Avalonia

Branch: main

Commit Graph

Author	SHA1	Message	Date
Steven Kirk	0082fc6b2a	Fix UIA selection never reaching the client on Windows (#22151 ) * Add failing tests for SAFEARRAY marshalling of COM providers SafeArrayRef.CreateFromObjects sizes the SAFEARRAY to the pooled buffer it rents rather than to the input, and only fills a slot when the object already has a live COM wrapper. Cover both with tests driven through SafeArrayMarshaller, which is how the UIA interop actually reaches this code. Two of the three tests fail: a two-element input produces a 16-element array of nulls. The string test passes and is the control. Each provider test checks the length before it reads the entries. A wrongly sized array holds slots that were never written, and dereferencing those takes down the test host with an access violation. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RYYMWsTkmkKjptFL88xjAg * Fix ISelectionProvider.GetSelection() never reaching the UIA client SafeArrayRef.CreateFromObjects had two defects, and between them every VT_UNKNOWN SAFEARRAY the automation interop produced was empty. It sized the array to the buffer it rented from ArrayPool rather than to the input, so a one-element selection became a 16-element array. The rented buffer isn't cleared, so stale pointers from an earlier rent could leak in and later be released by SafeArrayDestroy. It also filled a slot only when ComWrappers.TryGetComInstance succeeded. That call resolves a managed object that wraps a native COM instance; for a purely managed object it always fails, so no slot was ever filled and UIA received an array of nulls. Wrappers now come from ComInterfaceMarshaller<T>, which is what the rest of the interop uses. Sharing the instance matters: UI Automation identifies elements by IUnknown pointer, so a wrapper from a second ComWrappers would read as a different element. The element type isn't recoverable from the values, so SafeArrayMarshaller<T> passes it through a new generic TryCreate<T> overload. The object branch of the non-generic TryCreate is gone with it. Nothing reached it: the only other caller is ComVariant.Create, and no property value is an array of providers. This fixes ISelectionProvider.GetSelection() and, by the same route, ITableProvider.GetRowHeaders/GetColumnHeaders, ITableItemProvider, and ITextProvider.GetSelection/GetVisibleRanges. Fixes #22150 Claude-Session: https://claude.ai/code/session_01RYYMWsTkmkKjptFL88xjAg Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2 weeks ago

Author

SHA1

Message

Date

Steven Kirk

0082fc6b2a

Fix UIA selection never reaching the client on Windows (#22151 )

* Add failing tests for SAFEARRAY marshalling of COM providers

SafeArrayRef.CreateFromObjects sizes the SAFEARRAY to the pooled buffer it
rents rather than to the input, and only fills a slot when the object already
has a live COM wrapper. Cover both with tests driven through SafeArrayMarshaller,
which is how the UIA interop actually reaches this code.

Two of the three tests fail: a two-element input produces a 16-element array of
nulls. The string test passes and is the control.

Each provider test checks the length before it reads the entries. A wrongly
sized array holds slots that were never written, and dereferencing those takes
down the test host with an access violation.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RYYMWsTkmkKjptFL88xjAg

* Fix ISelectionProvider.GetSelection() never reaching the UIA client

SafeArrayRef.CreateFromObjects had two defects, and between them every
VT_UNKNOWN SAFEARRAY the automation interop produced was empty.

It sized the array to the buffer it rented from ArrayPool rather than to the
input, so a one-element selection became a 16-element array. The rented buffer
isn't cleared, so stale pointers from an earlier rent could leak in and later be
released by SafeArrayDestroy.

It also filled a slot only when ComWrappers.TryGetComInstance succeeded. That
call resolves a managed object that wraps a native COM instance; for a purely
managed object it always fails, so no slot was ever filled and UIA received an
array of nulls.

Wrappers now come from ComInterfaceMarshaller<T>, which is what the rest of the
interop uses. Sharing the instance matters: UI Automation identifies elements by
IUnknown pointer, so a wrapper from a second ComWrappers would read as a
different element. The element type isn't recoverable from the values, so
SafeArrayMarshaller<T> passes it through a new generic TryCreate<T> overload.

The object branch of the non-generic TryCreate is gone with it. Nothing reached
it: the only other caller is ComVariant.Create, and no property value is an
array of providers.

This fixes ISelectionProvider.GetSelection() and, by the same route,
ITableProvider.GetRowHeaders/GetColumnHeaders, ITableItemProvider, and
ITextProvider.GetSelection/GetVisibleRanges.

Fixes #22150

Claude-Session: https://claude.ai/code/session_01RYYMWsTkmkKjptFL88xjAg
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

2 weeks ago

1 Commits (main)