[Problem/Bug]: Program crashes when calling host object

[thqby]

What happened?

The program crashed when an array was passed into the parameter to call the host object and return the parameter.

Importance

Blocking. My app's basic functions are not working due to this issue.

Runtime Channel

Stable release (WebView2 Runtime)

Runtime Version

131.0.2903.112

SDK Version

1.0.2903.40

Framework

Win32

Operating System

Windows 11

OS Version

No response

Repro steps

Create CoreWebView2 on the host side, add the host object fn through AddHostObjectToScript, and the object will return the passed-in parameters as they are, then OpenDevToolsWindow, run the code on the console.

This is a simple ahk implementation.

; https://github.com/thqby/ahk2_lib
#Include <WebView2\WebView2>
g := Gui()
g.Show('w800 h600')
wvc := WebView2.create(g.Hwnd)
cwv := wvc.CoreWebView2
cwv.AddHostObjectToScript('fn', v => v)
cwv.OpenDevToolsWindow()

await chrome.webview.hostObjects.fn(123) // 123
await chrome.webview.hostObjects.fn('abc') // 'abc'
await chrome.webview.hostObjects.fn({a:1,b:2}) // {a:1,b:2}
await chrome.webview.hostObjects.fn({a:[12,34]}) // {a:[12,34]}
await chrome.webview.hostObjects.fn(Promise.resolve(0)) // {}, the return value is different from the incoming value.
await chrome.webview.hostObjects.fn(new Map()) // {}, the return value is different from the incoming value.
await chrome.webview.hostObjects.fn([12,34]]) // [null,null], after a few seconds, the program crashed.

Repros in Edge Browser

No, issue does not reproduce in the corresponding Edge version

Regression

Don't know

Last working version (if regression)

No response

[mhdshameel]

Facing similar issue with the same runtime 131.0.2903.112.
Raised it here #5014

[vbryh-msft]

@thqby I think we have not considered host object to be a function. How do you write this in win32 or .net to get the repro cwv.AddHostObjectToScript('fn', v => v) ?

[thqby]

This is an IDispatch in win32.

interface ICallable : IDispatch {
	[id(DISPID_VALUE)] HRESULT Call([in] VARIANT Param, [out, retval] VARIANT* Value);
};

class Callable : public Microsoft::WRL::RuntimeClass<Microsoft::WRL::RuntimeClassFlags<Microsoft::WRL::ClassicCom>, IDispatch>
{
public:
	STDMETHODIMP GetTypeInfoCount(UINT *pctinfo) override {
		*pctinfo = 0;
		return S_OK;
	}

	STDMETHODIMP GetTypeInfo(UINT iTInfo, LCID lcid, ITypeInfo **ppTInfo) override {
		*ppTInfo = NULL;
		return E_NOTIMPL;
	}

	STDMETHODIMP GetIDsOfNames(REFIID riid, LPOLESTR *rgszNames, UINT cNames, LCID lcid, DISPID *rgDispId) override {
		if (cNames != 1)
			return DISP_E_MEMBERNOTFOUND;
		rgDispId[0] = DISPID_VALUE;
		return S_OK;
	}

	STDMETHODIMP Invoke(DISPID dispIdMember, REFIID riid, LCID lcid, WORD wFlags, DISPPARAMS *pDispParams,
		VARIANT *pVarResult, EXCEPINFO *pExcepInfo, UINT *puArgErr) override {
		if (pDispParams->cArgs != 1)
			return DISP_E_BADPARAMCOUNT;
		ULONG ref;
		*pVarResult = pDispParams->rgvarg[0];
		if (pVarResult->vt == VT_DISPATCH || pVarResult->vt == VT_UNKNOWN)
			ref = pVarResult->punkVal->AddRef();
		return S_OK;
	}
};

The array is passed to the host in the form of SafeArray, and the host can't return the original SafeArray to webview2? Must create a new one?