1710212 - Crash in [@ CStdAsyncStubBuffer2_Disconnect]

Status: RESOLVED WORKSFORME

(Core :: Disability Access APIs, defect)

Description

[Calixte Denizet (:calixte)]

Maybe Fission related. (DOMFissionEnabled=1)

Crash report: https://crash-stats.mozilla.org/report/index/a3f4a1d9-73be-4427-b2a1-d882e0210506

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0 combase.dll CStdAsyncStubBuffer2_Disconnect onecore\com\combase
dr
drole\stub.cxx:1343
1 combase.dll CStdMarshal::DisconnectSrvIPIDs onecore\com\combase\dcomrem\marshal.cxx:5640
2 combase.dll ObjectLibrary::ReferencedPtr<CObjectContext>::ReferencedPtr<CObjectContext><CObjectContext> onecore\com\combase\ObjectLibrary\inc\ComReferenceCounting.hpp:1224
3 combase.dll CStdMarshal::DisconnectWorker_ReleasesLock onecore\com\combase\dcomrem\marshal.cxx:4710
4 combase.dll CStdMarshal::Disconnect onecore\com\combase\dcomrem\marshal.cxx:4522
5 combase.dll CStdMarshal::DisconnectObject onecore\com\combase\dcomrem\marshal.cxx:4489
6 combase.dll CoDisconnectObject onecore\com\combase\dcomrem\coapi.cxx:2258
7 xul.dll mozilla::mscom::Interceptor::DisconnectObject ipc/mscom/Interceptor.cpp:397
8 combase.dll CoDisconnectObject onecore\com\combase\dcomrem\coapi.cxx:2258
9 xul.dll static mozilla::mscom::Interceptor::DisconnectRemotesForTarget ipc/mscom/Interceptor.cpp:851

There is 1 crash in nightly 90 with buildid 20210504214950. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1694865.

[1] https://hg.mozilla.org/mozilla-central/rev?node=4173ffb5fcb9

Comment 1

[James Teh [:Jamie]]

It's hard to tell whether this is new or related to the existing crashes in bug 1664224 and bug 1404623. The origin point is definitely different, but they're similar in that they all involve disconnection code somewhere deep within Windows COM triggered by disconnection of a COM interceptor. I've never been able to get anywhere figuring out what's going on here.

Comment 2

[Chris Peterson [:cpeterson]]

(In reply to Calixte Denizet (:calixte) from comment #0)

Maybe Fission related. (DOMFissionEnabled=1)

Crash report: https://crash-stats.mozilla.org/report/index/a3f4a1d9-73be-4427-b2a1-d882e0210506

AFAICT, this crash is not Fission related, even though the (one) crash report had Fission enabled.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Since the bug is closed, the stalled keyword is now meaningless.
For more information, please visit auto_nag documentation.

Comment 5

[James Teh [:Jamie]]

This may have been fixed by bug 1716549, though I'm far from certain.