Incorrect handling of nil blocks in Managed Static Registrar

[filipnavara]

We started experimenting with MSR in release builds of our app and we can reproducibly hit this on device when going through a certain UI path:

System.ArgumentNullException: ArgumentNull_Generic Arg_ParamName_Name, delegate
  ?, in Delegate Runtime.ReleaseBlockWhenDelegateIsCollected(IntPtr, Delegate)
  ?, in void __Registrar_Callbacks__.callback_125_Microsoft_Maui_Controls_Platform_ControlsModalWrapper_DismissViewController(IntPtr pobj, IntPtr sel, byte p0, IntPtr p1, IntPtr* exception_gchandle)

The code comes from MAUI:
https://github.com/dotnet/maui/blob/515c8986efefc83a7b21b30f32a8d44dd9748959/src/Controls/src/Core/Platform/iOS/ControlsModalWrapper.cs#L88-L91

		public override void DismissViewController(bool animated, Action? completionHandler)
		{
			base.DismissViewController(animated, completionHandler);
		}

It makes me wonder what happens if DismissViewController is called with completionHandler == null and how would that get marshalled between ObjC and C#.

[filipnavara]

Repro: https://github.com/filipnavara/ios-msr-menu-repro

Click anywhere on the main screen, it opens menu. Dismiss the menu by clicking outside it => crash.

[filipnavara]

Affects both NativeAOT and MonoVM.

[filipnavara]

Presumably the fix is just to flip the order of these two conditions:

xamarin-macios/src/ObjCRuntime/Runtime.cs

Lines 2590 to 2594 in 261a603

	if (@delegate is null)
	ObjCRuntime.ThrowHelper.ThrowArgumentNullException (nameof (@delegate));
	if (block == IntPtr.Zero)
	return @delegate;

The MSR generates this code:

[UnmanagedCallersOnly(EntryPoint = "callback_0_menu_repro_AppDelegate_ViewController_DismissViewController")]
public unsafe static void callback_0_menu_repro_AppDelegate_ViewController_DismissViewController(nint pobj, nint sel, byte p0, nint p1, nint* exception_gchandle)
{
	try
	{
		ViewController nSObject = Runtime.GetNSObject<ViewController>(pobj, sel, (RuntimeMethodHandle)/*OpCode not supported: LdMemberToken*/, true);
		nint num = BlockLiteral.Copy(p1);
		nSObject.DismissViewController(p0 != 0, (Action)Runtime.ReleaseBlockWhenDelegateIsCollected(num, Trampolines.NIDAction.Create(num)));
	}
	catch (Exception ex)
	{
		*exception_gchandle = Runtime.AllocGCHandle(ex);
	}
}

The trampolines were always created with the Create method returning null output for null input:

[UnmanagedCallersOnly(EntryPoint = "callback_0_menu_repro_AppDelegate_ViewController_DismissViewController")]
public unsafe static void callback_0_menu_repro_AppDelegate_ViewController_DismissViewController(nint pobj, nint sel, byte p0, nint p1, nint* exception_gchandle)
{
	try
	{
		ViewController nSObject = Runtime.GetNSObject<ViewController>(pobj, sel, (RuntimeMethodHandle)/*OpCode not supported: LdMemberToken*/, true);
		nint num = BlockLiteral.Copy(p1);
		nSObject.DismissViewController(p0 != 0, (Action)Runtime.ReleaseBlockWhenDelegateIsCollected(num, Trampolines.NIDAction.Create(num)));
	}
	catch (Exception ex)
	{
		*exception_gchandle = Runtime.AllocGCHandle(ex);
	}
}

[filipnavara]

Since this is an absolute blocker for us I created a custom ILLink step to patch the code: https://github.com/emclient/MailClient.Linker

[ivanpovazan]

/cc: @rolfbjarne