=000000eaac19c0d0  r9=000002ecd00da520 r10=0000000000000000
r11=000000eaac19c080 r12=000002ecc9ad3be0 r13=000002ecdb0e7890
r14=000002ecb8bb8450 r15=00000000000001ca
iopl=0         nv up ei pl zr na po nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010244
Microsoft_ui_xaml!CInputServices::UnregisterCrossSlideViewport+0x73:
00007ff8`20736b17 488b01          mov     rax,qword ptr [rcx] ds:00000000`00000000=????????????????
Resetting default scope

[techjogger]

Simultaneous Mouse and multi-touch input crashes Apps too

microsoft/WindowsAppSDK#3257

[ranjeshj]

@wbokkers can you provide more details ? your steps say run your app, but no details on what that app is. If you can share a small repro, that would be helpful. Touch on WinUI3 gallery seems to be working fine.