Fix referenceTracker scenarios where we use the result of QI on failure (#2305)

* Fix QI not setting to null on failure

* Minor nits

---------

Co-authored-by: Sergio Pedri <sergio0694@live.com>

Author: manodasanW

src/WinRT.Runtime2/InteropServices/ObjectReference/WindowsRuntimeObjectReference.Initialization.cs

@@ -108,7 +108,15 @@ internal static WindowsRuntimeObjectReference InitializeFromManagedTypeUnsafe(
         // will have the 'IReferenceTracker' implementation. Otherwise, the new instance will be used. Since the
         // inner was composed, it should answer immediately without going through the outer. Either way, the
         // reference count will go to the new instance.
-        _ = IUnknownVftbl.QueryInterfaceUnsafe(externalComObject, in WellKnownWindowsInterfaceIIDs.IID_IReferenceTracker, out void* referenceTracker);
+        HRESULT isReferenceTracker = IUnknownVftbl.QueryInterfaceUnsafe(externalComObject, in WellKnownWindowsInterfaceIIDs.IID_IReferenceTracker, out void* referenceTracker);
+
+        // We have seen scenarios where 'QueryInterface' is not set to 'null' on failure (for instance, both UWP XAML
+        // and WinUI 3 objects don't do this), so if the call failed we manually set the resulting pointer to 'null'.
+        // This allows the following code to rely on the pointer value to determine how to handle reference tracking.
+        if (isReferenceTracker.Failed)
+        {
+            referenceTracker = null;
+        }
 
         // Determine the flags needed for the native object wrapper (ie. RCW) creation.
         // These are the ones we'll pass to 'ComWrappers' to register the new object.
@@ -296,9 +304,9 @@ internal static WindowsRuntimeObjectReference InitializeObjectReferenceUnsafe(vo
         Marshal.ThrowExceptionForHR(isFreeThreaded);
 
         // Try to resolve an 'IReferenceTracker' pointer (see detailed notes above)
-        _ = IUnknownVftbl.QueryInterfaceUnsafe(externalComObject, in WellKnownWindowsInterfaceIIDs.IID_IReferenceTracker, out void* referenceTracker);
+        HRESULT isReferenceTracker = IUnknownVftbl.QueryInterfaceUnsafe(externalComObject, in WellKnownWindowsInterfaceIIDs.IID_IReferenceTracker, out void* referenceTracker);
 
-        if (referenceTracker is not null)
+        if (isReferenceTracker.Succeeded)
         {
             // If we have a reference tracker, we should report an 'AddRef' on it,
             // as we're wrapping the native object in a managed object reference.
@@ -309,6 +317,11 @@ internal static WindowsRuntimeObjectReference InitializeObjectReferenceUnsafe(vo
             // This matches the handling of non aggregation scenarios above.
             _ = IUnknownVftbl.ReleaseUnsafe(referenceTracker);
         }
+        else
+        {
+            // Ensure the 'IReferenceTracker' pointer is 'null' in case of failure (see notes above)
+            referenceTracker = null;
+        }
 
         // We're going to store the input object, so increment its ref count
         _ = IUnknownVftbl.AddRefUnsafe(externalComObject);
@@ -351,15 +364,20 @@ private static WindowsRuntimeObjectReference InitializeObjectReferenceUnsafe(ref
         }
 
         // Try to resolve an 'IReferenceTracker' pointer (see detailed notes above)
-        _ = IUnknownVftbl.QueryInterfaceUnsafe(acquiredExternalComObject, in WellKnownWindowsInterfaceIIDs.IID_IReferenceTracker, out void* referenceTracker);
+        HRESULT isReferenceTracker = IUnknownVftbl.QueryInterfaceUnsafe(acquiredExternalComObject, in WellKnownWindowsInterfaceIIDs.IID_IReferenceTracker, out void* referenceTracker);
 
         // If we resolved a reference tracker, set it up (see notes above)
-        if (referenceTracker is not null)
+        if (isReferenceTracker.Succeeded)
         {
             _ = IReferenceTrackerVftbl.AddRefFromTrackerSourceUnsafe(referenceTracker);
 
             _ = IUnknownVftbl.ReleaseUnsafe(referenceTracker);
         }
+        else
+        {
+            // Ensure the 'IReferenceTracker' pointer is 'null' in case of failure (see notes above)
+            referenceTracker = null;
+        }
 
         // Special case for free-threaded object references (see notes above)
         if (isFreeThreaded == WellKnownErrorCodes.S_OK)