[valentino-saitz-optris]

What does the pull request do?

ComVariant.Create has no case for decimal, so it throws ArgumentException for any decimal automation value. NumericUpDown.Value is a decimal?, so changing it while a UI Automation client is connected crashes the app. This adds VT_DECIMAL support to ComVariant.

This is the root-cause ComVariant fix that @maxkatz6 identified in #21515 (which was closed with the CLA unsigned). I've scoped it to just ComVariant. There are no NumericUpDownAutomationPeer changes.

Fixes #21491.

What is the current behavior?

Setup: Windows, with any UI Automation client connected so Narrator, Magnifier, Voice Access, the touch keyboard (TabTip) that Steam opens, the "Show pointer location" setting, etc. Then spinning, typing, or setting a NumericUpDown value crashes the process:

System.ArgumentException: UnsupportedType (Parameter 'Decimal')
   at Avalonia.Win32.Automation.Marshalling.ComVariant.Create(Object value)
   at Avalonia.Win32.Automation.Marshalling.ComVariantMarshaller.ConvertToUnmanaged(Object managed)
   at Avalonia.Win32.Automation.Interop.UiaCoreProviderApi.UiaRaiseAutomationPropertyChangedEvent(...)
   at Avalonia.Win32.Automation.AutomationNode.OnPeerPropertyChanged(...)
   at Avalonia.Automation.Peers.NumericUpDownAutomationPeer.OwnerPropertyChanged(...)
   at Avalonia.Controls.NumericUpDown.set_Value(Nullable`1 value)

The event is only raised when a UIA client is listening, which is why it looks like it only happens on some machines.

What is the updated/expected behavior with this PR?

decimal marshals to VT_DECIMAL and round-trips back, so the property-changed event is raised without throwing and the app keeps running.

To check: dotnet new avalonia.app, add a <NumericUpDown/>, run with Narrator on (Ctrl+Win+Enter), and change the value. It crashes on master and works with this change.

I've created a minimal demo Project to replicate and prove the issue. When running it, attach Narrator (or the included trigger-uia.ps1, which subscribes a programmatic UIA client so no screen reader is needed), then try to change the value.
UiaDecimalCrashPoc.zip

How was the solution implemented (if it's not obvious)?

Same approach as the BCL System.Runtime.InteropServices.Marshalling.ComVariant, which this type is based on:

• A decimal field that overlaps the whole variant. A decimal doesn't use its first two bytes, so _vt still encodes the type; the existing TypeUnion layout already lines up with Decimal._flags. Automation here is Windows-only (little-endian), so there's no big-endian case to handle.
• In Create, set the value before VarType = VT_DECIMAL, since the type discriminator overlaps the decimal's unused leading bytes.
• In AsObject, clear the discriminator on a copy (VarType = VT_EMPTY) before returning, so the VT_DECIMAL flag doesn't leak into the value.

Checklist

• Added unit tests (if possible)? Avalonia.Win32.Automation exposes its internals only to Avalonia.Win32 and has no unit-test project yet
• Added XML documentation to any related classes?
• Consider submitting a PR to avalonia-docs: No. Internal n/a (internal marshalling).

Breaking changes

None.

Obsoletions / Deprecations

None.

Fixed issues

Fixes #21491

[avaloniaui-bot]

You can test this PR using the following package version. 12.1.999-cibuild0066828-alpha. (feed url: https://nuget-feed-all.avaloniaui.net/v3/index.json) [PRBUILDID]

[cla-avalonia]

• All contributors have signed the CLA.

[valentino-saitz-optris]

@cla-avalonia agree

[MrJul]

The change matches .NET's own ComVariant.
LGTM!