Closed Bug 1378382 Opened 7 years ago Closed 7 years ago

Crash in mozilla::mscom::AsyncInvoker<T>::AsyncInvoker<T>

Categories

(Core :: Disability Access APIs, defect)

Product:
Core
Component:
Disability Access APIs
Platform:
Unspecified
Windows 7
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1374792

People

(Reporter: jimm, Unassigned)

Details

(Keywords: crash, Whiteboard: aes+)

Crash Data

I've been running with a11y force enabled. These started showing up recently.

This bug was filed from the Socorro interface and is 
report bp-b59b6277-08d9-4611-bfb2-723ed0170705.
=============================================================
This is a dup of bug 1374792. While I have a patch in there to attempt to avoid the root cause, I am still not sure what the root cause is.

I know that it's a UAF involving a COM proxy - the pointer to the proxy's vtable is either null or invalid, but it is not clear how the proxy's refcount is being messed up such that the proxy is being prematurely destroyed.

Since it sounds like you can reproduce it, any debugging assistance would be extremely useful!
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.