fix: Stop shared dependency objects retaining discarded elements and their DataContext - #25102

GitHub Issue: closes #25099

PR Type:

🐞 Bugfix

What changed? 🚀

On Skia, dependency objects that are shared between elements kept the last element they were applied to alive, and through that element's inherited DataContext, whole pages after navigation. The issue lists the reference chains found with a reflection walk from static roots in a real app. Two of the problems it found have since been fixed on master: the strong single-parent association of a shareable value (#26123, which also clears a released child's DataContext) and ToolTipService.m_CurrentToolTip (#25137). This PR, rebased on current master, fixes the two that remain, plus one stale-DataContext case that master's weak association exposes.

1. Transform.Changed handlers accumulated (unbounded)

A Style setter hands the same ScaleTransform to every element the style applies to. NativeRenderTransformAdapter subscribed to the transform's Changed event with a strong handler and only unsubscribed when the element's RenderTransform was replaced, never when the element was discarded. A shared transform therefore held one handler per element ever styled with it (147 after a few minutes of navigating in the reporting app), each rooting a FontIcon and its page.

Transform now exposes an internal RegisterChanged built on WeakEventHelper, the same pattern Brush.RegisterInvalidateRender uses, and the adapter registers through it and disposes the registration. The registration disposable captures the delegate, so the handler lives exactly as long as the adapter holds it, and the transform never roots its subscribers. Popup's own RenderTransform handler and UIElement's Projection.Changed handler had the same shape and were migrated the same way (Projection gets the same RegisterChanged). So were Brush (Transform, RelativeTransform), Geometry (Transform) and TransformGroup (its children): a transform is multi-parent shareable, as in WinUI, so a single one can be used by many short-lived brushes, geometries or groups (a resource referenced from a template, for instance), and each of them was kept alive by it; a geometry also keeps the Path it draws, or the element it clips, alive through GeometryChanged. With no strong subscriber left, the strong Changed events of Transform and Projection are removed, so every subscriber goes through the weak registration. TransformGroup also handles the Reset that Children.Clear() raises without the removed items, so it lets go of cleared children. There is no WinUI counterpart for the adapter: WinUI dirties the composition tree through non-owning parent associations, so this stays an Uno-native design.

2. Shared values held their owner's DataContext strongly (bounded, one page per shared object)

A non-FrameworkElement dependency object set as a property value caches the DataContext pushed down from the element it is set on (_inheritedDataContext in the non-FE binding store), so {Binding}s added or resumed on it later resolve against it. This is how Uno models WinUI's inheritance context, which Given_NonFE_DataContextBinding and the MultiParentNonFE_* tests guard. The cache was a strong reference, so a style setter value, a static brush, a shared TransitionCollection or a static InputScope retained the DataContext of the last element it was applied to, and with it that element's page. In WinUI the inheritance context is a non-owning link to the mentor, and the DataContext belongs to the mentor.

The cache is now a ManagedWeakReference rented from WeakReferencePool. No inheritance rule changes: the value inherits exactly as before, it just no longer owns what it inherited. A value a binding has already copied into an object-typed property is released when the owner's subtree leaves the tree (the owner loses its inherited DataContext and pushes null into its values).

3. A collected parent's DataContext survived re-association

Since #26123, a shareable value whose single parent was collected without unassociating counts that parent as no parent, and the next owner becomes its single parent, as in WinUI, where a destroyed parent removes itself from its values (CDependencyObject::ReleaseImpl -> ResetReferencesFromChildren -> RemoveParent). The expired slot was reused without clearing the DataContext the dead parent had pushed in, and the on-attach push in UpdateChildBindable only forwards a non-null DataContext, so on an owner with no DataContext the value's bindings kept resolving against the old view model whenever it was still alive (the weak reference does not help then). AssociateParent now clears the inherited DataContext when it reuses an expired slot, as the parent's removal does in WinUI, unless the value has a parent of its own other than the new owner (the same guard as the on-attach push). The dead parent's slot also no longer counts as a holder: it never released its bindable slot, so master's guarded clear on release (which waits for the last holder) never fired again for that value, and the next owner's DataContext stayed behind once it let go. The ALC sweep frees an already-collected parent's slot the same way.

Tests

Runtime tests, each failing on master and passing with its commit:

• Given_Transform.When_RenderTransform_Shared_By_Style_Then_Discarded_Elements_Collected: five elements styled with a shared transform are discarded and collected, then a new element styled the same way still renders at the new scale after a full collection when the shared transform changes.
• Given_Transform.When_RenderTransform_Shared_By_Popup_Style_Then_Discarded_Popups_Collected and When_Projection_Shared_By_Style_Then_Discarded_Elements_Collected: the same for a Popup style sharing a transform and for a style-shared PlaneProjection.
• Given_Transform.When_Transform_Shared_By_Brushes_Then_Discarded_Brushes_Collected, When_Transform_Shared_By_Geometries_Then_Discarded_Elements_Collected and When_Transform_Shared_By_TransformGroups_Then_Discarded_Groups_Collected: one transform used by several gradient brushes (RelativeTransform), clip geometries or TransformGroups; the discarded brushes, clipped elements and groups are collected, and a survivor still renders the transform's next change after a full collection.
• Given_BindingMemoryLeak.When_BrushShared_SingleOwner_Removed_Then_Owner_And_ViewModel_Collected, When_TransitionsShared_Removed_Then_ViewModel_Collected and When_InputScopeShared_Removed_Then_ViewModel_Collected: a long-lived brush applied to one element at a time, a TransitionCollection shared through a Style setter and a plain shared InputScope do not retain the owner's DataContext.
• Given_UIElement.SingleParentNonFE_Parent_Collected_Then_Next_Parent_Starts_Clean: a bound brush whose first owner is collected while that owner's view model stays alive starts clean on a new owner with no DataContext, then inherits the new owner's DataContext, and drops it again once the new owner replaces it.

Regression guards, passing before and after: Given_Transform.When_TransformGroup_Children_Cleared_Then_Removed_Child_Collected (a transform cleared from a long-lived group is collected, and the group follows a child added afterwards) covers the TransformGroup registrations, and Given_UIElement.SharedNonFE_ObjectBinding_Subtree_Severed_Then_Bound_Value_Released (a bound object-typed value on a shared non-FE object is released when the owner's subtree is severed) covers the weak cache.

Validation on Skia desktop, on the rebased head: Given_Transform, Given_BindingMemoryLeak, Given_UIElement, Given_CollectibleAlcAssociations, Given_NonFE_DataContextBinding, Given_ResourceDictionary_DataContext, Given_SharedTemplate_DataContext, Given_ToolTip and Given_FrameworkElement_And_Leak pass: 727 passed, 3 failed, 1 skipped, where the 3 failures are Given_UIElement ActualOffset tests that fail the same way on master on this machine (125% DPI rounding). With the product changes reverted to master, every test in the first list fails and the two guards pass; with only the weak DataContext, or without the holder-count fix (its last step), SingleParentNonFE_Parent_Collected_Then_Next_Parent_Starts_Clean still fails and the Given_BindingMemoryLeak tests pass. The Given_Transform and Given_BindingMemoryLeak tests are unchanged from the previous round, where they passed on native WinUI with the WinAppSDK head built locally (the projection test and the Given_UIElement tests are Skia-only).

PR Checklist ✅

• 🧪 Added Runtime tests, UI tests, or a manual test sample (for bug fixes / features, if applicable)
• 📚 Docs have been added/updated following the documentation template (for bug fixes / features)
• 🖼️ Validated PR Screenshots Compare Test Run results.
• ❗ Contains NO breaking changes
• 👀 Reviewed 2 other open pull requests (optional but appreciated!)