1949617 - Crash in [@ mozilla::StaticPrefs::accessibility_uia_enable]

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[Andrew McCreight (out of office until 8/21) [:mccr8]]

Crash report: https://crash-stats.mozilla.org/report/index/355a9065-3753-483d-95c8-f0f280250220

MOZ_CRASH Reason:

MOZ_DIAGNOSTIC_ASSERT(IsAtomic<bool>::value || NS_IsMainThread()) (Non-atomic static pref 'accessibility.uia.enable' being accessed on background thread by getter)

Top 10 frames:

0  xul.dll  mozilla::StaticPrefs::accessibility_uia_enable()  modules/libpref/init/StaticPrefList_accessibility.h:66
0  xul.dll  mozilla::a11y::MsaaRootAccessible::InternalQueryInterface(_GUID const&, void**)  accessible/windows/msaa/MsaaRootAccessible.cpp:40
1  combase.dll  CStdMarshal::CreateStub(tagIPIDEntry*, IRpcStubBuffer**, void**, int*, IUnkno...  onecore\com\combase\dcomrem\marshal.cxx:6908
2  combase.dll  CStdMarshal::ConnectSrvIPIDEntry(tagIPIDEntry*, IUnknown*)  onecore\com\combase\dcomrem\marshal.cxx:2927
2  combase.dll  CStdMarshal::MarshalServerIPID(_GUID const&, unsigned long, unsigned long, bo...  onecore\com\combase\dcomrem\marshal.cxx:1794
2  combase.dll  CStdMarshal::MarshalIPID(_GUID const&, unsigned long, unsigned long, bool, ta...  onecore\com\combase\dcomrem\marshal.cxx:1645
2  combase.dll  CRemoteUnknown::RemQueryInterface(_GUID const&, unsigned long, unsigned short...  onecore\com\combase\dcomrem\remoteu.cxx:527
3  rpcrt4.dll  Invoke
4  rpcrt4.dll  NdrStubCall2
5  rpcrt4.dll  NdrStubCall3

This showed up on the Nightly crash spike report. It looks like this pref needs to be made atomic.

The Nightly crashes are all via MsaaRootAccessible::InternalQueryInterface.

There are also a few similar crashes on beta, via LazyInstantiator::QueryInterface: bp-ae2f5810-3ba7-4e9b-89e5-dd2180250216

Comment 1

[Andrew McCreight (out of office until 8/21) [:mccr8]]

Although bug 1896816 suggests the problem might be this code running off the main thread in the first place.

Comment 2

[James Teh [:Jamie]]

This is really odd. The COM marshaler is making this call. However, we only ever hand back MsaaRootAccessible from a COM STA (our main thread), which means COM should never call us on anything other than that thread.

Comment 3

[James Teh [:Jamie]]

Attachment: Bug 1949617: Return an error if QueryInterface is called on MsaaRootAccessible or LazyInstantiator from the wrong thread.

The COM marshaler seems to do this sometimes, possibly to determine whether this is a COM proxy.
Our implementation can't be used off the main thread, so just return an error.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/37ca140f5820
Return an error if QueryInterface is called on MsaaRootAccessible or LazyInstantiator from the wrong thread. r=nlapre

Comment 5

[agoloman]

https://hg.mozilla.org/mozilla-central/rev/37ca140f5820