ListView crashes on scrolling with many items of different lengths

[chausner]

Describe the bug

My window is defined as:

<Grid>
    <Grid.Resources>
        <DataTemplate x:Key="EntryDataTemplate" x:DataType="local:Entry">
            <TextBlock Text="{x:Bind WordClasses}" />                    
        </DataTemplate>
    </Grid.Resources>
        
    <ListView ItemsSource="{x:Bind ViewModel.Entries}" ItemTemplate="{StaticResource EntryDataTemplate}" />
</Grid>

with the following code-behind:

public class ViewModel
{
    public IReadOnlyList<Entry> Entries { get; }

    public ViewModel()
    {
        var entries = new List<Entry>();

        for (int i = 0; i < 200000; i++)
            entries.Add(new Entry());

        Entries = entries;
    }
}

public class Entry
{
    public string WordClasses
    {
        get
        {
            if (Random.Shared.Next(20) == 0)
            {
                return "aaaaaaaaa";
            }
            else
                return "b";
        }
    }
}

The initial loading of the window succeeds but when scrolling the list view, the app crashes with an access violation. A sample stack trace is:

Microsoft.UI.Input.dll!winrt::impl::consume_Microsoft_UI_Dispatching_IDispatcherQueue2<struct winrt::Microsoft::UI::Dispatching::DispatcherQueue>::HasThreadAccess(void)	Unbekannt
Microsoft.UI.Input.dll!winrt::Microsoft::UI::Input::implementation::PointerPoint::abi_enter(void)	Unbekannt
Microsoft.UI.Input.dll!winrt::impl::produce<struct winrt::Microsoft::UI::Input::implementation::PointerPoint,struct winrt::Microsoft::UI::Input::IPointerPoint>::GetTransformedPoint(void *,void * *)	Unbekannt
Microsoft.ui.xaml.dll!DirectUI::PointerRoutedEventArgs::GetCurrentPointImpl()	Unbekannt
Microsoft.ui.xaml.dll!DirectUI::PointerRoutedEventArgsGenerated::GetCurrentPoint()	Unbekannt
Microsoft.ui.xaml.dll!DirectUI::RepeatButton::ShouldIgnoreInput(struct ABI::Microsoft::UI::Xaml::Input::IPointerRoutedEventArgs *,unsigned char *)	Unbekannt
Microsoft.ui.xaml.dll!DirectUI::RepeatButton::OnPointerExited(struct ABI::Microsoft::UI::Xaml::Input::IPointerRoutedEventArgs *)	Unbekannt
Microsoft.ui.xaml.dll!DirectUI::ControlGenerated::OnPointerExitedProtected()	Unbekannt
Microsoft.ui.xaml.dll!DirectUI::Control::FireEvent()	Unbekannt
Microsoft.ui.xaml.dll!DirectUI::DXamlCore::FireEvent()	Unbekannt
Microsoft.ui.xaml.dll!CCoreServices::CLR_FireEvent()	Unbekannt
Microsoft.ui.xaml.dll!CommonBrowserHost::CLR_FireEvent()	Unbekannt
Microsoft.ui.xaml.dll!CControlBase::ScriptCallback()	Unbekannt
Microsoft.ui.xaml.dll!CXcpDispatcher::OnWindowMessage()	Unbekannt
Microsoft.ui.xaml.dll!CDeferredInvoke::DispatchQueuedMessage()	Unbekannt
Microsoft.ui.xaml.dll!Microsoft::WRL::Details::DelegateArgTraits<long (__stdcall ABI::Windows::Foundation::ITypedEventHandler_impl<ABI::Windows::Foundation::Internal::AggregateType<ABI::Microsoft::UI::Dispatching::DispatcherQueueTimer *,ABI::Microsoft::UI::Dispatching::IDispatcherQueueTimer *>,IInspectable *>::*)(ABI::Microsoft::UI::Dispatching::IDispatcherQueueTimer *,IInspectable *)>::DelegateInvokeHelper<Microsoft::WRL::Implements<Microsoft::WRL::RuntimeClassFlags<2>,ABI::Windows::Foundation::ITypedEventHandler<ABI::Microsoft::UI::Dispatching::DispatcherQueueTimer *,IInspectable *>,Microsoft::WRL::FtmBase>,<lambda_75d8d10b6d6fea9c509efa8d2232ea42> &,1,ABI::Microsoft::UI::Dispatching::IDispatcherQueueTimer *,IInspectable *>::Invoke()	Unbekannt
CoreMessagingXP.dll!Microsoft::WRL::Details::DelegateArgTraits<long ( Windows::Foundation::ITypedEventHandler_impl<struct Windows::Foundation::Internal::AggregateType<class Microsoft::UI::Dispatching::DispatcherQueueTimer *,struct Microsoft::UI::Dispatching::IDispatcherQueueTimer *>,struct IInspectable *>::*)(struct Microsoft::UI::Dispatching::IDispatcherQueueTimer *,struct IInspectable *)>::DelegateInvokeHelper<struct Microsoft::WRL::Implements<struct Microsoft::WRL::RuntimeClassFlags<2>,struct Windows::Foundation::ITypedEventHandler<class Microsoft::UI::Dispatching::DispatcherQueueTimer *,struct IInspectable *>,class Microsoft::WRL::FtmBase>,class <lambda_1b1a5b0dce93060c2ffe10d1d311f882>,-1,struct Microsoft::UI::Dispatching::IDispatcherQueueTimer *,struct IInspectable *>::Invoke(struct Microsoft::UI::Dispatching::IDispatcherQueueTimer *,struct IInspectable *)	Unbekannt
CoreMessagingXP.dll!Microsoft::WRL::InvokeTraits<-2>::InvokeDelegates<class <lambda_2ad0659dc62ecd7334c0ef0269e3265b>,struct Windows::Foundation::ITypedEventHandler<class Microsoft::UI::Dispatching::DispatcherQueue *,struct IInspectable *> >(class <lambda_2ad0659dc62ecd7334c0ef0269e3265b>,class Microsoft::WRL::Details::EventTargetArray *,class Microsoft::WRL::EventSource<struct Windows::Foundation::ITypedEventHandler<class Microsoft::UI::Dispatching::DispatcherQueue *,struct IInspectable *>,struct Microsoft::WRL::InvokeModeOptions<-2> > *)	Unbekannt
CoreMessagingXP.dll!Microsoft::WRL::EventSource<struct Windows::Foundation::ITypedEventHandler<class Microsoft::UI::Dispatching::DispatcherQueue *,struct IInspectable *>,struct Microsoft::WRL::InvokeModeOptions<-2> >::InvokeAll<class Microsoft::UI::Dispatching::DispatcherQueue *,std::nullptr_t>(class Microsoft::UI::Dispatching::DispatcherQueue *,std::nullptr_t)	Unbekannt
CoreMessagingXP.dll!Microsoft::UI::Dispatching::DispatcherQueueTimer::TimerCallback(void *)	Unbekannt
CoreMessagingXP.dll!CFlat::SehSafe::Execute<<lambda_e16aea3717fc5beac95aa2e513a8f395>>()	Unbekannt
CoreMessagingXP.dll!Microsoft::CoreUI::ActionCallback::ImportAdapter$(class CFlat::Box$1<struct CFlat::FunctionPointerAndUserData$1<long (*)(void *)> > *)	Unbekannt
CoreMessagingXP.dll!Microsoft::CoreUI::Support::ActivationContext::CallbackWithActivationContext(class Microsoft::CoreUI::Dispatch::Timeout *,struct System::UIntPtr)	Unbekannt
CoreMessagingXP.dll!Microsoft::CoreUI::Dispatch::TimeoutManager::Callback_OnDispatch(void)	Unbekannt
CoreMessagingXP.dll!Microsoft::CoreUI::Dispatch::Dispatcher::Callback_DispatchNextItem(class Microsoft::CoreUI::Dispatch::DispatchItem *)	Unbekannt
CoreMessagingXP.dll!Microsoft::CoreUI::Dispatch::Dispatcher::Callback_DispatchLoop(enum Microsoft::CoreUI::Dispatch::RunnablePriorityMask)	Unbekannt
CoreMessagingXP.dll!Microsoft::CoreUI::Dispatch::EventLoop::Callback_RunCoreLoop(enum Microsoft::CoreUI::Dispatch::RunMode)	Unbekannt
CoreMessagingXP.dll!Microsoft::CoreUI::Dispatch::UserAdapter::DrainCoreMessagingQueue(enum Microsoft::CoreUI::Dispatch::UserAdapter$UserPriority,bool,struct CFlat::Ref<struct System::IntPtr>)	Unbekannt
CoreMessagingXP.dll!Microsoft::CoreUI::Dispatch::UserAdapter::OnUserDispatch(bool,enum Microsoft::CoreUI::Dispatch::UserAdapter$UserPriority,struct CFlat::Ref<struct System::IntPtr>)	Unbekannt
CoreMessagingXP.dll!Microsoft::CoreUI::Dispatch::UserAdapter::OnUserDispatchRaw(enum Microsoft::CoreUI::Dispatch::UserAdapter$UserPriority,bool,struct CFlat::Ref<struct System::IntPtr>)	Unbekannt
CoreMessagingXP.dll!Microsoft::CoreUI::Dispatch::UserAdapter::DoWork(struct HWND__ *,enum Microsoft::CoreUI::Dispatch::UserAdapter$UserPriority,bool)	Unbekannt
CoreMessagingXP.dll!Microsoft::CoreUI::Dispatch::UserAdapter::HandleDispatchNotifyMessage(struct HWND__ *,unsigned int,long)	Unbekannt
CoreMessagingXP.dll!Microsoft::CoreUI::Dispatch::UserAdapter::WindowProc(struct HWND__ *,unsigned int,unsigned int,long)	Unbekannt
user32.dll!__InternalCallWinProc@20()	Unbekannt
user32.dll!UserCallWinProcCheckWow(struct _ACTIVATION_CONTEXT *,void *,struct HWND__ *,enum _WM_VALUE,unsigned int,long,void *,int)	Unbekannt
user32.dll!DispatchClientMessage()	Unbekannt
user32.dll!___fnDWORD@4()	Unbekannt
ntdll.dll!_KiUserCallbackDispatcher@12()	Unbekannt
Microsoft.ui.xaml.dll!DirectUI::FrameworkApplication::RunDesktopWindowMessageLoop()	Unbekannt
Microsoft.ui.xaml.dll!DirectUI::FrameworkApplicationFactory::Start()	Unbekannt
[Externer Code]	
[Inlineframe] hostpolicy.dll!coreclr_t::execute_assembly(int) Zeile 89	C++
hostpolicy.dll!run_app_for_context(const hostpolicy_context_t & context, int argc, const wchar_t * * argv) Zeile 255	C++
hostpolicy.dll!run_app(const int argc, const wchar_t * * argv) Zeile 284	C++
hostpolicy.dll!corehost_main(const int argc, const wchar_t * * argv) Zeile 430	C++
hostfxr.dll!execute_app(const std::wstring & impl_dll_dir, corehost_init_t * init, const int argc, const wchar_t * * argv) Zeile 147	C++
hostfxr.dll!`anonymous namespace'::read_config_and_execute(const std::wstring & host_command, const host_startup_info_t & host_info, const std::wstring & app_candidate, const std::unordered_map<enum known_options,std::vector<std::wstring,std::allocator<std::wstring>>,known_options_hash,std::equal_to<enum known_options>,std::allocator<std::pair<enum known_options const ,std::vector<std::wstring,std::allocator<std::wstring>>>>> & opts, int new_argc, const wchar_t * * new_argv, host_mode_t mode, const bool is_sdk_command, wchar_t * out_buffer, int buffer_size, int * required_buffer_size) Zeile 533	C++
hostfxr.dll!fx_muxer_t::handle_exec_host_command(const std::wstring & host_command, const host_startup_info_t & host_info, const std::wstring & app_candidate, const std::unordered_map<enum known_options,std::vector<std::wstring,std::allocator<std::wstring>>,known_options_hash,std::equal_to<enum known_options>,std::allocator<std::pair<enum known_options const ,std::vector<std::wstring,std::allocator<std::wstring>>>>> & opts, int argc, const wchar_t * * argv, int argoff, host_mode_t mode, const bool is_sdk_command, wchar_t * result_buffer, int buffer_size, int * required_buffer_size) Zeile 1018	C++
hostfxr.dll!fx_muxer_t::execute(const std::wstring host_command, const int argc, const wchar_t * * argv, const host_startup_info_t & host_info, wchar_t * result_buffer, int buffer_size, int * required_buffer_size) Zeile 594	C++
hostfxr.dll!hostfxr_main_startupinfo(const int argc, const wchar_t * * argv, const wchar_t * host_path, const wchar_t * dotnet_root, const wchar_t * app_path) Zeile 61	C++
ListViewBug.exe!exe_start(const int argc, const wchar_t * * argv) Zeile 235	C++
ListViewBug.exe!wmain(const int argc, const wchar_t * * argv) Zeile 304	C++

From various experiments, the following points are important:

• the condition Random.Shared.Next(20) == 0 should not happen too often and also not too rarely. 1/20 chance works well for me to reproduce the error.
• the length of the two strings "aaaaaaaaa" and "b" matters. The error does not occur if the first string is less than 9 characters long, or if the second string is of equal length than the first string.

Steps to reproduce the bug

1. Open the sample project in Visual Studio: ListViewBug.zip
2. Build and run the app.
3. Grab the scrollbar and scroll quickly up and down. The crash should occur instantly or within a second or two.

Expected behavior

No response

Screenshots

No response

NuGet package version

No response

Windows app type

• [ ] UWP
• [X] Win32

Device form factor

Desktop

Windows version

Windows Insider Build (xxxxx)

Additional context

I am using Microsoft.WindowsAppSDK 1.1.0.

[wroyca]

I managed to reproduce it. According to my tests, it start crashing when you reach 137 elements. Furthermore, successive scrolling up and down with the scroll bar leaks memory.

Step to reproduce:

• 1. Click on scrollbar
• 2. Scroll down completely
• 3. Release
• 4. Reclick on scrollbar
• 5. Scroll up completely
• 6. Release
• 7. Repeat

[luisaguilarb]

Hi There, I ran into the same problem scrolling down and up in an application I'm building, using ListView with ItemTemplate.

The items within the listview are aprox 81, not that big.

Dev specs. Microsoft.NETCore.App.Ref\6.0.6 microsoft.windows.sdk.net.ref\10.0.19041.25 Microsoft.Windows.SDK.BuildTools 10.0.22000.194 Microsoft.WindowsAppSDK 1.1.0

Microsoft Visual Studio Enterprise 2022 (64-bit) - Current Version 17.2.5

XAML Sample Code that Crashes.

        <StackPanel Grid.Column="2" Orientation="Horizontal"  HorizontalAlignment="Left" VerticalAlignment="Top">

                <ListView ItemsSource="{x:Bind ViewModel.[SourceData],Mode=OneWay}" ScrollViewer.HorizontalScrollMode="Enabled"
                  ScrollViewer.HorizontalScrollBarVisibility="Auto">
                    <ListView.HeaderTemplate>
                        <DataTemplate>
                            <Grid Padding="12" Background="{ThemeResource SystemBaseLowColor}">
                                <Grid.ColumnDefinitions>
                                    <ColumnDefinition Width="Auto"/>
                                </Grid.ColumnDefinitions>
                                <TextBlock Text="[List Name]" FontSize="22" FontWeight="Bold" Style="{ThemeResource CaptionTextBlockStyle}"/>
                            </Grid>
                        </DataTemplate>
                    </ListView.HeaderTemplate>

                    <ListView.ItemTemplate>
                        <DataTemplate x:Name="[DataTemplateName]" x:DataType="localModel:[Model]">
                            <Grid>
                                <Grid.ColumnDefinitions>
                                    <ColumnDefinition Width="*"/>
                                </Grid.ColumnDefinitions>
                            <StackPanel Grid.Column="1" Orientation="Horizontal" Height="64" AutomationProperties.Name="{x:Bind Field1}">
                                <Ellipse x:Name="Ellipse"
                                            Width ="48"
                                            Height="48"
                                            Margin="6"
                                            VerticalAlignment="Center"
                                            HorizontalAlignment="Center"
                                            Fill="SeaGreen"/>
                                <StackPanel Orientation="Vertical" VerticalAlignment="Center" Margin="12,0,0,0">
                                    <StackPanel Orientation="Horizontal">
                                        <TextBlock>
                                            <Span><Bold>NIT:</Bold></Span>
                                        </TextBlock>
                                        <TextBlock Margin="5,0,0,0"  Text="{x:Bind [Field1]}"  Style="{ThemeResource BaseTextBlockStyle}" Foreground="{ThemeResource SystemControlPageTextBaseHighBrush}" />
                                    </StackPanel>
                                    <TextBlock Text="{x:Bind [Field2]}" Style="{ThemeResource BodyTextBlockStyle}" Foreground="{ThemeResource SystemControlPageTextBaseMediumBrush}"/>
                                </StackPanel>
                            </StackPanel>
                            </Grid>
                        </DataTemplate>
                    </ListView.ItemTemplate>
                </ListView>

            </StackPanel>

[lhak]

I see a similar crash when scrolling an image in a scrollviewer. This reproduces with winappsdk 1.1.2 but I cannot trigger it with 1.0.4.

[myblindy]

Even the XAML Gallery sample thing crashes if you scroll the various lists fast enough, I think it’s fair to say the list controls are fundamentally borked up too and including 1.1.2.

[Balkoth]

Seeing the crash too, often times my application does not even get the chance to catch the exception, it just goes away, even when Visual Studio as debugger is attached an all exceptions are enabled.

[dreke1]

Got the same: scroll down slow, no problem. Scroll down fast: application crash.

[lucas861223]

Have this happening too, except my app crashes even when I'm slowly scrolling.

[myblindy]

If those tags mean that it was fixed in 1.1.0, it most definitely wasn't. This is still happening today.

[codendone]

@myblindy The raw version tag indicates the version the bug was introduced in (if known), and in this case the bug was introduced in 1.1. The issue will be fixed in an upcoming servicing release.

[rcohn]

Hello - I'm building a WinUI3 desktop app and have similar crash problem when vertically scrolling a NavigationView. If the height of the NavigationView, or the height of a container (such as StackPanel) is not enough, then I can crash the app while scrolling.

Using WindowsAppSDK 1.0.0, although I don't see this being fixed in later releases. I've tried both enclosing the NavigationView in a ScrollViewer as well as using the NV ScrollViewer property. Same results.

Are there any guidelines or workarounds for this ScrollViewer bug?

Thank you.

[codendone]

Closing as fixed in 1.1.4.