Fix InvalidCastException in Control.OnHandleDestroyed for non-ControlAccessibleObject

[LeafShi1]

Fixes #14291

Root Cause

Control.OnHandleDestroyed used Properties.TryGetValue<ControlAccessibleObject> for both AccessibilityObject and NcAccessibilityObject, assuming the stored instance was always a ControlAccessibleObject. When a control overrides CreateAccessibleObject() to return a different AccessibleObject type, the generic TryGetValue<T> attempted an invalid cast and threw InvalidCastException during handle destruction.

Proposed changes

• Change the lookups in Control.OnHandleDestroyed for s_accessibilityProperty and s_ncAccessibilityProperty from TryGetValue<ControlAccessibleObject> to TryGetValue<AccessibleObject>, then use type pattern matching (accObj is ControlAccessibleObject controlAccObj) before resetting controlAccObj.Handle = IntPtr.Zero, so only true ControlAccessibleObject instances are manipulated and other AccessibleObject types no longer cause invalid casts.

Customer Impact

• This change prevents InvalidCastException crashes when controls with custom accessible objects are destroyed

Regression?

• Yes (Regress by commit d08128b#diff-07a0a87cedab0d76c974ce8b105912a1b986c87116c7ee0ac73d6d5d65e4b48aL7643)

Risk

• Minimal

Screenshots

Before

Sample project:
WinFormsApp15.zip

On teardown, If a custom overrode CreateAccessibleObject() and returned a different AccessibleObject type, TryGetValue threw an InvalidCastException when the handle was destroyed, potentially crashing the app.

BeforeChanges.mp4

After

Custom accessible objects that are not ControlAccessibleObject are left untouched during handle destruction, so no InvalidCastException is thrown and the app stays stable.

AfterChanges.mp4

Test methodology

• Manually

Test environment(s)

• .net 11.0.0-preview.2.26080.101

Microsoft Reviewers: Open in CodeFlow

[Copilot]

Pull request overview

Fixes a regression in Control.OnHandleDestroyed where PropertyStore.TryGetValue<T> could throw InvalidCastException if a control’s accessibility object stored in the property store is not a ControlAccessibleObject.

Changes:

• Update OnHandleDestroyed to retrieve AccessibleObject instances from the PropertyStore instead of ControlAccessibleObject.
• Use type pattern matching to only clear the handle when the stored object is actually a ControlAccessibleObject (including derived types).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 77.24652%. Comparing base (9b546b7) to head (5d05194).
⚠️ Report is 15 commits behind head on main.

Additional details and impacted files

@@                 Coverage Diff                 @@
##                main      #14295         +/-   ##
===================================================
+ Coverage   77.18395%   77.24652%   +0.06257%     
===================================================
  Files           3279        3279                 
  Lines         645138      645119         -19     
  Branches       47730       47731          +1     
===================================================
+ Hits          497943      498332        +389     
+ Misses        143503      143094        -409     
- Partials        3692        3693          +1     

Flag	Coverage Δ
Debug	77.24652% <100.00000%> (+0.06257%)	⬆️
integration	19.09095% <40.00000%> (+0.10031%)	⬆️
production	52.19126% <100.00000%> (+0.12807%)	⬆️
test	97.41584% <100.00000%> (+0.01104%)	⬆️
unit	49.57475% <100.00000%> (+0.07213%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[ricardobossan]

Other than a small comment, all LGTM!

[KlausLoeffelmann]

We should think about pro-actively investigating potential other regressions connected to that Property Store "Optimization". But for now, this is OK to take.