WPF的TreeView执行ExpandSubtree时抛出异常System.NullReferenceException

最近拿到一个dump，有应用崩溃，通过查看dump，异常信息如下：
0:012> !pe
Exception object: 0000000005187278
Exception type: System.NullReferenceException
Message: Object reference not set to an instance of an object.
InnerException: <none>
StackTrace (generated):
SP IP Function
000000002144DB50 000007FEEDF84989 PresentationFramework_ni!System.Windows.Controls.TreeViewItem.ExpandRecursive(System.Windows.Controls.TreeViewItem)+0x119
000000002144DC10 000007FEEDF84B46 PresentationFramework_ni!System.Windows.Controls.TreeViewItem.ExpandRecursive(System.Windows.Controls.TreeViewItem)+0x2d6
000000002144DCD0 000007FEEDE574B8 PresentationFramework_ni!System.Windows.Controls.TreeView.ExpandSubtree(System.Windows.Controls.TreeViewItem)+0x18
000000002144DD00 000007FEEDE572F5 PresentationFramework_ni!System.Windows.Controls.TreeView.OnKeyDown(System.Windows.Input.KeyEventArgs)+0x135
000000002144DD40 000007FEF116B1E3 PresentationCore_ni!System.Windows.RoutedEventArgs.InvokeHandler(System.Delegate, System.Object)+0x53
000000002144DDA0 000007FEF116A991 PresentationCore_ni!System.Windows.EventRoute.InvokeHandlersImpl(System.Object, System.Windows.RoutedEventArgs, Boolean)+0x271
000000002144DFE0 000007FEF115408E PresentationCore_ni!System.Windows.UIElement.RaiseEventImpl(System.Windows.DependencyObject, System.Windows.RoutedEventArgs)+0x14e
000000002144E070 000007FEF114FF66 PresentationCore_ni!System.Windows.UIElement.RaiseTrustedEvent(System.Windows.RoutedEventArgs)+0x96
000000002144E0D0 000007FEF117C921 PresentationCore_ni!System.Windows.Input.InputManager.ProcessStagingArea()+0x471
000000002144E160 000007FEF117C42B PresentationCore_ni!System.Windows.Input.InputManager.ProcessInput(System.Windows.Input.InputEventArgs)+0xab
000000002144E1B0 000007FEF117C1BC PresentationCore_ni!System.Windows.Interop.HwndKeyboardInputProvider.ReportInput(IntPtr, System.Windows.Input.InputMode, Int32, System.Windows.Input.RawKeyboardActions, Int32, Boolean, Boolean, Int32)+0x1bc

!pe即PrintException，从异常堆栈信息上可以看到当时在TreeView上按了某个键导致TreeView要展开TreeViewItem，然后循环时抛出空指针异常。

接下来就是查看当时传递的KeyDown事件是哪个，查看google后有的人说通过!clrstack -p可以看到函数参数的地址， 但试过后发现由于是Release版本，这个windbg命令并不起效。
只能用笨办法，通过!dso来查看当时整个线程所有堆栈变量， 如下：
0:012> ~12e !dso
OS Thread Id: 0xba4 (12)
RSP/REG Object Name
00000000214479B0 0000000005187278 Syste.NullReferenceException
000000002144DCB0 00000000051840c8 System.Windows.Input.KeyEventArgs
000000002144DCC0 0000000002d728f8 System.Windows.Controls.TreeView
000000002144DCD0 00000000041c1188 System.Windows.Controls.TreeViewItem

上面12是抛异常的clr线程号，可以通过~*kb查看所有现场的堆栈，就可以知道具体线程号
从上面命令的部分信息可以看到当时KeyEventArgs的地址。

接下来通过!do命令查看具体信息
012> !do 00000000051840c8
Name: System.Windows.Input.KeyEventArgs
MethodTable: 000007fef1283900
EEClass: 000007fef0ee4de0
Size: 80(0x50) bytes
File: C:\Windows\Microsoft.Net\assembly\GAC_64\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\PresentationCore.dll
Fields:
MT Field Offset Type VT Attr Value Name
000007fef5070c78 40001c7 80 System.EventArgs 0 shared static Empty
>> Domain:Value 00000000008083f0:0000000002bd96d0 <<
000007fef1279088 40012ff 8 ...ndows.RoutedEvent 0 instance 0000000002ba43d0 _routedEvent
000007fef5055ac8 4001300 10 System.Object 0 instance 0000000002d728f8 _source
000007fef5055ac8 4001301 18 System.Object 0 instance 00000000041c1188 _originalSource
000007fef43990a8 4001302 20 ...lized.BitVector32 1 instance 00000000051840e8 _flags
000007fef128b320 40016ce 28 ...Input.InputDevice 0 instance 0000000002bc2f00 _inputDevice
000007fef505c858 40016cf 1460 System.Int32 1 static 396682259 _timestamp
000007fef3161bf0 40018ba 38 System.Int32 1 instance 84 _realKey
000007fef3161bf0 40018bb 3c System.Int32 1 instance 84 _key
000007fef1283da8 40018bc 30 ...resentationSource 0 instance 0000000003f8d7a0 _inputSource
000007fef505d688 40018bd 44 System.Boolean 1 instance 0 _isRepeat
000007fef505c858 40018be 40 System.Int32 1 instance 55 _scanCode
000007fef505d688 40018bf 45 System.Boolean 1 instance 0 _isExtendedKey

从上面可以看到当时按键Key的值是84，
通过查看enum类型的Key源码，发现84是*
namespace System.Windows.Input
{
[ValueSerializer(typeof (KeyValueSerializer))]
[TypeConverter(typeof (KeyConverter))]
public enum Key
{

NumPad9 = 83,
Multiply = 84,
Add = 85,
Separator = 86,
Subtract = 87,
Decimal = 88,
Divide = 89,

通过查看TreeView的代码也可以看出Multiply的快捷键作用是ExpandSubTree

case Key.Multiply:
if (ExpandSubtree(_selectedContainer))
{
e.Handled = true;
}
break;

结论：
*是TreeView控件的默认系统快捷键，用来展开TreeViewItem，当TreeView的Style有问题时，导致递归展开子项时抛了异常。

解决办法：
修改Style或者屏蔽快捷键。