Bug 47560 - Mono always passes IUnknown interface when marshaling an array of COM-callable wrappers
Summary: Mono always passes IUnknown interface when marshaling an array of COM-callabl...
Alias: None
Product: Runtime
Classification: Mono
Component: Interop ()
Version: 4.6.0 (C8)
Hardware: PC Linux
: --- normal
Target Milestone: ---
Assignee: Bugzilla
Depends on:
Reported: 2016-11-21 09:50 UTC by daspits
Modified: 2017-08-09 12:24 UTC (History)
4 users (show)

Is this bug a regression?: ---
Last known good build:

Notice (2018-05-24): bugzilla.xamarin.com is now in read-only mode.

Please join us on Visual Studio Developer Community and in the Xamarin and Mono organizations on GitHub to continue tracking issues. Bugzilla will remain available for reference in read-only mode. We will continue to work on open Bugzilla bugs, copy them to the new locations as needed for follow-up, and add the new items under Related Links.

Our sincere thanks to everyone who has contributed on this bug tracker over the years. Thanks also for your understanding as we make these adjustments and improvements for the future.

Please create a new report on GitHub or Developer Community with your current version information, steps to reproduce, and relevant error messages or log files if you are hitting an issue that looks similar to this resolved bug and you do not yet see a matching new report.

Related Links:

Description daspits 2016-11-21 09:50:09 UTC
When an array of COM-callable wrappers (CCW) are marshaled, the IUnknown interface of the objects is always passed instead of the COM interface specified in the method signature. When the native code expects to receive a pointer to the correct interface. A crash will occur if it tries to call a method on the interface. The code that causes this problem is in the "mono_array_to_lparray" function in the "marshal.c" file. The "mono_array_to_lparray" function incorrectly calls the "ves_icall_System_Runtime_InteropServices_Marshal_GetIUnknownForObjectInternal" function on the CCW irrespective of the type of the array elements. The correct behavior would be to get the COM interface of the object  that corresponds to the element type.

In addition, when the array is freed in the "mono_free_lparray" function, the CCWs are incorrectly freed, which can cause a crash if the CCWs are used later in the program. The CCWs should only be freed when they are garbage-collected and finalized.
Comment 1 eb1 2017-08-07 17:34:01 UTC
https://github.com/mono/mono/pull/4379 contains a suggested fix.
Comment 2 Alexander Köplinger [MSFT] 2017-08-09 12:24:43 UTC
the fix was merged, thank you!