InfiniteCanvas Heap Corruption

[vborovikov]

Describe the bug

A normal work with InfiniteCanvas control causes a heap corruption exception.

0xC0000374: A heap has been corrupted

Steps to Reproduce

Steps to reproduce the behavior:

1. Install Windows Community toolkit Sample App
2. Open InfiniteCanvas page
3. Draw some ink with default settings
4. Scroll and zoom the canvas

The app will crash. Same will happen when using the control outside the sample app.

Expected behavior

The app/control should continue to work.

Screenshots

If applicable, add screenshots to help explain your problem.

Environment

NuGet Package(s): 

Package Version(s): 

Windows 10 Build Number:
- [ ] Fall Creators Update (16299)
- [ ] April 2018 Update (17134)
- [ ] October 2018 Update (17763)
- [ x] May 2019 Update (18362)
- [ ] Insider Build (build number: )

App min and target version:
- [ ] Fall Creators Update (16299)
- [ ] April 2018 Update (17134)
- [ ] October 2018 Update (17763)
- [ ] May 2019 Update (18362)
- [ ] Insider Build (xxxxx)

Device form factor:
- [ x] Desktop
- [ ] Xbox
- [ ] Surface Hub
- [ ] IoT

Visual Studio 
- [ ] 2017 (version: )
- [ x] 2019 (version: ) 
- [ ] 2019 Preview (version: )

Additional context

Event Log entry

Faulting application name: Microsoft.Toolkit.Uwp.SampleApp.exe, version: 0.0.0.0, time stamp: 0x5dca712c
Faulting module name: ntdll.dll, version: 10.0.18362.719, time stamp: 0x64d10ee0
Exception code: 0xc0000374
Fault offset: 0x00000000000f92a9
Faulting process id: 0x120
Faulting application start time: 0x01d5ff960bcc9fc4
Faulting application path: C:\Program Files\WindowsApps\Microsoft.UWPCommunityToolkitSampleApp_6.0.0.0_x64__8wekyb3d8bbwe\Microsoft.Toolkit.Uwp.SampleApp.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: c77fa18c-e1a7-4d57-b140-d62a8b462f4a
Faulting package full name: Microsoft.UWPCommunityToolkitSampleApp_6.0.0.0_x64__8wekyb3d8bbwe
Faulting package-relative application ID: App

Sample call stack

ntdll.dll!RtlReportCriticalFailure()   Unknown
ntdll.dll!RtlpHeapHandleError()    Unknown
ntdll.dll!RtlpHpHeapHandleError()  Unknown
ntdll.dll!RtlpLogHeapFailure() Unknown
ntdll.dll!RtlpHpLfhSubsegmentFreeBlock()    Unknown
ntdll.dll!RtlpFreeHeapInternal()    Unknown
ntdll.dll!RtlpHpFreeWithExceptionProtection()  Unknown
ntdll.dll!RtlFreeHeap() Unknown
msvcrt.dll!free()  Unknown
Windows.UI.Input.Inking.dll!std::_Tree<std::_Tmap_traits<Windows::UI::Input::Inking::IInkRenderableStroke *,SurfaceBaseRender<SurfaceDefaultRender>::StrokeInfo,std::less<Windows::UI::Input::Inking::IInkRenderableStroke *>,std::allocator<std::pair<Windows::UI::Input::Inking::IInkRenderableStroke * const,SurfaceBaseRender<SurfaceDefaultRender>::StrokeInfo>>,0>>::erase(std::_Tree_const_iterator<std::_Tree_val<std::_Tree_simple_types<std::pair<Windows::UI::Input::Inking::IInkRenderableStroke * const,SurfaceBaseRender<SurfaceDefaultRender>::StrokeInfo>>>> _Where) Line 1500  C++
Windows.UI.Input.Inking.dll!std::_Tree<std::_Tmap_traits<Windows::UI::Input::Inking::IInkRenderableStroke *,SurfaceBaseRender<SurfaceDefaultRender>::StrokeInfo,std::less<Windows::UI::Input::Inking::IInkRenderableStroke *>,std::allocator<std::pair<Windows::UI::Input::Inking::IInkRenderableStroke * const,SurfaceBaseRender<SurfaceDefaultRender>::StrokeInfo>>,0>>::erase(std::_Tree_const_iterator<std::_Tree_val<std::_Tree_simple_types<std::pair<Windows::UI::Input::Inking::IInkRenderableStroke * const,SurfaceBaseRender<SurfaceDefaultRender>::StrokeInfo>>>> _First, std::_Tree_const_iterator<std::_Tree_val<std::_Tree_simple_types<std::pair<Windows::UI::Input::Inking::IInkRenderableStroke * const,SurfaceBaseRender<SurfaceDefaultRender>::StrokeInfo>>>> _Last) Line 1517   C++
Windows.UI.Input.Inking.dll!std::_Tree<std::_Tmap_traits<Windows::UI::Input::Inking::IInkRenderableStroke *,SurfaceBaseRender<SurfaceDefaultRender>::StrokeInfo,std::less<Windows::UI::Input::Inking::IInkRenderableStroke *>,std::allocator<std::pair<Windows::UI::Input::Inking::IInkRenderableStroke * const,SurfaceBaseRender<SurfaceDefaultRender>::StrokeInfo>>,0>>::erase(Windows::UI::Input::Inking::IInkRenderableStroke * const & _Keyval) Line 1530  C++
Windows.UI.Input.Inking.dll!SurfaceBaseRender<SurfaceDefaultRender>::OnStrokeModified(Windows::UI::Input::Inking::IInkRenderableStroke * stroke, Windows::UI::Input::Inking::RenderableStrokeChange change) Line 127    C++
[Inline Frame] Windows.UI.Input.Inking.dll!Microsoft::WRL::Callback::__l2::<lambda_1e0ee65a6e77c55bcc6e8804ffe2811b>::operator()(Windows::UI::Input::Inking::Core::ICoreIncrementalInkStroke * &&) Line 335 C++
Windows.UI.Input.Inking.dll!Microsoft::WRL::Details::DelegateArgTraits<long (__cdecl Windows::Foundation::ITypedEventHandler_impl<Windows::Foundation::Internal::AggregateType<Windows::UI::Input::Inking::Core::CoreIncrementalInkStroke *,Windows::UI::Input::Inking::Core::ICoreIncrementalInkStroke *>,IInspectable *>::*)(Windows::UI::Input::Inking::Core::ICoreIncrementalInkStroke *,IInspectable *)>::DelegateInvokeHelper<Windows::Foundation::ITypedEventHandler<Windows::UI::Input::Inking::Core::CoreIncrementalInkStroke *,IInspectable *>,<lambda_1e0ee65a6e77c55bcc6e8804ffe2811b>,-1,Windows::UI::Input::Inking::Core::ICoreIncrementalInkStroke *,IInspectable *>::Invoke(Windows::UI::Input::Inking::Core::ICoreIncrementalInkStroke * <args_0>, IInspectable * <args_1>) Line 245   C++
[Inline Frame] Windows.UI.Input.Inking.dll!Microsoft::WRL::EventSource<Windows::Foundation::ITypedEventHandler<Windows::UI::Input::Inking::IInkRenderableStroke *,enum Windows::UI::Input::Inking::RenderableStrokeChange>,Microsoft::WRL::InvokeModeOptions<-2>>::InvokeAll::__l2::<lambda_d630d8126d99d760408ed52fc0792ed8>::operator()(Microsoft::WRL::ComPtr<IUnknown> &) Line 820  C++
Windows.UI.Input.Inking.dll!Microsoft::WRL::InvokeTraits<-2>::InvokeDelegates<<lambda_d630d8126d99d760408ed52fc0792ed8>,Windows::Foundation::ITypedEventHandler<Windows::UI::Input::Inking::IInkRenderableStroke *,enum Windows::UI::Input::Inking::RenderableStrokeChange>>(Microsoft::WRL::EventSource<Windows::Foundation::ITypedEventHandler<Windows::UI::Input::Inking::IInkRenderableStroke *,enum Windows::UI::Input::Inking::RenderableStrokeChange>,Microsoft::WRL::InvokeModeOptions<-2>>::InvokeAll::__l2::<lambda_d630d8126d99d760408ed52fc0792ed8> invokeOne, Microsoft::WRL::Details::EventTargetArray * targetArray, Microsoft::WRL::EventSource<Windows::Foundation::ITypedEventHandler<Windows::UI::Input::Inking::IInkRenderableStroke *,enum Windows::UI::Input::Inking::RenderableStrokeChange>,Microsoft::WRL::InvokeModeOptions<-2>> * pEvent) Line 119   C++
[Inline Frame] Windows.UI.Input.Inking.dll!Microsoft::WRL::EventSource<Windows::Foundation::ITypedEventHandler<Windows::UI::Input::Inking::IInkRenderableStroke *,enum Windows::UI::Input::Inking::RenderableStrokeChange>,Microsoft::WRL::InvokeModeOptions<-2>>::DoInvoke(Microsoft::WRL::EventSource<Windows::Foundation::ITypedEventHandler<Windows::UI::Input::Inking::IInkRenderableStroke *,enum Windows::UI::Input::Inking::RenderableStrokeChange>,Microsoft::WRL::InvokeModeOptions<-2>>::InvokeAll::__l2::<lambda_d630d8126d99d760408ed52fc0792ed8>) Line 810    C++
[Inline Frame] Windows.UI.Input.Inking.dll!Microsoft::WRL::EventSource<Windows::Foundation::ITypedEventHandler<Windows::UI::Input::Inking::IInkRenderableStroke *,enum Windows::UI::Input::Inking::RenderableStrokeChange>,Microsoft::WRL::InvokeModeOptions<-2>>::InvokeAll(Windows::UI::Input::Inking::CInkStroke * <args_0>, Windows::UI::Input::Inking::RenderableStrokeChange <args_1>) Line 820   C++
Windows.UI.Input.Inking.dll!Windows::UI::Input::Inking::CInkStroke::RaiseStrokeModifiedEvent(Windows::UI::Input::Inking::RenderableStrokeChange value) Line 2596    C++
[Inline Frame] Windows.UI.Input.Inking.dll!Windows::UI::Input::Inking::CInkStroke::{dtor}() Line 72 C++
Windows.UI.Input.Inking.dll!Windows::UI::Input::Inking::CInkStroke::`scalar deleting destructor'(unsigned int)  C++
Windows.UI.Input.Inking.dll!Microsoft::WRL::Details::RuntimeClassImpl<Microsoft::WRL::RuntimeClassFlags<3>,1,1,0,Windows::UI::Input::Inking::IInkStroke,Windows::UI::Input::Inking::IInkStroke2,Windows::UI::Input::Inking::IInkStroke3,Windows::UI::Input::Inking::IInkRenderableStroke,Windows::UI::Input::Internal::Inking::IInkStrokeInternal,IAgileObject,Microsoft::WRL::FtmBase>::Release() Line 2010    C++
kernel32.dll!BaseThreadInitThunk() Unknown
ntdll.dll!RtlUserThreadStart() Unknown

Hello vborovikov, thank you for opening an issue with us!

I have automatically added a "needs triage" label to help get things started. Our team will analyze and investigate the issue, and escalate it to the relevant team if possible. Other community members may also look into the issue and provide feedback 🙌

[Kyaa-dost]

@vborovikov I am not able to reproduce this based on the steps mentioned above. Can you please screen record this so we can see the process you are following?

[vborovikov]

Recorded the steps using Steps Recorder app. The record was stopped when the app has crashed.

wintk_crash.zip

[Kyaa-dost]

@vborovikov I am not seeing anything in this zip folder. It seems to be a list of empty screenshots.

[vborovikov]

https://youtu.be/xJI1g_u_50A

Notice in the end the ink gets blurry, it's the moment the app crashes.

[Kyaa-dost]

Thanks for showing the error @vborovikov. @deanchalk will you be able to look into this?

[deanchalk]

I have created a pull request #3228
I couldnt recreate the heap corruption issue, but I did manage to crash the app consistently using the pan/zoom features. The PR isnt an ideal fix, but it seems to be the best we can do with the current implementation. of the control.
Let me know what you think

[Kyaa-dost]

Thanks @deanchalk will check it out.

@vborovikov what do you think?