[SplitButton, WinUI3, MUX 2.8.7, WUX] Crash on destruction of control derived from SplitButton using C++/WinRT projection, minimal repro attached

[eugenegff]

Describe the bug

Crash occurs when control derived from MUXC SplitButton using C++/WinRT projection is placed on some Page, and then this Page is destructed during navigation away to other Page.

Crash was found during porting Live Home 3D from C++/CX to C++/WinRT (WinUI2, MUXC 2.8.7), but happens on WinUI3 too. Minimal repro SplitButtonDerived_CppWinRTCrashOnDestruction_WinUI3.zip has three almost identical WinUI3, WinUI2 C++/WinRT and WinUI2 C++/CX projects with simplest possible SplitButtonDerived, crash happens only in WinUI3 and WinUI2 C++/WinRT, but not in WinUI2 C++/CX

1. no crash if C++/CX was used to implement SplitButtonDerived class - it is C++/WinRT related regression
2. no crash if MUXC::SplitButton is used directly, without deriving from it
3. no crash if MUXC::DropDownButton is used instead of MUXC::SplitButton as base for the derived control - crash is strongly connected to MUXC::SplitButton implementation
4. there is crash if MUXC::ToggleSplitButton is used as base for the derived control
5. there is crash if OS WUXC::[Toggle]SplitButton is used as base for the derived control
6. there is crash if WinUI3::[Toggle]SplitButton is used as base for the derived control
7. SplitButtonDerived can be simplest possible, without extra code or custom style, as in minimal repro - crash will happen

Following callstack is from WinUI2 C++/WinRT project, as I cannot obtain symbols for WinUI3 1.7 Microsoft.UI.Xaml.dll

From preliminar investigation, it seems that core CContentControl tried to release his DXamlPeer == DirectUI::ContentControl, that is part of COM composite object DirectUI::ContentControl + MUXC::SplitButton + CppWinRT::SplitButtonDerived. But something with reference counting went wrong, and outer parts of the composite are destructed (breakpoints placed on SplitButtonDerived::.dtor and SplitButton::.dtor are triggered), but inner part remained alive (DependencyObject::OnFinalRelease() is not called, breakpoint on it is not triggered, and therefore DXamlPeer was not disconnected from core object), and then code in CContentControl used partially destructed COM composite object.

Following breakpoint in DirectUI::DependencyObject::OnFinalRelease() is reached for C++/CX SplitButtonDerived, but is not reached for C++/WinRT SplitButtonDerived, that clearly shows that inner part of DirectUI::ContentControl + MUXC::SplitButton + CppWinRT::SplitButtonDerived composite is not destructed

Steps to reproduce the bug

1. Open minimal repro SplitButtonDerived_CppWinRTCrashOnDestruction_WinUI3.zip, run SplitButtonDerived_CppWinRT or SplitButtonDerived_WinUI3 project, see "C++/WinRT SplitButtonDerived" control
2. Click "Click Me" button to navigate away from MainPage
3. Crash on destruction

Expected behavior

No crash

NuGet package version

WinUI 3 - WindowsAppSDK 1.7
WinUI 2 - Microsoft.UI.Xaml 2.8.7
OS WUXC::SplitButton affected too

Windows version

Windows 11 (24H2): Build 26100

[eugenegff]

Tested on WinUI3 - it is crashed too. Added WinUI3 project to minimal repro.

[vgromfeld]

This issue is still occurring with WinAppSDK 1.8.260209005.
Unloading a custom SplitButton is triggering a double free of the projection smart pointer.
Our mitigation is to manually call AddRef() in the constructor but we're leaking memory.

The issue is only occurring when using C++/winRT. It works without any issue in a C# application.

SpliButtonReferenceCountIssue.zip

It has been closed as "not planned" in #5620.