I'm getting an access violation within my application only on Tablet PCs (several different brands tested).

The access violation occurs within comctl32.dll when the winproc for the regular treectrl receives the message TVM_GETITEMRECT. When the tree tries to fill in the RECT* an exception occurs because the message was sent by another process (pointer to RECT not in the receiver's address space).

The message is being sent by TabTip.exe (the input panel on Tablet PC). This process calls a function in a dll (tipskins) which then appears to be obtaining an accessibility proxy (IAccessible) for the treectrl. It then calls get_accState which eventually calls SendMessage (TVM_GETITEMRECT) to the tree control in my process space. It looks to me that tipskins did not get an accessibility proxy from the right process space (this one is in it's own). I've seen two other posts where users were having the same problem in different applications, and no one has provided any help. If anyone has any ideas, please chime in. (note: I do not use accessibility in my app and do not handle WM_GETOBJECT).

Thanks

Call stacks below:

Process where treectrl exists:

COMCTL32! 7735d616()
COMCTL32! 7736190c()
USER32! 77d43a50()
USER32! 77d43b1f()
USER32! 77d45b2c()
USER32! 77d45b4b()
CWnd::DefWindowProcW(unsigned int 4356, unsigned int 1, long 127991808) line 1000 + 32 bytes
CWnd::WindowProc(unsigned int 4356, unsigned int 1, long 127991808) line 1586 + 26 bytes
AfxCallWndProc(CWnd * 0x01964d8c {CTreeCtrl hWnd=0x000109cc}, HWND__ * 0x000109cc, unsigned int 4356, unsigned int 1, long 127991808) line 215 + 26 bytes
AfxWndProc(HWND__ * 0x000109cc, unsigned int 4356, unsigned int 1, long 127991808) line 368
AfxWndProcBase(HWND__ * 0x000109cc, unsigned int 4356, unsigned int 1, long 127991808) line 220 + 21 bytes
USER32! 77d43a50()
USER32! 77d43b1f()
USER32! 77d444f5()
USER32! 77d44525()
NTDLL! 77f75da3()
USER32! 77d43fd4()
AfApcWinApp::MessageLoop(int 1) line 82 + 20 bytes
AfApcWinApp::Run() line 224
AfxWinMain(HINSTANCE__ * 0x00400000, HINSTANCE__ * 0x00000000, unsigned short * 0x0002080c, int 1) line 49 + 11 bytes
wWinMain(HINSTANCE__ * 0x00400000, HINSTANCE__ * 0x00000000, unsigned short * 0x0002080c, int 1) line 30
wWinMainCRTStartup() line 330 + 55 bytes

Tabtip.exe 's call stack at time of crash (note message being sent and received 0x1104 (4356 decimal) = TVM_GETITEMRECT.

77d49c29 000202ea 00001104 SharedUserData!SystemCallStub+0x4
0049ee50 00001104 00000001 user32!NtUserMessageCall+0xc
000202ea 00001104 00000001 user32!SendMessageW+0x7d
00000440 0318fd84 07a20000 oleacc!COutlineView32::accLocation+0xb0
000b6120 0318fe0c 0318fd88 oleacc!GetLocationRect+0x3a
000b6120 0318fe0c 000202ea oleacc!IsClippedByWindow+0x15
000b6120 77e90003 77e83288 oleacc!COutlineView32::get_accState+0x83
000b2158 77e90003 77e83288 oleacc!AccWrap_Base::get_accState+0x20
000b2158 77e90003 77e83288 oleacc!AccWrap_Annotate::get_accState+0x3f
00020709 000b2158 000202ea tipskins!FACTCL::WinEventProc+0x9b
0318fef8 00000020 546c19b6 user32!__ClientCallWinEventProc+0x28
77d43c7d 0318ff58 00000000 ntdll!KiUserCallbackDispatcher+0x13
0318ff58 00000000 00000000 user32!NtUserGetMessage+0xc
0027f914 00000012 002709e8 TabTip!ObjectWorkerThread+0xa8
0027c948 00000012 002709e8 msvcrt!_endthreadex+0xa0
77c37f49 0027c948 00000000 kernel32!BaseThreadStart+0x37

I'd suggest you post your issues to the
microsoft.public.windows.tabletpc.developer newsgroup. They deal with
programming issues over there.
--
Chris H.
Microsoft Windows MVP/Tablet PC
Tablet PC Universe - www.tabletpcuniverse.net
Tablet PC Chat - http://thetabletpc.net/support.htm
Associate Expert
Expert Zone - www.microsoft.com/windowsxp/expertzone

"Russell K Louks" <rlouks AT esri.com> wrote in message
news:E2D5C0D5-716C-49AC-9972-F7EC6A9BB89F@microsoft.com...
> I'm getting an access violation within my application only on Tablet PCs
(several different brands tested).
>
<snipped>