I can't reproduce it, so I reviewed the IL code with reflector. I think the only things that could possibly nullref here would be DefaultCompletionSessionPresenter, itself, or DefaultCompletionSessionPresenter._session.

Looking at the usage of _session, I see it is only initialized to be non-null after AttachToSession() has been called, and it can also be reset to null by DetachFromSession() or Dispose(), so it seems very plausible to me that _session was actually null here, and the bug is that there is a missing null check on _session.

The reason it is difficult to reproduce is probably that in most cases, AttachToSession wins the race and is called before keyboard focus event is delivered.

private void <strong><a href="https://127.0.0.1/roeder/dotnet/Default.aspx?Target=code://Microsoft.VisualStudio.Platform.VSEditor:15.0.0.0:b03f5f7f11d50a3a/Microsoft.VisualStudio.Language.Intellisense.Implementation.DefaultCompletionSessionPresenter/OnGotKeyboardFocus%28Object,System.Windows.Input.KeyboardFocusChangedEventArgs%29">OnGotKeyboardFocus</a></strong>(object sender, KeyboardFocusChangedEventArgs e)
{
    this.<a>_hasFocus</a> = true;
    if (!this.<a>_surrenderFocusQueued</a>)
    {
        this.<a>_surrenderFocusQueued</a> = true;
        <a>IWpfTextView2</a> <strong>textView</strong> = this.<a>_session</a>.<a>TextView</a> as <a>IWpfTextView2</a>;

This issue has been fixed and is now available in our latest update. You can download the update via the in-product notification or from here: https://www.visualstudio.com/vs/ Thanks to everyone who provided feedback, votes and solutions for this problem.