{"id":108991,"date":"2023-11-10T07:00:00","date_gmt":"2023-11-10T15:00:00","guid":{"rendered":"https:\/\/devblogs.microsoft.com\/oldnewthing\/?p=108991"},"modified":"2023-11-10T08:42:59","modified_gmt":"2023-11-10T16:42:59","slug":"20231110-00","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20231110-00\/?p=108991","title":{"rendered":"The case of the invalid argument exception from a method that takes no arguments"},"content":{"rendered":"

A customer was getting crashes with the following stack:<\/p>\n

ucrtbase!abort+0x4e                                            <\/span>\r\nucrtbase!terminate+0x29                                        <\/span>\r\nucrtbase!FindHandler<__FrameHandler4>+0x4f4                    <\/span>\r\nucrtbase!__InternalCxxFrameHandler<__FrameHandler4>+0x276      <\/span>\r\nucrtbase!__InternalCxxFrameHandlerWrapper<__FrameHandler4>+0x3e<\/span>\r\nucrtbase!__CxxFrameHandler4+0xa9                               <\/span>\r\ncontoso!__GSHandlerCheck_EH4+0x64                              <\/span>\r\nntdll!RtlpExecuteHandlerForException+0xf                       <\/span>\r\nntdll!RtlDispatchException+0x26c                               <\/span>\r\nntdll!RtlRaiseException+0x195                                  <\/span>\r\nKERNELBASE!RaiseException+0x6c                                 <\/span>\r\nucrtbase!_CxxThrowException+0x9a                               <\/span>\r\ncontoso!winrt::throw_hresult+0xd3                              <\/span>\r\ncontoso!winrt::check_hresult+0xcf                              <\/span>\r\ncontoso!winrt::impl::consume_Microsoft_UI_Xaml_Controls_       <\/span>\r\n        Primitives_IFlyoutBase<winrt::Microsoft::UI::Xaml::    <\/span>\r\n        Controls::Primitives::IFlyoutBase>::Hide+0xe9          <\/span>\r\ncontoso!MyPanel::CancelCurrentFlyout+0x25e                     <\/span>\r\ncontoso!MyPanel::IsReadyForNewContextMenu+0x4b                 <\/span>\r\ncontoso!MyPanel::DoContextMenu+0x1ac                           <\/span>\r\ncontoso!MyPanel::WndProc+0x7f2\r\nuser32!UserCallWinProcCheckWow+0x2ba\r\nuser32!DispatchMessageWorker+0x2b0\r\ncontoso!CMainWindow::Run+0xde\r\ncontoso!wWinMain+0xd69\r\ncontoso!invoke_main+0x21\r\ncontoso!__scrt_common_main_seh+0x110\r\nkernel32!BaseThreadInitThunk+0x1d\r\nntdll!RtlUserThreadStart+0x28\r\n<\/pre>\n
The block of stack frames at the top is the C++ runtime infrastructure throwing an exception and looking for a handler. Eventually, no handler is found, and we end up terminating due to an unhandled exception.<\/p>\n
The next block of stack frames is the code that threw the unhandled exception. From the winrt::throw_hresult<\/code>, we know that this code is written in C++\/WinRT, and the check_hresult<\/code> tells us that we are converting a failure HRESULT<\/code> into an exception. The next frame tells us that this failure HRESULT<\/code> came from a call to IFlyoutBase::Hide<\/code>.<\/p>\n
The name of that frame breaks down like this:<\/p>\n
    \n
  • winrt::impl::<\/code><\/span> C++\/WinRT internal method<\/li>\n
  • consume_<\/code><\/span> Wrapper for client code to call into Windows Runtime component (consuming an interface)<\/li>\n
  • Microsoft_UI_Xaml_Controls_Primitives_IFlyoutBase<\/code><\/span> The interface we called is Microsoft::UI::Xaml::Controls::Primitives::IFlyoutBase<\/code>.<\/li>\n
  • <winrt::Microsoft::UI::Xaml::Controls::Primitives::IFlyoutBase><\/code><\/span> The interface is implemented by an object whose type is winrt::Microsoft::UI::Xaml::Controls::Primitives::IFlyoutBase<\/code>. In this case, we are invoking it directly on the interface, so the interface simply implements itself, and this part looks silly.<\/li>\n
  • Hide<\/code><\/span> is the method being invoked.<\/li>\n<\/ul>\n
    Okay, so our call on the IFlyoutBase::Hide<\/code> method failed with an “invalid parameter” exception. How can a method with no parameters have an invalid parameter?<\/p>\n
    Here’s the call in the Contoso app:<\/p>\n
    void MyPanel::CancelCurrentFlyout()\r\n{\r\n    \/\/ Cancel any pending action.\r\n    if (!m_actionPending)\r\n    {\r\n        InvokeCancel();\r\n    }\r\n\r\n    \/\/ Hide any open flyout.\r\n    if (m_menu &&\r\n        ((m_flyoutState == FlyoutState::Opened) ||\r\n         (m_flyoutState == FlyoutState::Opening)))\r\n    {\r\n        m_menu.Hide(); \/* we failed here *\/\r\n    }\r\n    TransitionFlyoutState(FlyoutState::Closed);\r\n    ResetDataModelAndTasks();\r\n}\r\n<\/pre>\n
    Let’s look more closely at the exception that was thrown. We know that it was an hresult_error<\/code>, so we can just dump it straight away.<\/p>\n
    0:000> .frame b\r\n0b 00000000`0107c670 00007ffa`84e2d24b     ucrtbase!_CxxThrowException+0x9a\r\n0:000> dv\r\npExceptionObject = 0x00000000`0107c700\r\n...\r\n0:000> dps 0x00000000`0107c700 L3\r\n00000000`0107c700  00000000`00000000\r\n00000000`0107c708  80070057`aabbccdd \/\/ There's our ERROR_INVALID_PARAMETER\r\n00000000`0107c710  00000000`2c81b7a8 \/\/ Here's the IErrorInfo\r\n<\/pre>\n
    Although we don’t know the internal layout of the IErrorInfo<\/code>, we can dump it to see if anything jumps out at us.<\/p>\n
    0:000> dc 0x00000000`2c81b7a8\r\n00000000`2c81b7a8  6b70cca8 00007ffa 6b70cb30 00007ffa  ..pk....0.pk....\r\n00000000`2c81b7b8  6b70cad0 00007ffa 6b70ccd0 00007ffa  ..pk......pk....\r\n00000000`2c81b7c8  6b70cb78 00007ffa 6b70cc50 00007ffa  x.pk....P.pk....\r\n00000000`2c81b7d8  6b70cc08 00007ffa 6b70caf8 00007ffa  ..pk......pk....\r\n00000000`2c81b7e8  00000000 00000001 28a6a1a0 00000000  ...........(....\r\n00000000`2c81b7f8  290bc760 00000000 00000000 00000000  `..)............\r\n00000000`2c81b808  80070057 00000000 00000000 00000000  W...............\r\n00000000`2c81b818  00000000 00000000 00010002 00000039  ............9...\r\n00000000`2c81b828  283dbe90 00000000 00000008 00000000  ..=(............\r\n00000000`2c81b838  00000038 53453032<\/span> 80070057 000056dd  8...20ES<\/span>W....V..\r\n00000000`2c81b848  6b4d1bf8 00007ffa 00000008 00000039  ..Mk........9...\r\n00000000`2c81b858  283dbe90 00000000 00000000 00000000  ..=(............\r\n00000000`2c81b868  00000000 00000000 00000000 00000000  ................\r\n00000000`2c81b878  43832534 35316d47 108a28cb 09f94d9d  4%.CGm15.(...M..\r\n00000000`2c81b888  00000000 00000000 2c81ab08 00000000  ...........,....\r\n00000000`2c81b898  00000000 00000000 00000002 00000000  ................\r\n<\/pre>\n
    After a lot of introductory stuff, we recognize the failure HRESULT<\/code> of 0x80070057<\/code>, but more interestingly, the signature value 53453032<\/code> which decodes to the ASCII characters SE02<\/code>, the signature for STOWED_EXCEPTION_INFORMATION_V2<\/code>. There’s a good chance this is a STOWED_EXCEPTION_INFORMATION_V2<\/code> structure. Let’s ask the !pde.dse<\/code> extension to dump it.<\/p>\n
    The !pde.dse<\/code> extension optionally takes a pointer to an array of stowed exception pointers. To dump a single stowed exception, we’ll have to create one of these arrays and ask !pde.dse<\/code> to dump it.<\/p>\n
    0:000> eq @rsp-8 0x00000000`2c81b7a8\r\n0:000> !pde.dse @rsp-8\r\nStowed Exception Array @ 0x00000000035477e8\r\n\r\nStowed Exception #1 @ 0x000000002c81b838\r\n        0x80070057: E_INVALIDARG - One or more arguments are not valid\r\n\r\nStack    : 0x283dbe90\r\n\r\ncombase!RoOriginateErrorW+0x131\r\nMicrosoft_UI_Xaml!DirectUI::ErrorHelper::OriginateError+0x172\r\nMicrosoft_UI_Xaml!DirectUI::ErrorHelper::OriginateError+0x28\r\nMicrosoft_UI_Xaml!DirectUI::VisualTreeHelper::GetOpenPopupsForXamlRoot+0x63\r\ncontoso!<lambda_\u27e6\u2026\u27e7>::operator()+0x3e\r\ncontoso!winrt::\u27e6\u2026\u27e7::VisualTreeHelper::GetOpenPopupsForXamlRoot+0x43\r\ncontoso!<lambda_\u27e6\u2026\u27e7>::operator()+0x7f\r\ncontoso!winrt::impl::delegate<winrt::\u27e6\u2026\u27e7::TypedEventHandler<\r\n    winrt::\u27e6\u2026\u27e7::FlyoutBase,\r\n    winrt::\u27e6\u2026\u27e7::FlyoutBaseClosingEventArgs>,\r\n    <lambda_\u27e6\u2026\u27e7> >::Invoke+0x22\r\nMicrosoft_UI_Xaml!DirectUI::CEventSourceBase<\u27e6\u2026\u27e7>::Raise+0xa0\r\nMicrosoft_UI_Xaml!DirectUI::FlyoutBase::OnClosing+0x7c\r\nMicrosoft_UI_Xaml!DirectUI::FlyoutBase::HideImpl+0x3b\r\nMicrosoft_UI_Xaml!DirectUI::FlyoutBaseGenerated::Hide+0x52\r\ncontoso!MyPanel::CancelCurrentFlyout+0x25e    <\/span>\r\ncontoso!MyPanel::IsReadyForNewContextMenu+0x4b<\/span>\r\ncontoso!MyPanel::DoContextMenu+0x1ac          <\/span>\r\ncontoso!MyPanel::WndProc+0x7f2                <\/span>\r\nuser32!UserCallWinProcCheckWow+0x2ba          <\/span>\r\nuser32!DispatchMessageWorker+0x2b0            <\/span>\r\ncontoso!CMainWindow::Run+0xde                 <\/span>\r\ncontoso!wWinMain+0xd69                        <\/span>\r\ncontoso!invoke_main+0x21                      <\/span>\r\ncontoso!__scrt_common_main_seh+0x110          <\/span>\r\nkernel32!BaseThreadInitThunk+0x1d             <\/span>\r\nntdll!RtlUserThreadStart+0x28                 <\/span>\r\n<\/pre>\n
    Notice that the deeper part of the stack matches our current stack. This is expected because the stowed exception captures the error origination slightly deeper in the stack, so the stuff outside MyPanel::CancelCurrentFlyout<\/code> will still be the same.<\/p>\n
    Note also that the stack trace from the stowed exception doesn’t include inlined functions, because the stack capturing code doesn’t have access to symbols. It just walks the stack frames.<\/p>\n
    So let’s look at the new information we gained from the stowed exception:<\/p>\n
    combase!RoOriginateErrorW+0x131\r\nMicrosoft_UI_Xaml!DirectUI::ErrorHelper::OriginateError+0x172\r\nMicrosoft_UI_Xaml!DirectUI::ErrorHelper::OriginateError+0x28\r\nMicrosoft_UI_Xaml!DirectUI::VisualTreeHelper::GetOpenPopupsForXamlRoot+0x63\r\ncontoso!`winrt::\u27e6\u2026\u27e7::VisualTreeHelper::GetOpenPopupsForXamlRoot`::\r\n    <lambda_1>::operator()+0x3e\r\ncontoso!winrt::\u27e6\u2026\u27e7::VisualTreeHelper::GetOpenPopupsForXamlRoot+0x43\r\ncontoso!`winrt::\u27e6\u2026\u27e7::MenuFlyoutControl::CreateMenu`::<lambda_1>::operator()+0x7f\r\ncontoso!winrt::impl::delegate<winrt::\u27e6\u2026\u27e7::TypedEventHandler<\r\n    winrt::\u27e6\u2026\u27e7::FlyoutBase,\r\n    winrt::\u27e6\u2026\u27e7::FlyoutBaseClosingEventArgs>,\r\n    `winrt::\u27e6\u2026\u27e7::MenuFlyoutControl::CreateMenu`::<lambda_1> >::Invoke+0x22\r\nMicrosoft_UI_Xaml!DirectUI::CEventSourceBase<\u27e6\u2026\u27e7>::Raise+0xa0\r\nMicrosoft_UI_Xaml!DirectUI::FlyoutBase::OnClosing+0x7c\r\nMicrosoft_UI_Xaml!DirectUI::FlyoutBase::HideImpl+0x3b\r\nMicrosoft_UI_Xaml!DirectUI::FlyoutBaseGenerated::Hide+0x52\r\n<\/pre>\n
    Reading from the bottom: Our code called the Hide<\/code> method, which went into HideImpl<\/code>, which called OnClosing<\/code>. Based on the name of the method and the fact that it calls CEventSourceBase::Raise<\/code>, it’s apparent that this code is raising the Closing<\/code> event. The delegate registered for this event is a lambda in Menu\u00adFlyout\u00adControl::Create\u00adMenu<\/code>, and it called Get\u00adOpen\u00adPopups\u00adFor\u00adXaml\u00adRoot<\/code>, which decided to return an “invalid argument” error.<\/p>\n
    Let’s see why.<\/p>\n
    0:000> u 7ffa266ad663-63 7ffa266ad663\r\nDirectUI::VisualTreeHelper::GetOpenPopupsForXamlRoot:\r\n00007ffa`266ad600 mov     qword ptr [rsp+20h],rbx\r\n00007ffa`266ad605 push    rbp\r\n00007ffa`266ad606 push    rsi\r\n00007ffa`266ad607 push    rdi\r\n00007ffa`266ad608 sub     rsp,30h\r\n00007ffa`266ad60c mov     rax,qword ptr [_security_cookie (00007ffa`26bef010)]\r\n00007ffa`266ad613 xor     rax,rsp\r\n00007ffa`266ad616 mov     qword ptr [rsp+28h],rax\r\n00007ffa`266ad61b and     qword ptr [rsp+20h],0\r\n00007ffa`266ad621 mov     rsi,r8\r\n00007ffa`266ad624 mov     rdi,rdx\r\n00007ffa`266ad627 mov     rbp,rcx\r\n00007ffa`266ad62a test    r8,r8\r\n00007ffa`266ad62d jne     00007ffa`266ad64a\r\n00007ffa`266ad62f lea     r8,[`string' (00007ffa`26904470)]\r\n00007ffa`266ad636 mov     ecx,80070057h\r\n00007ffa`266ad63b lea     edx,[rsi+0Bh]\r\n00007ffa`266ad63e call    DirectUI::ErrorHelper::OriginateError\r\n00007ffa`266ad643 mov     ebx,eax\r\n00007ffa`266ad645 jmp     00007ffa`266ad6f3\r\n00007ffa`266ad64a test    rdi,rdi\r\n00007ffa`266ad64d jne     00007ffa`266ad675\r\n00007ffa`266ad64f lea     r8,[`string' (00007ffa`26b663b0)]\r\n00007ffa`266ad656 mov     ecx,80070057h\r\n00007ffa`266ad65b lea     edx,[rdi+8]\r\n00007ffa`266ad65e call    DirectUI::ErrorHelper::OriginateError\r\n00007ffa`266ad663 mov     ebx,eax\r\n<\/pre>\n
    The code that leads up to the error breaks up into three parts:<\/p>\n
    00007ffa`266ad600 mov     qword ptr [rsp+20h],rbx\r\n00007ffa`266ad605 push    rbp\r\n00007ffa`266ad606 push    rsi\r\n00007ffa`266ad607 push    rdi\r\n00007ffa`266ad608 sub     rsp,30h\r\n00007ffa`266ad60c mov     rax,qword ptr [_security_cookie (00007ffa`26bef010)]\r\n00007ffa`266ad613 xor     rax,rsp\r\n00007ffa`266ad616 mov     qword ptr [rsp+28h],rax\r\n00007ffa`266ad61b and     qword ptr [rsp+20h],0\r\n00007ffa`266ad621 mov     rsi,r8\r\n00007ffa`266ad624 mov     rdi,rdx\r\n00007ffa`266ad627 mov     rbp,rcx\r\n<\/pre>\n
    This first section is function prologue stuff and initializing local variables. The inbound parameters are stored in rbp<\/code>, rdi<\/code>, and rsi<\/code>. Therefore we have this so far:<\/p>\n\n\n\n\n\n
    rbp<\/code> = rcx<\/code><\/td>\nthis<\/code><\/td>\n<\/tr>\n
    rdi<\/code> = rdx<\/code><\/td>\nxamlRoot<\/code><\/td>\n<\/tr>\n
    rsi<\/code> = r8<\/code><\/td>\nresult<\/code> (output)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
    Next up is this section:<\/p>\n
    00007ffa`266ad62a test    r8,r8\r\n00007ffa`266ad62d jne     00007ffa`266ad64a\r\n00007ffa`266ad62f lea     r8,[`string' (00007ffa`26904470)]\r\n00007ffa`266ad636 mov     ecx,80070057h\r\n00007ffa`266ad63b lea     edx,[rsi+0Bh]\r\n00007ffa`266ad63e call    DirectUI::ErrorHelper::OriginateError\r\n00007ffa`266ad643 mov     ebx,eax\r\n00007ffa`266ad645 jmp     00007ffa`266ad6f3\r\n<\/pre>\n
    If r8<\/code> is zero, then we return 0x80070057<\/code> = E_INVALIDARG<\/code> with a custom message:<\/p>\n
    0:000> du 00007ffa`26904470\r\n00007ffa`26904470  \"returnValue\"\r\n<\/pre>\n
    Okay, so first we verify that the result parameter (which I guess this function calls returnValue<\/code>) is not null; if it is, we fail with E_INVALIDARG<\/code>.<\/p>\n
    And then we have this:<\/p>\n
    00007ffa`266ad64a test    rdi,rdi\r\n00007ffa`266ad64d jne     00007ffa`266ad675\r\n00007ffa`266ad64f lea     r8,[`string' (00007ffa`26b663b0)]\r\n00007ffa`266ad656 mov     ecx,80070057h\r\n00007ffa`266ad65b lea     edx,[rdi+8]\r\n00007ffa`266ad65e call    DirectUI::ErrorHelper::OriginateError\r\n00007ffa`266ad663 mov     ebx,eax\r\n<\/pre>\n
    This returns E_INVALIDARG<\/code> with a custom message if the rdi<\/code> register is zero, which our table above tells us corresponds to the xamlRoot<\/code> parameter. The error message confirms this:<\/p>\n
    0:000> du 00007ffa`26b663b0\r\n00007ffa`26b663b0  \"xamlRoot\"\r\n<\/pre>\n
    So we got an “invalid argument” error because xamlRoot<\/code> was null. Working backward, we can look at the Closing<\/code> event handler:<\/p>\n
    void MenuFlyoutControl::CreateMenu(const winrt::IIterable& menuItems)\r\n{\r\n    \u27e6\u2026\u27e7\r\n\r\n    m_closingRevoker = flyout.Closing(winrt::auto_revoke,\r\n        [](auto&& sender, auto&&) {\r\n        if (auto flyout = sender.try_as<xaml::CommandBarFlyout>()) {\r\n            auto popups = xaml::VisualTreeHelper::GetOpenPopupsForXamlRoot(flyout.XamlRoot());\r\n            \u27e6\u2026\u27e7\r\n        }\r\n    });\r\n\r\n    \u27e6\u2026\u27e7\r\n}\r\n<\/pre>\n
    We infer therefore that flyout.XamlRoot()<\/code> was null. And that’s what generates the “invalid parameter” exception: Null is not a valid parameter for Get\u00adOpen\u00adPopups\u00adFor\u00adXaml\u00adRoot<\/code>.<\/p>\n
    This invalid parameter error projects as an exception, which causes the Closing<\/code> event handler to fail with an exception, which is then transformed back into E_INVALIDARG<\/code> at the ABI. This error presumably propagates out of the Raise<\/code> method back into OnClosing<\/code> and then to HideImpl<\/code>, and then back to the caller, which causes m_menu.Hide()<\/code> to fail with an invalid argument exception, which is where our crash dump was generated.<\/p>\n
    The customer fixed the problem by revising the Closing<\/code> event handler to skip the call to Get\u00adOpen\u00adPopups\u00adFor\u00adXaml\u00adRoot<\/code> if flyout.XamlRoot()<\/code> is null, and just assume that there are no popups.<\/p>\n
    Bonus viewing<\/b>:  Stowed Exception C000027B<\/a>: A video with the creator of the !pde.dse<\/code> debugger extension. The array of pointers shows up at time code 5:24.<\/p>\n","protected":false},"excerpt":{"rendered":"
    Where did the invalid argument come from?<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[25],"class_list":["post-108991","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-code"],"acf":[],"blog_post_summary":"
    Where did the invalid argument come from?<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/108991","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=108991"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/108991\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=108991"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=108991"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=108991"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}