Taking a WeakReference to a C# object that inherits a native WinRT object crashes the app.

[jlaanstra]

Describe the bug
WeakReferences to managed objects inheriting native objects causes InvalidCastExceptions and/or access violations.

To Reproduce

1. Open the attached project in VS: WeakRefRepro.zip
2. Click "Click Me" repeatedly.

Expected behavior
No crash/exception.

Version Info
CsWinRT 1.3.5

[manodasanW]

Took a quick look and looks like it is failing to find the managed object:

WinRT_Runtime!WinRT.ComWrappersSupport.GetInspectableInfo+0x52 [D:\a\1\s\src\WinRT.Runtime\ComWrappersSupport.net5.cs @ 71] 
WinRT_Runtime!WinRT.IInspectable.Vftbl.Do_Abi_GetRuntimeClassName+0x36 [D:\a\1\s\src\WinRT.Runtime\IInspectable.cs @ 86] 
WinRT_Runtime!ILStubClass.IL_STUB_PInvoke(IntPtr, IntPtr*)+0x6d
WinRT_Runtime!WinRT.IInspectable.GetRuntimeClassName+0x8d [D:\a\1\s\src\WinRT.Runtime\IInspectable.cs @ 130] 
WinRT_Runtime!WinRT.ComWrappersSupport.GetRuntimeClassForTypeCreation+0x74 [D:\a\1\s\src\WinRT.Runtime\ComWrappersSupport.cs @ 368] 
WinRT_Runtime!WinRT.DefaultComWrappers.CreateObject+0x9b [D:\a\1\s\src\WinRT.Runtime\ComWrappersSupport.net5.cs @ 441] 
WinRT_Runtime!WinRT.DefaultComWrappers.CreateObject+0x48 [D:\a\1\s\src\WinRT.Runtime\ComWrappersSupport.net5.cs @ 470] 
System_Private_CoreLib!System.Runtime.InteropServices.ComWrappers.CallCreateObject+0x74 [/_/src/coreclr/src/System.Private.CoreLib/src/System/Runtime/InteropServices/ComWrappers.cs @ 268] 
coreclr!CallDescrWorkerInternal+0x83 [D:\workspace\_work\1\s\src\coreclr\src\vm\amd64\CallDescrWorkerAMD64.asm @ 100] 
coreclr!DispatchCallSimple+0x80 [D:\workspace\_work\1\s\src\coreclr\src\vm\callhelpers.cpp @ 222] 
coreclr!`anonymous namespace'::CallCreateObject+0x90 [D:\workspace\_work\1\s\src\coreclr\src\vm\interoplibinterface.cpp @ 564] 
coreclr!`anonymous namespace'::TryGetOrCreateObjectForComInstanceInternal+0x316 [D:\workspace\_work\1\s\src\coreclr\src\vm\interoplibinterface.cpp @ 835] 
coreclr!GlobalComWrappersForTrackerSupport::TryGetOrCreateObjectForComInstance+0x1e1 [D:\workspace\_work\1\s\src\coreclr\src\vm\interoplibinterface.cpp @ 1706] 
coreclr!LoadComWeakReferenceTarget+0x53e [D:\workspace\_work\1\s\src\coreclr\src\vm\weakreferencenative.cpp @ 282] 
coreclr!WeakReferenceOfTNative::GetTarget+0xc4b88 [D:\workspace\_work\1\s\src\coreclr\src\vm\weakreferencenative.cpp @ 725] 
System_Private_CoreLib!System.WeakReference<System.__Canon>.TryGetTarget+0xf [/_/src/libraries/System.Private.CoreLib/src/System/WeakReference.T.cs @ 57] 
WeakRefRepro!WeakRefRepro.InstancePerDeviceProviderBase<WeakRefRepro.DerivedClass>.GetInstanceForDevice+0x15c [E:\WeakRefRepro\WeakRefRepro\WeakRefRepro\WeakRefRepro\InstancePerObjectProviderBase.cs @ 32] 
WeakRefRepro!WeakRefRepro.MainWindow.Call+0x84 [E:\WeakRefRepro\WeakRefRepro\WeakRefRepro\WeakRefRepro\MainWindow.xaml.cs @ 41] 
WeakRefRepro!WeakRefRepro.MainWindow.<myButton_Click>d__2.MoveNext+0x4c [E:\WeakRefRepro\WeakRefRepro\WeakRefRepro\WeakRefRepro\MainWindow.xaml.cs @ 36] 

[manodasanW]

Another stack

WeakRefBase!winrt::impl::root_implements<winrt::WeakRefBase::implementation::Class,winrt::WeakRefBase::Class,winrt::WeakRefBase::IClassOverrides,winrt::composable>::QueryInterface+0xc [E:\WeakRefRepro\WeakRefRepro\WeakRefBase\Generated Files\winrt\base.h @ 7236] 
WeakRefBase!winrt::implements<winrt::WeakRefBase::implementation::Class,winrt::WeakRefBase::Class,winrt::WeakRefBase::IClassOverrides,winrt::composable>::QueryInterface+0xc [E:\WeakRefRepro\WeakRefRepro\WeakRefBase\Generated Files\winrt\base.h @ 7849] 
WeakRefBase!winrt::impl::produce_base<winrt::WeakRefBase::implementation::Class,winrt::WeakRefBase::IClass,void>::QueryInterface+0x1a [E:\WeakRefRepro\WeakRefRepro\WeakRefBase\Generated Files\winrt\base.h @ 6924] 
WeakRefBase!winrt::impl::weak_ref<1,1>::Resolve+0x36 [E:\WeakRefRepro\WeakRefRepro\WeakRefBase\Generated Files\winrt\base.h @ 7127] 
coreclr!LoadComWeakReferenceTarget+0x2e1 [D:\workspace\_work\1\s\src\coreclr\src\vm\weakreferencenative.cpp @ 263] 
coreclr!WeakReferenceOfTNative::GetTarget+0xc4b88 [D:\workspace\_work\1\s\src\coreclr\src\vm\weakreferencenative.cpp @ 725] 
System_Private_CoreLib!System.WeakReference<System.__Canon>.TryGetTarget+0xf [/_/src/libraries/System.Private.CoreLib/src/System/WeakReference.T.cs @ 57] 
WeakRefRepro!WeakRefRepro.InstancePerDeviceProviderBase<WeakRefRepro.DerivedClass>.GetInstanceForDevice+0x152 [E:\WeakRefRepro\WeakRefRepro\WeakRefRepro\WeakRefRepro\InstancePerObjectProviderBase.cs @ 32] 
WeakRefRepro!WeakRefRepro.MainWindow.Call+0x70 [E:\WeakRefRepro\WeakRefRepro\WeakRefRepro\WeakRefRepro\MainWindow.xaml.cs @ 41] 

[AaronRobinsonMSFT]

@manodasanW This appears to be a .NET bug. @jkoritzinsky will be looking into a fix. We chatted offline and I believe we understand the problem—it is limited to aggregation scenarios where the native base type implements IWeakReferenceSource.

[jlaanstra]

@jkoritzinsky is there a .NET build I can use to verify this is fixed?

[jkoritzinsky]

There's not a build available of the whole sdk, but this link should provide you with a .NET 7 nightly runtime build with the fix: https://dotnetcli.azureedge.net/dotnet/Runtime/7.0.0-alpha.1.21558.2/dotnet-runtime-7.0.0-alpha.1.21558.2-win-x64.exe