1505276 - Crash in VBufStorage_buffer_t::deleteSubtree

Status: RESOLVED FIXED

(External Software Affecting Firefox :: Other, defect)

Description

[Marco Zehe (:MarcoZ)]

This bug was filed from the Socorro interface and is
report bp-f2d0aa12-ab7e-48dc-9bb6-3637e0181107.
=============================================================

Top 10 frames of crashing thread:

0 nvdahelperremote.dll VBufStorage_buffer_t::deleteSubtree c:\projects\nvda\build\x86_64\vbufbase\storage.cpp:492
1 nvdahelperremote.dll VBufStorage_buffer_t::deleteSubtree c:\projects\nvda\build\x86_64\vbufbase\storage.cpp:493
2 nvdahelperremote.dll VBufStorage_buffer_t::deleteSubtree c:\projects\nvda\build\x86_64\vbufbase\storage.cpp:493
3 nvdahelperremote.dll VBufStorage_buffer_t::removeFieldNode c:\projects\nvda\build\x86_64\vbufbase\storage.cpp:770
4 nvdahelperremote.dll VBufStorage_buffer_t::replaceSubtrees c:\projects\nvda\build\x86_64\vbufbase\storage.cpp:644
5 nvdahelperremote.dll VBufBackend_t::update c:\projects\nvda\build\x86_64\vbufbase\backend.cpp:214
6 nvdahelperremote.dll VBufBackend_t::forceUpdate c:\projects\nvda\build\x86_64\vbufbase\backend.cpp:51
7 nvdahelperremote.dll GeckoVBufBackend_t::renderThread_winEventProcHook c:\projects\nvda\build\x86_64\vbufbackends\gecko_ia2\gecko_ia2.cpp:1066
8 nvdahelperremote.dll inProcess_winEventCallback c:\projects\nvda\build\x86_64\remote\inprocess.cpp:156
9 nvdahelperremote.dll inproc_winEventCallback c:\projects\nvda\build\x86_64\remote\injection.cpp:74

=============================================================

This is a crash in the NVDA LL injected into the main Firefox process.

STR (with NVDA latest alpha builds and Firefox nightly):
1. Open Gmail and open a conversation.
2. Press Shift+B until NVDA says More Button menu.
3. Press Space to activate this More button menu.
4. Press Down Arrow a few times.

On two of my machines, once I get past the third menu item, whatever that may be, Firefox closes and sometimes brings up Crash Reporter, sometimes doesn't. The above result is a lucky instance where Crash Reporter did come up.

Note, again, that this is an NVDA issue, but tracking it with Firefox since the crash shows up in our crash stats.

Related NVDA issue: https://github.com/nvaccess/nvda/issues/8924

Another crash report submitted by me from a different machine: https://crash-stats.mozilla.com/report/index/6c6c3806-ad3e-4b1d-b625-37f720181106
(Note that this has a slightly different signature, but the steps are the same).

Comment 1

[James Teh [:Jamie]]

Fixed in NVDA. PR: https://github.com/nvaccess/nvda/pull/8930