On drop, drag operation crashes WPF application with FatalExecutionEngineError

• .NET Core Version:

> dotnet --info
.NET SDK (reflecting any global.json):
 Version:   5.0.103
 Commit:    72dec52dbd

Runtime Environment:
 OS Name:     Windows
 OS Version:  10.0.19042
 OS Platform: Windows
 RID:         win10-x64
 Base Path:   C:\Program Files\dotnet\sdk\5.0.103\

Host (useful for support):
  Version: 5.0.3
  Commit:  c636bbdc8a

.NET SDKs installed:
  3.1.406 [C:\Program Files\dotnet\sdk]
  5.0.103 [C:\Program Files\dotnet\sdk]

.NET runtimes installed:
  Microsoft.AspNetCore.All 2.1.25 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.App 2.1.25 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 3.1.12 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 5.0.3 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.NETCore.App 2.1.25 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 3.1.12 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 5.0.3 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.WindowsDesktop.App 3.1.12 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 5.0.3 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

• .NET Framework Version:

> reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full
    CBS    REG_DWORD    0x1
    Install    REG_DWORD    0x1
    InstallPath    REG_SZ    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\
    Release    REG_DWORD    0x80ff4
    Servicing    REG_DWORD    0x0
    TargetVersion    REG_SZ    4.0.0
    Version    REG_SZ    4.8.04084

• Windows version: Windows 10 20H2 19042.804
• Does the bug reproduce also in WPF for .NET Framework 4.8?: Yes
• Is this bug related specifically to tooling in Visual Studio (e.g. XAML Designer, Code editing, etc…)? No

Problem description: Production WPF application targeting v4.7.2 that previously worked without issue began throwing an exception on drop on certain PCs within the last few weeks. Crash is reproducible with a minimal WPF app. Another PC with the same Windows/.NET Framework version does not exhibit the crash.

What have I tried?

• Uninstalled Windows Updates from the past month (KB4601319, KB4601050) but KB4598481 (see screenshot) could not be uninstalled due to no “Uninstall” button presenting itself when clicking on that update.
• 
• Ran .NET Framework Repair Tool.
• Repaired install of VS2019 16.8.5.
• Modified app.config to include <AppContextSwitchOverrides value="Switch.System.Windows.Interop.MouseInput.OptOutOfMoveToChromedWindowFix=true; Switch.System.Windows.Interop.MouseInput.DoNotOptOutOfMoveToChromedWindowFix=true " /> as specified workaround from known issue in KB4601050 (stab in the dark)
• Attempted to restore to an older restore point. Unfortunately this PC has restore points disabled.

Actual behavior:

Managed Debugging Assistant 'FatalExecutionEngineError' : 'The runtime has encountered a fatal error. The address of the error was at 0x745a1bc9, on thread 0x376c. The error code is 0xc0000005. This error may be a bug in the CLR or in the unsafe or non-verifiable portions of user code. Common sources of this bug include user marshaling errors for COM-interop or PInvoke, which may corrupt the stack.'

 	[Managed to Native Transition]	
 	PresentationCore.dll!System.Windows.OleServicesContext.OleDoDragDrop(System.Runtime.InteropServices.ComTypes.IDataObject dataObject, MS.Win32.UnsafeNativeMethods.IOleDropSource dropSource, int allowedEffects, int[] finalEffect)	Unknown
 	PresentationCore.dll!System.Windows.DragDrop.OleDoDragDrop(System.Windows.DependencyObject dragSource, System.Windows.DataObject dataObject, System.Windows.DragDropEffects allowedEffects)	Unknown
 	PresentationCore.dll!System.Windows.DragDrop.DoDragDrop(System.Windows.DependencyObject dragSource, object data, System.Windows.DragDropEffects allowedEffects)	Unknown
>	ItsaDrag.exe!ItsaDrag.MainWindow.TreeViewItem_MouseMove(object sender, System.Windows.Input.MouseEventArgs e) Line 26	C#
 	PresentationCore.dll!System.Windows.Input.MouseEventArgs.InvokeEventHandler(System.Delegate genericHandler, object genericTarget)	Unknown
 	PresentationCore.dll!System.Windows.RoutedEventArgs.InvokeHandler(System.Delegate handler, object target)	Unknown
 	PresentationCore.dll!System.Windows.RoutedEventHandlerInfo.InvokeHandler(object target, System.Windows.RoutedEventArgs routedEventArgs)	Unknown
 	PresentationCore.dll!System.Windows.EventRoute.InvokeHandlersImpl(object source, System.Windows.RoutedEventArgs args, bool reRaised)	Unknown
 	PresentationCore.dll!System.Windows.UIElement.RaiseEventImpl(System.Windows.DependencyObject sender, System.Windows.RoutedEventArgs args)	Unknown
 	PresentationCore.dll!System.Windows.UIElement.RaiseTrustedEvent(System.Windows.RoutedEventArgs args)	Unknown
 	PresentationCore.dll!System.Windows.UIElement.RaiseEvent(System.Windows.RoutedEventArgs args, bool trusted)	Unknown
 	PresentationCore.dll!System.Windows.Input.InputManager.ProcessStagingArea()	Unknown
 	PresentationCore.dll!System.Windows.Input.InputManager.ProcessInput(System.Windows.Input.InputEventArgs input)	Unknown
 	PresentationCore.dll!System.Windows.Input.InputProviderSite.ReportInput(System.Windows.Input.InputReport inputReport)	Unknown
 	PresentationCore.dll!System.Windows.Interop.HwndMouseInputProvider.ReportInput(System.IntPtr hwnd, System.Windows.Input.InputMode mode, int timestamp, System.Windows.Input.RawMouseActions actions, int x, int y, int wheel)	Unknown
 	PresentationCore.dll!System.Windows.Interop.HwndMouseInputProvider.FilterMessage(System.IntPtr hwnd, MS.Internal.Interop.WindowMessage msg, System.IntPtr wParam, System.IntPtr lParam, ref bool handled)	Unknown
 	PresentationCore.dll!System.Windows.Interop.HwndSource.InputFilterMessage(System.IntPtr hwnd, int msg, System.IntPtr wParam, System.IntPtr lParam, ref bool handled)	Unknown
 	WindowsBase.dll!MS.Win32.HwndWrapper.WndProc(System.IntPtr hwnd, int msg, System.IntPtr wParam, System.IntPtr lParam, ref bool handled)	Unknown
 	WindowsBase.dll!MS.Win32.HwndSubclass.DispatcherCallbackOperation(object o)	Unknown
 	WindowsBase.dll!System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate callback, object args, int numArgs)	Unknown
 	WindowsBase.dll!System.Windows.Threading.ExceptionWrapper.TryCatchWhen(object source, System.Delegate callback, object args, int numArgs, System.Delegate catchHandler)	Unknown
 	WindowsBase.dll!System.Windows.Threading.Dispatcher.LegacyInvokeImpl(System.Windows.Threading.DispatcherPriority priority, System.TimeSpan timeout, System.Delegate method, object args, int numArgs)	Unknown
 	WindowsBase.dll!MS.Win32.HwndSubclass.SubclassWndProc(System.IntPtr hwnd, int msg, System.IntPtr wParam, System.IntPtr lParam)	Unknown
 	[Native to Managed Transition]	
 	[Managed to Native Transition]	
 	WindowsBase.dll!System.Windows.Threading.Dispatcher.PushFrameImpl(System.Windows.Threading.DispatcherFrame frame)	Unknown
 	WindowsBase.dll!System.Windows.Threading.Dispatcher.PushFrame(System.Windows.Threading.DispatcherFrame frame)	Unknown
 	PresentationFramework.dll!System.Windows.Application.RunDispatcher(object ignore)	Unknown
 	PresentationFramework.dll!System.Windows.Application.RunInternal(System.Windows.Window window)	Unknown
 	PresentationFramework.dll!System.Windows.Application.Run(System.Windows.Window window)	Unknown
 	PresentationFramework.dll!System.Windows.Application.Run()	Unknown
 	ItsaDrag.exe!ItsaDrag.App.Main()	Unknown

Expected behavior: Drag/drop functions without crashing.

Minimal repro: https://github.com/dcwork/ItsaDrag

[SamBent]

The crash occurs deep in CLR native code:

0:000> k
 # ChildEBP RetAddr      
00 00afe600 7464e179     clr!MethodDesc::GetMethodTable_NoLogging [f:\dd\ndp\clr\src\vm\method.hpp @ 3473] 
01 00afe600 745bd076     clr!SigTypeContext::InitTypeContext+0x12 [f:\dd\ndp\clr\src\vm\typectxt.cpp @ 54] 
02 00afe60c 746c44f1     clr!SigTypeContext::SigTypeContext+0x1d [f:\dd\ndp\clr\src\vm\typectxt.h @ 61] 
03 00afe644 746c3f7f     clr!MetaSig::EnsureSigValueTypesLoaded+0x17 [f:\dd\ndp\clr\src\vm\siginfo.cpp @ 5130] 
04 (Inline) --------     clr!ComCallMethodDesc::IsWinRTCtor [f:\dd\ndp\clr\src\vm\comtoclrcall.h @ 230] 
05 00afe8a8 7459f570     clr!ComPreStubWorker+0x28b [f:\dd\ndp\clr\src\vm\comcallablewrapper.cpp @ 527] 
06 00afe8dc 66a70b12     clr!ComCallPreStub+0x19 [f:\dd\ndp\clr\src\vm\i386\asmhelpers.asm @ 2290] 
WARNING: Stack unwind information not available. Following frames may be wrong.
07 00afe964 76120a42     csprnthk!GdiPrintHookGetObject+0x9b42
08 00afe9a4 761208bb     ole32!CPrivDragDrop::PrivDragDrop+0x172 [com\ole32\com\rot\getif.cxx @ 740] 
09 00afe9f4 760e7b84     ole32!PrivDragDrop+0x130 [com\ole32\com\rot\getif.cxx @ 920] 
0a 00afea64 760e749f     ole32!CDropTargetAdapter::Drop+0xb1 [com\ole32\ole232\drag\drag.cpp @ 3353] 
0b 00afea90 760ea83b     ole32!CDragOperation::CompleteDrop+0x58 [com\ole32\ole232\drag\drag.cpp @ 2548] 
0c 00afec1c 68d803f6     ole32!DoDragDrop+0xfb [com\ole32\ole232\drag\drag.cpp @ 3030] 
0d 00afec8c 5132451d     WindowsBase_ni!DomainBoundILStubClass.IL_STUB_PInvoke(System.Runtime.InteropServices.ComTypes.IDataObject, IOleDropSource, Int32, Int32[])+0xa2
0e 00afecbc 513243b6     PresentationCore_ni!System.Windows.OleServicesContext.OleDoDragDrop(System.Runtime.InteropServices.ComTypes.IDataObject, IOleDropSource, Int32, Int32[])+0x75 [f:\dd\wpf\src\Core\CSharp\System\Windows\OleServicesContext.cs @ 212] 

This is way outside WPF area, but call at frame 07 looks suspicious to me. It looks like a 3rd-party app has injected itself into your message queue, and is messing things up. The arguments to clr!ComCallPreStub look totally bogus, leading eventually to reference to unknown memory. Perhaps the difference between your good and bad machines is the presence of “CoSoSys Endpoint Protector”?

0:000> lmv mcsprnthk*
Browse full module list
start    end        module name
66a60000 66ab2000   csprnthk   (export symbols)       csprnthk.dll
    Loaded symbol image file: csprnthk.dll
    Image path: C:\Program Files\CoSoSys\Endpoint Protector\i386\csprnthk.dll
    Image name: csprnthk.dll
    Browse all global symbols  functions  data
    Timestamp:        Tue Dec 22 02:57:15 2020 (5FE1D10B)
    CheckSum:         00054778
    ImageSize:        00052000
    File version:     5.3.6.6
    Product version:  5.3.6.6
    File flags:       0 (Mask 3F)
    File OS:          4 Unknown Win32
    File type:        1.0 App
    File date:        00000000.00000000
    Translations:     0409.04e4
    Information from resource tables:
        CompanyName:      CoSoSys
        ProductName:      Endpoint Protector
        InternalName:     CssGdiPrintHook
        OriginalFilename: csprnthk.dll
        ProductVersion:   5.3.6.6
        FileVersion:      5.3.6.6
        SpecialBuild:     0
        FileDescription:  GDI Print Hook
        LegalCopyright:   © 2006-2020 CoSoSys All rights reserved.

[dcwork]

Thanks again @SamBent. The cause of the issue was indeed CoSoSys Endpoint Protector.