MFC Ribbon quick access toolbar crash when state is changed - c++

Question

I have an old MFC application I am updating and I just added a ribbon (using the CMFCRibbonBar class).
However any commands in the quick access toolbar on the ribbon that cause a change in state (eg closing the file and exiting to the main menu) cause a crash when the command is used from the quick access toolbar but not the normal ribbon button.
The crash happens in the MFC file afxribbonbar.cpp in OnMouseMove()
if (pHit != m_pHighlighted)
{
PopTooltip();
if (m_pHighlighted != NULL)
{
ASSERT_VALID(m_pHighlighted);
m_pHighlighted->m_bIsHighlighted = FALSE;
m_pHighlighted->OnHighlight(FALSE);
InvalidateRect(m_pHighlighted->GetRect());
m_pHighlighted = NULL;
}
It crashes on the InvalidateRect line, because m_pHighlighted seems to exist but have no data, so either the stack is corrupted or m_pHighlighted doesn't exist anymore.
I have some lines to reload where all the frames were last time the user was in the new state and I found if I comment out the lines when I change state the crash doesn't happen:
theApp.SaveState(this, ToolbarKey(i_oldAppState));
and
theApp.LoadState( this, ToolbarKey(i_newAppState) );
But ideally I want these lines as otherwise all the windows and frames revert to their default state and users have to resize everything again.
It feels like the entries in the quick access toolbar are being destroyed and recreated when I change state, but I can't find where MFC does this, or a way to set the highlighted entry to null.
EDIT: The crash is an unhandled exception due to an access reading violation in mfc140u.dll. The crash happens deep in the MFC code, well away from anything I have written.
The call stack when this unhandled exception occurs is:
mfc140u.dll!CBasePane::get_accValue(tagVARIANT varChild, wchar_t * * pszValue) Line 1494 C++
mfc140u.dll!CMFCRibbonBar::OnMouseMove(unsigned int nFlags, CPoint point) Line 2348 C++
mfc140u.dll!CMFCRibbonBar::OnLButtonUp(unsigned int nFlags, CPoint point) Line 2276 C++
mfc140u.dll!CWnd::OnWndMsg(unsigned int message, unsigned __int64 wParam, __int64 lParam, __int64 * pResult) Line 2698 C++
mfc140u.dll!CWnd::WindowProc(unsigned int message, unsigned __int64 wParam, __int64 lParam) Line 2099 C++
mfc140u.dll!CBasePane::WindowProc(unsigned int message, unsigned __int64 wParam, __int64 lParam) Line 1020 C++
mfc140u.dll!CMFCRibbonBar::WindowProc(unsigned int message, unsigned __int64 wParam, __int64 lParam) Line 4884 C++
mfc140u.dll!AfxCallWndProc(CWnd * pWnd, HWND__ * hWnd, unsigned int nMsg, unsigned __int64 wParam, __int64 lParam) Line 265 C++
mfc140u.dll!AfxWndProc(HWND__ * hWnd, unsigned int nMsg, unsigned __int64 wParam, __int64 lParam) Line 417 C++
mfc140u.dll!AfxWndProcBase(HWND__ * hWnd, unsigned int nMsg, unsigned __int64 wParam, __int64 lParam) Line 299 C++
user32.dll!UserCallWinProcCheckWow() Unknown
user32.dll!DispatchMessageWorker() Unknown
user32.dll!IsDialogMessageW() Unknown
mfc140u.dll!CWnd::IsDialogMessageW(tagMSG * lpMsg) Line 194 C++
[Inline Frame] mfc140u.dll!CWnd::PreTranslateInput(tagMSG *) Line 4606 C++
mfc140u.dll!CBasePane::PreTranslateMessage(tagMSG * pMsg) Line 1057 C++
mfc140u.dll!CMFCRibbonBar::PreTranslateMessage(tagMSG * pMsg) Line 3734 C++
mfc140u.dll!CWnd::WalkPreTranslateTree(HWND__ * hWndStop, tagMSG * pMsg) Line 3379 C++
mfc140u.dll!AfxInternalPreTranslateMessage(tagMSG * pMsg) Line 233 C++
mfc140u.dll!AfxInternalPumpMessage() Line 178 C++
mfc140u.dll!CWinThread::Run() Line 629 C++

Answer 1

I had the same bug in the BCG Library. I Made my private fix there for the variables m_pHighlighted and m_pPressed.
BOOL CBCGPRibbonBar::LoadState (LPCTSTR lpszProfileName, int nIndex, UINT uiID)
{
// 2014-04-23 mri: we need to clear pointer to may be active elements that
// may get deleted, when LoadState is executed.
// We cannot set m_pActiveCategory to NULL!!!! This get us into problems when the
// program starts and the minimize/maximize button is used, when this pointer is
// NULL.
m_pHighlighted = NULL;
m_pPressed = NULL;
You should set them to nullptr before you call LoadState
As I remember the problem ist that a click in the ribbon is handled in the Mouse-Down message. So the Mouse-Up message is never executed that clears this member...