ListView crashes on scrolling with many items of different lengths

Describe the bug

My window is defined as:

<Grid>
    <Grid.Resources>
        <DataTemplate x:Key="EntryDataTemplate" x:DataType="local:Entry">
            <TextBlock Text="{x:Bind WordClasses}" />                    
        </DataTemplate>
    </Grid.Resources>
        
    <ListView ItemsSource="{x:Bind ViewModel.Entries}" ItemTemplate="{StaticResource EntryDataTemplate}" />
</Grid>

with the following code-behind:

public class ViewModel
{
    public IReadOnlyList<Entry> Entries { get; }

    public ViewModel()
    {
        var entries = new List<Entry>();

        for (int i = 0; i < 200000; i++)
            entries.Add(new Entry());

        Entries = entries;
    }
}

public class Entry
{
    public string WordClasses
    {
        get
        {
            if (Random.Shared.Next(20) == 0)
            {
                return "aaaaaaaaa";
            }
            else
                return "b";
        }
    }
}

The initial loading of the window succeeds but when scrolling the list view, the app crashes with an access violation. A sample stack trace is:

Microsoft.UI.Input.dll!winrt::impl::consume_Microsoft_UI_Dispatching_IDispatcherQueue2<struct winrt::Microsoft::UI::Dispatching::DispatcherQueue>::HasThreadAccess(void)	Unbekannt
Microsoft.UI.Input.dll!winrt::Microsoft::UI::Input::implementation::PointerPoint::abi_enter(void)	Unbekannt
Microsoft.UI.Input.dll!winrt::impl::produce<struct winrt::Microsoft::UI::Input::implementation::PointerPoint,struct winrt::Microsoft::UI::Input::IPointerPoint>::GetTransformedPoint(void *,void * *)	Unbekannt
Microsoft.ui.xaml.dll!DirectUI::PointerRoutedEventArgs::GetCurrentPointImpl()	Unbekannt
Microsoft.ui.xaml.dll!DirectUI::PointerRoutedEventArgsGenerated::GetCurrentPoint()	Unbekannt
Microsoft.ui.xaml.dll!DirectUI::RepeatButton::ShouldIgnoreInput(struct ABI::Microsoft::UI::Xaml::Input::IPointerRoutedEventArgs *,unsigned char *)	Unbekannt
Microsoft.ui.xaml.dll!DirectUI::RepeatButton::OnPointerExited(struct ABI::Microsoft::UI::Xaml::Input::IPointerRoutedEventArgs *)	Unbekannt
Microsoft.ui.xaml.dll!DirectUI::ControlGenerated::OnPointerExitedProtected()	Unbekannt
Microsoft.ui.xaml.dll!DirectUI::Control::FireEvent()	Unbekannt
Microsoft.ui.xaml.dll!DirectUI::DXamlCore::FireEvent()	Unbekannt
Microsoft.ui.xaml.dll!CCoreServices::CLR_FireEvent()	Unbekannt
Microsoft.ui.xaml.dll!CommonBrowserHost::CLR_FireEvent()	Unbekannt
Microsoft.ui.xaml.dll!CControlBase::ScriptCallback()	Unbekannt
Microsoft.ui.xaml.dll!CXcpDispatcher::OnWindowMessage()	Unbekannt
Microsoft.ui.xaml.dll!CDeferredInvoke::DispatchQueuedMessage()	Unbekannt
Microsoft.ui.xaml.dll!Microsoft::WRL::Details::DelegateArgTraits<long (__stdcall ABI::Windows::Foundation::ITypedEventHandler_impl<ABI::Windows::Foundation::Internal::AggregateType<ABI::Microsoft::UI::Dispatching::DispatcherQueueTimer *,ABI::Microsoft::UI::Dispatching::IDispatcherQueueTimer *>,IInspectable *>::*)(ABI::Microsoft::UI::Dispatching::IDispatcherQueueTimer *,IInspectable *)>::DelegateInvokeHelper<Microsoft::WRL::Implements<Microsoft::WRL::RuntimeClassFlags<2>,ABI::Windows::Foundation::ITypedEventHandler<ABI::Microsoft::UI::Dispatching::DispatcherQueueTimer *,IInspectable *>,Microsoft::WRL::FtmBase>,<lambda_75d8d10b6d6fea9c509efa8d2232ea42> &,1,ABI::Microsoft::UI::Dispatching::IDispatcherQueueTimer *,IInspectable *>::Invoke()	Unbekannt
CoreMessagingXP.dll!Microsoft::WRL::Details::DelegateArgTraits<long ( Windows::Foundation::ITypedEventHandler_impl<struct Windows::Foundation::Internal::AggregateType<class Microsoft::UI::Dispatching::DispatcherQueueTimer *,struct Microsoft::UI::Dispatching::IDispatcherQueueTimer *>,struct IInspectable *>::*)(struct Microsoft::UI::Dispatching::IDispatcherQueueTimer *,struct IInspectable *)>::DelegateInvokeHelper<struct Microsoft::WRL::Implements<struct Microsoft::WRL::RuntimeClassFlags<2>,struct Windows::Foundation::ITypedEventHandler<class Microsoft::UI::Dispatching::DispatcherQueueTimer *,struct IInspectable *>,class Microsoft::WRL::FtmBase>,class <lambda_1b1a5b0dce93060c2ffe10d1d311f882>,-1,struct Microsoft::UI::Dispatching::IDispatcherQueueTimer *,struct IInspectable *>::Invoke(struct Microsoft::UI::Dispatching::IDispatcherQueueTimer *,struct IInspectable *)	Unbekannt
CoreMessagingXP.dll!Microsoft::WRL::InvokeTraits<-2>::InvokeDelegates<class <lambda_2ad0659dc62ecd7334c0ef0269e3265b>,struct Windows::Foundation::ITypedEventHandler<class Microsoft::UI::Dispatching::DispatcherQueue *,struct IInspectable *> >(class <lambda_2ad0659dc62ecd7334c0ef0269e3265b>,class Microsoft::WRL::Details::EventTargetArray *,class Microsoft::WRL::EventSource<struct Windows::Foundation::ITypedEventHandler<class Microsoft::UI::Dispatching::DispatcherQueue *,struct IInspectable *>,struct Microsoft::WRL::InvokeModeOptions<-2> > *)	Unbekannt
CoreMessagingXP.dll!Microsoft::WRL::EventSource<struct Windows::Foundation::ITypedEventHandler<class Microsoft::UI::Dispatching::DispatcherQueue *,struct IInspectable *>,struct Microsoft::WRL::InvokeModeOptions<-2> >::InvokeAll<class Microsoft::UI::Dispatching::DispatcherQueue *,std::nullptr_t>(class Microsoft::UI::Dispatching::DispatcherQueue *,std::nullptr_t)	Unbekannt
CoreMessagingXP.dll!Microsoft::UI::Dispatching::DispatcherQueueTimer::TimerCallback(void *)	Unbekannt
CoreMessagingXP.dll!CFlat::SehSafe::Execute<<lambda_e16aea3717fc5beac95aa2e513a8f395>>()	Unbekannt
CoreMessagingXP.dll!Microsoft::CoreUI::ActionCallback::ImportAdapter$(class CFlat::Box$1<struct CFlat::FunctionPointerAndUserData$1<long (*)(void *)> > *)	Unbekannt
CoreMessagingXP.dll!Microsoft::CoreUI::Support::ActivationContext::CallbackWithActivationContext(class Microsoft::CoreUI::Dispatch::Timeout *,struct System::UIntPtr)	Unbekannt
CoreMessagingXP.dll!Microsoft::CoreUI::Dispatch::TimeoutManager::Callback_OnDispatch(void)	Unbekannt
CoreMessagingXP.dll!Microsoft::CoreUI::Dispatch::Dispatcher::Callback_DispatchNextItem(class Microsoft::CoreUI::Dispatch::DispatchItem *)	Unbekannt
CoreMessagingXP.dll!Microsoft::CoreUI::Dispatch::Dispatcher::Callback_DispatchLoop(enum Microsoft::CoreUI::Dispatch::RunnablePriorityMask)	Unbekannt
CoreMessagingXP.dll!Microsoft::CoreUI::Dispatch::EventLoop::Callback_RunCoreLoop(enum Microsoft::CoreUI::Dispatch::RunMode)	Unbekannt
CoreMessagingXP.dll!Microsoft::CoreUI::Dispatch::UserAdapter::DrainCoreMessagingQueue(enum Microsoft::CoreUI::Dispatch::UserAdapter$UserPriority,bool,struct CFlat::Ref<struct System::IntPtr>)	Unbekannt
CoreMessagingXP.dll!Microsoft::CoreUI::Dispatch::UserAdapter::OnUserDispatch(bool,enum Microsoft::CoreUI::Dispatch::UserAdapter$UserPriority,struct CFlat::Ref<struct System::IntPtr>)	Unbekannt
CoreMessagingXP.dll!Microsoft::CoreUI::Dispatch::UserAdapter::OnUserDispatchRaw(enum Microsoft::CoreUI::Dispatch::UserAdapter$UserPriority,bool,struct CFlat::Ref<struct System::IntPtr>)	Unbekannt
CoreMessagingXP.dll!Microsoft::CoreUI::Dispatch::UserAdapter::DoWork(struct HWND__ *,enum Microsoft::CoreUI::Dispatch::UserAdapter$UserPriority,bool)	Unbekannt
CoreMessagingXP.dll!Microsoft::CoreUI::Dispatch::UserAdapter::HandleDispatchNotifyMessage(struct HWND__ *,unsigned int,long)	Unbekannt
CoreMessagingXP.dll!Microsoft::CoreUI::Dispatch::UserAdapter::WindowProc(struct HWND__ *,unsigned int,unsigned int,long)	Unbekannt
user32.dll!__InternalCallWinProc@20()	Unbekannt
user32.dll!UserCallWinProcCheckWow(struct _ACTIVATION_CONTEXT *,void *,struct HWND__ *,enum _WM_VALUE,unsigned int,long,void *,int)	Unbekannt
user32.dll!DispatchClientMessage()	Unbekannt
user32.dll!___fnDWORD@4()	Unbekannt
ntdll.dll!_KiUserCallbackDispatcher@12()	Unbekannt
Microsoft.ui.xaml.dll!DirectUI::FrameworkApplication::RunDesktopWindowMessageLoop()	Unbekannt
Microsoft.ui.xaml.dll!DirectUI::FrameworkApplicationFactory::Start()	Unbekannt
[Externer Code]	
[Inlineframe] hostpolicy.dll!coreclr_t::execute_assembly(int) Zeile 89	C++
hostpolicy.dll!run_app_for_context(const hostpolicy_context_t & context, int argc, const wchar_t * * argv) Zeile 255	C++
hostpolicy.dll!run_app(const int argc, const wchar_t * * argv) Zeile 284	C++
hostpolicy.dll!corehost_main(const int argc, const wchar_t * * argv) Zeile 430	C++
hostfxr.dll!execute_app(const std::wstring & impl_dll_dir, corehost_init_t * init, const int argc, const wchar_t * * argv) Zeile 147	C++
hostfxr.dll!`anonymous namespace'::read_config_and_execute(const std::wstring & host_command, const host_startup_info_t & host_info, const std::wstring & app_candidate, const std::unordered_map<enum known_options,std::vector<std::wstring,std::allocator<std::wstring>>,known_options_hash,std::equal_to<enum known_options>,std::allocator<std::pair<enum known_options const ,std::vector<std::wstring,std::allocator<std::wstring>>>>> & opts, int new_argc, const wchar_t * * new_argv, host_mode_t mode, const bool is_sdk_command, wchar_t * out_buffer, int buffer_size, int * required_buffer_size) Zeile 533	C++
hostfxr.dll!fx_muxer_t::handle_exec_host_command(const std::wstring & host_command, const host_startup_info_t & host_info, const std::wstring & app_candidate, const std::unordered_map<enum known_options,std::vector<std::wstring,std::allocator<std::wstring>>,known_options_hash,std::equal_to<enum known_options>,std::allocator<std::pair<enum known_options const ,std::vector<std::wstring,std::allocator<std::wstring>>>>> & opts, int argc, const wchar_t * * argv, int argoff, host_mode_t mode, const bool is_sdk_command, wchar_t * result_buffer, int buffer_size, int * required_buffer_size) Zeile 1018	C++
hostfxr.dll!fx_muxer_t::execute(const std::wstring host_command, const int argc, const wchar_t * * argv, const host_startup_info_t & host_info, wchar_t * result_buffer, int buffer_size, int * required_buffer_size) Zeile 594	C++
hostfxr.dll!hostfxr_main_startupinfo(const int argc, const wchar_t * * argv, const wchar_t * host_path, const wchar_t * dotnet_root, const wchar_t * app_path) Zeile 61	C++
ListViewBug.exe!exe_start(const int argc, const wchar_t * * argv) Zeile 235	C++
ListViewBug.exe!wmain(const int argc, const wchar_t * * argv) Zeile 304	C++

From various experiments, the following points are important:

• the condition Random.Shared.Next(20) == 0 should not happen too often and also not too rarely. 1/20 chance works well for me to reproduce the error.
• the length of the two strings “aaaaaaaaa” and “b” matters. The error does not occur if the first string is less than 9 characters long, or if the second string is of equal length than the first string.

Steps to reproduce the bug

1. Open the sample project in Visual Studio: ListViewBug.zip
2. Build and run the app.
3. Grab the scrollbar and scroll quickly up and down. The crash should occur instantly or within a second or two.

Expected behavior

No response

Screenshots

No response

NuGet package version

No response

Windows app type

• UWP
• Win32

Device form factor

Desktop

Windows version

Windows Insider Build (xxxxx)

Additional context

I am using Microsoft.WindowsAppSDK 1.1.0.

[codendone]

Closing as fixed in 1.1.4.

[myblindy]

Even the XAML Gallery sample thing crashes if you scroll the various lists fast enough, I think it’s fair to say the list controls are fundamentally borked up too and including 1.1.2.