wpf: Crash 'Unable to cast object of type 'System.__ComObject' to type 'ITfThreadMgr'.'

.NET Core Version: 3.1
Windows version: (Windows 10 Pro 19043.1645)
Does the bug reproduce also in WPF for .NET Framework 4.8?: Unknow
Is this bug related specifically to tooling in Visual Studio (e.g. XAML Designer, Code editing, etc…)? No.
Security issues and bugs should be reported privately, learn more via our responsible disclosure guidelines.

Problem description: Unknown cause. 1.We used WebView2 (1.3.153.51) in our project, We are using WebView2 when the crash happens. I’m not sure if it has anything to do with this. 2.Is it possible that the problem is caused by the Chinese input ?

Actual behavior:

App crash at Dispatcher.GetMessagePump()

It looks like the ‘threadManager’ value is of the wrong type?

Expected behavior:

Minimal repro:

About this issue

Original URL
State: open
Created 2 years ago
Reactions: 1
Comments: 33 (22 by maintainers)

Most upvoted comments

According to the Windows SDK, ITfThreadMgr2 does not implement ITfThreadMgr (They do not share the same vtbl). It seems that even though ITfThreadMgr2 does not implement ITfThreadMgr, you can call QueryInterface with ITfThreadMgr2 on a ITfThreadMgr pointer. So if the pointer returned by TF_CreateThreadMgr is ITfThreadMgr2 it could cause this type of exception. I don’t know if this is the case here because it would be very weird since TF_CreateThreadMgr returns ITfThreadMgr according to the SDK. I’m not setup to try it since it looks like it requires specific input but if anyone can try to cast everything to ITfThreadMgr2 before using the instance of the COM object it would be great.

ThomasGoulet73 on Jun 23, 2022

@jim-jiang-github Do you mean call the CoInitialize twice without call the UnCoInitialize?

Yes. Alternatively, you can reproduce this issue by making multiple calls to CoInitialize in the code.

jim-jiang-github on May 7, 2023

Hi, Is here any improvement i start getting similar crashes after we make redesign of our app.

CurrentDomainOnUnhandledException The application is terminating.:Exception message:Unable to cast object of type 'System.__ComObject' to type 'ITfThreadMgr'. Exception stackTrace: at System.StubHelpers.StubHelpers.GetCOMIPFromRCW(Object objSrc, IntPtr pCPCMD, IntPtr& ppTarget, Boolean& pfNeedsRelease) at MS.Win32.UnsafeNativeMethods.ITfThreadMgr.Deactivate() at System.Windows.Input.TextServicesContext.Uninitialize(Boolean appDomainShutdown) at System.Windows.Input.TextServicesContext.TextServicesContextShutDownListener.OnShutDown(Object target, Object sender, EventArgs e) at MS.Internal.ShutDownListener.HandleShutDown(Object sender, EventArgs e) at System.EventHandler.Invoke(Object sender, EventArgs e) at System.Windows.Threading.Dispatcher.ShutdownImplInSecurityContext(Object state) at MS.Internal.CulturePreservingExecutionContext.CallbackWrapper(Object obj) at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx) at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx) at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state) at MS.Internal.CulturePreservingExecutionContext.Run(CulturePreservingExecutionContext executionContext, ContextCallback callback, Object state) at System.Windows.Threading.Dispatcher.ShutdownImpl() at System.Windows.Threading.Dispatcher.PushFrameImpl(DispatcherFrame frame) at System.Windows.Threading.Dispatcher.PushFrame(DispatcherFrame frame) at System.Windows.Application.RunDispatcher(Object ignore) at System.Windows.Application.RunInternal(Window window) at System.Windows.Application.Run(Window window) at MsaBrowserWPF.App.Main()

And

   CurrentOnDispatcherUnhandledException :Exception message:Error HRESULT E_FAIL has been returned from a call to a COM component.
Exception stackTrace:   at MS.Win32.UnsafeNativeMethods.ITfDocumentMgr.Pop(PopFlags flags)
   at System.Windows.Documents.TextServicesHost.OnUnregisterTextStore(Object arg)
   at System.Windows.Threading.ExceptionWrapper.InternalRealCall(Delegate callback, Object args, Int32 numArgs)
   at System.Windows.Threading.ExceptionWrapper.TryCatchWhen(Object source, Delegate callback, Object args, Int32 numArgs, Delegate catchHandler)

According to previuse version off application i have made update of WPF Material Design.

Norc89 on Apr 4, 2023

I found another crash error info here.

And stack: at System.StubHelpers.StubHelpers.GetCOMIPFromRCW(Object objSrc, IntPtr pCPCMD, IntPtr& ppTarget, Boolean& pfNeedsRelease) at MS.Win32.UnsafeNativeMethods.ITextStoreACPSink.OnLayoutChange(TsLayoutCode lcode, Int32 viewCookie) at System.Windows.Documents.TextStore.OnLayoutUpdated() at System.Windows.Documents.TextEditor.OnTextViewUpdatedWorker(Object o) at System.Windows.Threading.ExceptionWrapper.InternalRealCall(Delegate callback, Object args, Int32 numArgs) at System.Windows.Threading.ExceptionWrapper.TryCatchWhen(Object source, Delegate callback, Object args, Int32 numArgs, Delegate catchHandler) at System.Windows.Threading.DispatcherOperation.InvokeImpl() at MS.Internal.CulturePreservingExecutionContext.CallbackWrapper(Object obj) at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state) — End of stack trace from previous location — at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at MS.Internal.CulturePreservingExecutionContext.Run(CulturePreservingExecutionContext executionContext, ContextCallback callback, Object state) at System.Windows.Threading.DispatcherOperation.Invoke() at System.Windows.Threading.Dispatcher.ProcessQueue() at System.Windows.Threading.Dispatcher.WndProcHook(IntPtr hwnd, Int32 msg, IntPtr wParam, IntPtr lParam, Boolean& handled) at MS.Win32.HwndWrapper.WndProc(IntPtr hwnd, Int32 msg, IntPtr wParam, IntPtr lParam, Boolean& handled) at MS.Win32.HwndSubclass.DispatcherCallbackOperation(Object o) at System.Windows.Threading.ExceptionWrapper.InternalRealCall(Delegate callback, Object args, Int32 numArgs) at System.Windows.Threading.ExceptionWrapper.TryCatchWhen(Object source, Delegate callback, Object args, Int32 numArgs, Delegate catchHandler) at System.Windows.Threading.Dispatcher.LegacyInvokeImpl(DispatcherPriority priority, TimeSpan timeout, Delegate method, Object args, Int32 numArgs) at MS.Win32.HwndSubclass.SubclassWndProc(IntPtr hwnd, Int32 msg, IntPtr wParam, IntPtr lParam) at MS.Win32.UnsafeNativeMethods.DispatchMessage(MSG& msg) at System.Windows.Threading.Dispatcher.PushFrameImpl(DispatcherFrame frame) at System.Windows.Threading.Dispatcher.PushFrame(DispatcherFrame frame) at System.Windows.Threading.Dispatcher.Run() at System.Windows.Application.RunDispatcher(Object ignore) at System.Windows.Application.RunInternal(Window window) at System.Windows.Application.Run()

jim-jiang-github on Aug 1, 2022

I find the other call stack break the application

   at System.Environment.FailFast(System.String)
   at MS.Internal.Invariant.FailFast(System.String, System.String)
   at System.Windows.Documents.TextStore.OnUpdateComposition(ITfCompositionView, ITfRange)
   at MS.Win32.UnsafeNativeMethods+ITextStoreACPSink.OnLockGranted(LockFlags)
   at System.Windows.Documents.TextStore.GrantLock()
   at System.Windows.Documents.TextStore.GrantLockWorker(LockFlags)
   at System.Windows.Documents.TextStore.RequestLock(LockFlags, Int32 ByRef)
   at MS.Win32.UnsafeNativeMethods+ITfKeystrokeMgr.TestKeyDown(Int32, Int32, Boolean ByRef)
   at System.Windows.Input.TextServicesContext.Keystroke(Int32, Int32, KeyOp)
   at System.Windows.Input.TextServicesManager.TextServicesKeystroke(System.Windows.Input.TextServicesContext, System.Windows.Input.KeyEventArgs, Boolean)
   at System.Windows.Input.TextServicesManager.PreProcessInput(System.Object, System.Windows.Input.PreProcessInputEventArgs)
   at System.Windows.Input.InputManager.ProcessStagingArea()
   at System.Windows.Input.InputManager.ProcessInput(System.Windows.Input.InputEventArgs)

lindexi on Jul 29, 2022

@lindexi I have only one idea, how can ITfThreadMgr maybe not implemented, and at the same time everything working for the user. Maybe Sogou input implement only ITfThreadMgr2 ? If you can try call TF_CreateThreadMgr and try to convert _ComObject to ITfThreadMgr2 ?

kant2002 on May 20, 2022