NullReferenceException in PopupSecurityHelper started appearing yesterday (with .NET Core 3.1.24 update?) for hundreds of users so far

• .NET Core Version: 3.1.24.
• Windows version: 10 and 11 so far. 10.0.22598 (Windows 11 Insider Preview).
• Does the bug reproduce also in WPF for .NET Framework 4.8?: Unable to reproduce so far. Just seeing hundreds of bug reports coming in from our users.
• Is this bug related specifically to tooling in Visual Studio (e.g. XAML Designer, Code editing, etc…)? No.

Problem description: Yesterday, April 13, coinciding with a number of Windows updates rolling out (in particular I think .NET Core 3.1.24 is the culprit) we started seeing crashes of our application, Mailbird, coming in from first a few users, but today hundreds.

Stack traces are entirely in .NET code and we’ve released no update to Mailbird in several weeks. Looking at the change log for .NET Core 3.1.24 I see two PR’s that make changes that “fit” the stack traces: https://github.com/dotnet/wpf/pull/6020 and https://github.com/dotnet/wpf/pull/6017.

Actual behavior: Since it’s the Dispatcher, the application crashes. A few of the stack traces we’re seeing (all end the same place):

System.NullReferenceException: Object reference not set to an instance of an object.
  Module "System.Windows.Controls.Primitives.Popup+PopupSecurityHelper", in get_Handle
  Module "System.Windows.Controls.Primitives.Popup+PopupSecurityHelper", in RegisterForTooltipDismissNotification
  Module "System.Windows.Controls.PopupControlService", in CloseToolTip
  Module "System.Windows.Controls.PopupControlService", in OnMouseMove
  Module "System.Windows.Controls.PopupControlService", in OnPostProcessInput
  Module "System.Windows.Input.InputManager", in RaiseProcessInputEventHandlers
  Module "System.Windows.Input.InputManager", in ProcessStagingArea
  Module "System.Windows.Input.InputManager", in ProcessInput
  Module "System.Windows.Input.InputProviderSite", in ReportInput
  Module "System.Windows.Interop.HwndMouseInputProvider", in ReportInput
  Module "System.Windows.Interop.HwndMouseInputProvider", in FilterMessage
  Module "System.Windows.Interop.HwndSource", in InputFilterMessage
  Module "MS.Win32.HwndWrapper", in WndProc
  Module "MS.Win32.HwndSubclass", in DispatcherCallbackOperation
  Module "System.Windows.Threading.ExceptionWrapper", in InternalRealCall
  Module "System.Windows.Threading.ExceptionWrapper", in TryCatchWhen

System.NullReferenceException: Object reference not set to an instance of an object.
  Module "System.Windows.Controls.Primitives.Popup+PopupSecurityHelper", in get_Handle
  Module "System.Windows.Controls.Primitives.Popup+PopupSecurityHelper", in RegisterForTooltipDismissNotification
  Module "System.Windows.Controls.PopupControlService", in CloseToolTip
  Module "System.Windows.Controls.PopupControlService", in OnMouseMove
  Module "System.Windows.Controls.PopupControlService", in OnPostProcessInput
  Module "System.Windows.Input.InputManager", in RaiseProcessInputEventHandlers
  Module "System.Windows.Input.InputManager", in ProcessStagingArea
  Module "System.Windows.Input.InputManager", in ProcessInput
  Module "System.Windows.Input.MouseDevice", in Synchronize
  Module "System.Windows.Input.InputManager", in HitTestInvalidatedAsyncCallback
  Module "System.Windows.Threading.ExceptionWrapper", in InternalRealCall
  Module "System.Windows.Threading.ExceptionWrapper", in TryCatchWhen

System.NullReferenceException: La référence d'objet n'est pas définie à une instance d'un objet.
à System.Windows.Controls.Primitives.Popup.PopupSecurityHelper.get_Handle()
à System.Windows.Controls.Primitives.Popup.PopupSecurityHelper.RegisterForTooltipDismissNotification(UInt32 flag)
à System.Windows.Controls.PopupControlService.CloseToolTip(ToolTip tooltip)
à System.Windows.Controls.PopupControlService.OnPostProcessInput(Object sender, ProcessInputEventArgs e)
à System.Windows.Input.InputManager.RaiseProcessInputEventHandlers(ProcessInputEventHandler postProcessInput, ProcessInputEventArgs processInputEventArgs)
à System.Windows.Input.InputManager.ProcessStagingArea()
à System.Windows.Input.InputManager.ProcessInput(InputEventArgs input)
à System.Windows.Input.MouseDevice.Synchronize()
à System.Windows.Input.MouseDevice.ChangeMouseCapture(IInputElement mouseCapture, IMouseInputProvider providerCapture, CaptureMode captureMode, Int32 timestamp)
à System.Windows.Input.MouseDevice.Capture(IInputElement element, CaptureMode captureMode)
à System.Windows.Controls.Primitives.ButtonBase.OnMouseLeftButtonDown(MouseButtonEventArgs e)
à System.Windows.RoutedEventArgs.InvokeHandler(Delegate handler, Object target)
à System.Windows.RoutedEventHandlerInfo.InvokeHandler(Object target, RoutedEventArgs routedEventArgs)
à System.Windows.EventRoute.InvokeHandlersImpl(Object source, RoutedEventArgs args, Boolean reRaised)
à System.Windows.UIElement.ReRaiseEventAs(DependencyObject sender, RoutedEventArgs args, RoutedEvent newEvent)
à System.Windows.UIElement.OnMouseDownThunk(Object sender, MouseButtonEventArgs e)
à System.Windows.RoutedEventArgs.InvokeHandler(Delegate handler, Object target)
à System.Windows.RoutedEventHandlerInfo.InvokeHandler(Object target, RoutedEventArgs routedEventArgs)
à System.Windows.EventRoute.InvokeHandlersImpl(Object source, RoutedEventArgs args, Boolean reRaised)
à System.Windows.UIElement.RaiseEventImpl(DependencyObject sender, RoutedEventArgs args)
à System.Windows.UIElement.RaiseTrustedEvent(RoutedEventArgs args)
à System.Windows.Input.InputManager.ProcessStagingArea()
à System.Windows.Input.InputManager.ProcessInput(InputEventArgs input)
à System.Windows.Input.InputProviderSite.ReportInput(InputReport inputReport)
à System.Windows.Interop.HwndMouseInputProvider.ReportInput(IntPtr hwnd, InputMode mode, Int32 timestamp, RawMouseActions actions, Int32 x, Int32 y, Int32 wheel)
à System.Windows.Interop.HwndMouseInputProvider.FilterMessage(IntPtr hwnd, WindowMessage msg, IntPtr wParam, IntPtr lParam, Boolean& handled)
à System.Windows.Interop.HwndSource.InputFilterMessage(IntPtr hwnd, Int32 msg, IntPtr wParam, IntPtr lParam, Boolean& handled)
à MS.Win32.HwndWrapper.WndProc(IntPtr hwnd, Int32 msg, IntPtr wParam, IntPtr lParam, Boolean& handled)
à MS.Win32.HwndSubclass.DispatcherCallbackOperation(Object o)
à System.Windows.Threading.ExceptionWrapper.InternalRealCall(Delegate callback, Object args, Int32 numArgs)
à System.Windows.Threading.ExceptionWrapper.TryCatchWhen(Object source, Delegate callback, Object args, Int32 numArgs, Delegate catchHandler)

Expected behavior: No System.NullReferenceException should be thrown.

Minimal repro: As of yet we’ve been unable to reproduce. It seems random in terms of when and where it happens, but looking at the stack traces it seems to happen when tooltips are closed.

[SamBent]

The stack traces all mention the method System.Windows.Controls.Primitives.Popup.PopupSecurityHelper.RegisterForTooltipDismissNotification(UInt32 flag) which doesn’t exist in any version of WPF except for .NET 4.8.1. That hasn’t been released yet, but it is included in previews of the next release of Windows 11. So I suspect all these reports are really about .NET Framework apps running on a Win11 preview OS that includes the buggy version of ,NET 4.8.1. (Note: apps that target 4.7.2, or any other version of .NET Framework, use the installed version of the runtime, and hence would see this bug on machines with 4.8.1.)

The bug has been fixed in 4.8.1, but it takes some time for the fix to flow into the Win11 preview packages.

[pchaurasia14]

Since this is not an issue in 3.1.24 and the bug has already been fixed in 4.8.1, we’re closing this issue. If you experience the issue again, please raise another ticket.