1664224 - Crash in [@ WindowsDeleteString]

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect, P1)

Description

[Marco Zehe (:MarcoZ)]

Crash report: https://crash-stats.mozilla.org/report/index/2efb0a68-d1a7-4eb3-b00f-fa77b0200910

Top 10 frames of crashing thread:

0 combase.dll WindowsDeleteString onecore\com\combase\winrt\string\string.cpp:150
1 combase.dll CStdMarshal::DisconnectSrvIPIDs onecore\com\combase\dcomrem\marshal.cxx:5437
2 combase.dll CStdMarshal::DisconnectSrvIPIDs onecore\com\combase\dcomrem\marshal.cxx:5477
3 combase.dll CStdMarshal::DisconnectSrvIPIDs onecore\com\combase\dcomrem\marshal.cxx:5437
4 ole32.dll MD_INTERFACE::Release com\ole32\com\txf\callframe\metadata.h:813
5  @0x13800000009 
6 ole32.dll MD_INTERFACE::Release com\ole32\com\txf\callframe\metadata.h:813
7  @0x138ef27ad87 
8 ntdll.dll RtlpFreeHeapInternal 
9 ole32.dll MD_INTERFACE::Release com\ole32\com\txf\callframe\metadata.h:813

Reported to us by a JAWS 2020 user using Firefox 80.0.1 and experiencing tab crashes. Jamie, any ideas?

Comment 1

[Marco Zehe (:MarcoZ)]

Another report is here.

Comment 2

[James Teh [:Jamie]]

We can only destroy our COM interceptors on the main thread, so we queue final releases to the main thread. It looks like this crash occurs when destroying the standard COM marshaler we create for the interceptor. I guess that suggests we already destroyed it (or something it depends on) somewhere earlier? I don't know where or why, though.

Note that this crash report from the same user:
bp-a4eeb554-4fe4-4451-84d6-ffbde0200910
has the signature [@ CStdMarshal::DisconnectSrvIPIDs ]. At first glance, that appears to be related to bug 1404623, but the stack is very different. The stacks in that bug are not related to a main thread release, but this crash is definitely a main thread release of the marshaler. I think that crash is actually just another manifestation of this bug (bug 1664224).

Comment 3

[James Teh [:Jamie]]

I very much doubt it, but...
I wonder whether releasing a standard marshaler in a different apartment to the one in which it was created can cause problems? We always create the standard marshaler in the MTA, but we always release it on the STA.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Since the crash volume is low (less than 5 per week), the severity is downgraded to S3. Feel free to change it back if you think the bug is still critical.

For more information, please visit auto_nag documentation.

Comment 5

[James Teh [:Jamie]]

This should be resolved by Cache the World, which is enabled by default in Firefox 113.