Hi guys,

I've spent quite a bit of time tracking down a crash. I've tracked it down to attempting to apply an animation value on a destroyed dependency object.

I've created a reproducible sample that I've attached as a ZIP to this bug report.

So what has happened?

1. In TimeManager::Tick it collates together all the animation values that it needs to apply to all dependency objects this frame. This is stored in a local HashMap on the stack which contains non-ref counted pointers
2. It then iterates through each AnimationValue and call DependencyObject::SetAnimation passing in the new value.
3. This invoked dependency property changed events.
4. If user code binds to this (e.g. the IsVisibleChanged event) we can run code which ultimately removes all references to dependency object and removes it
5. This can end up freeing the dependency objects that are currently stored as raw addresses in the stack that was created in step 1.
6. When it attempts to apply the animation value on the now deleted object it crashes.

So just to clarify, it's this bit of code in TimeManager::Tick which is broken:

// Update properties
AnimationValues animationValues;
for (Targets::Bucket& b: mTargets)
{
    DependencyObject* target = b.key;
    const AnimatedProperties& properties = b.value.animatedProperties;

    EvaluateTarget(target, properties, animationValues, finishedClocks);
}

// Now that we are out of the targets loop, we can safely apply the new animation values
ApplyAnimationValues(animationValues);

So if dependency objects that currently reside in the animationValues map are removed during ApplyAnimationValues it can crash. In my case this was caused by changing the Content from a DependencyPropertyChangedEvent which cleared out the ContentTemplate which destroyed the DependencyObjects created by that DataTemplate. Since this happened instantly, it ended up invalidating the AnimationValue map which had already taken a raw pointer to the DependencyObjects.

I've fixed this locally by adding all targets in the AnimationValue map to the "aliveTargets" vector:

for (Targets::Bucket& b: mTargets)
{
    DependencyObject* target = b.key;
    const AnimatedProperties& properties = b.value.animatedProperties;

    EvaluateTarget(target, properties, animationValues, finishedClocks);

    // Keep this target alive as it could be invalidated in ApplyAnimationValues
    aliveTargets.EmplaceBack().Reset(target); // [Sumo SPH 2022-03-31] - Keep these animation targets alive!
}

I'm not sure if this is the best fix, but I've not been able to crash it after this change.

Cheers!