Steps to reproduce (it may not always happen).

1. Run Narrator on Windows 7

2. Run HelloSanity

3. Press the "Controls" button

4. Tab around a while, using the controls (select / deselect the cancel checkbox and radio button, scroll the lists, etc)

5. Press the "Back" button

6. Press the "Tabs and Menus" button

7. Tab or mouse around a few of the combo boxes and select a few choices

8. Press the "Back" button

9. Press the "Quit" button.


On my system, the program crashes and relaunches itself indicative of certain crash-on-exit problems. If I attach a debugger I can catch the crash.


Here is the stack trace (no FX code in stace).

> UIAutomationCore.dll!ComInvoker::~ComInvoker() + 0x54 bytes
  UIAutomationCore.dll!ComInvoker::`vector deleting destructor'() + 0xd bytes
  UIAutomationCore.dll!RefcountBase::Release() + 0x45 bytes
  UIAutomationCore.dll!ComInvoker::Release() + 0x11 bytes
  UIAutomationCore.dll!ProcessStaticMethod() + 0x207 bytes
  UIAutomationCore.dll!ProcessIncomingRequest() + 0xd7 bytes
  UIAutomationCore.dll!ChannelBasedServerConnection::OnData() + 0x52 bytes
  UIAutomationCore.dll!ReadWriteChannelInfo::Service() + 0x178 bytes
  UIAutomationCore.dll!OverlappedIOManager::IoThreadProc() + 0x27 bytes
  UIAutomationCore.dll!OverlappedIOManager::StaticIoThreadProc() + 0xd bytes
  kernel32.dll!@BaseThreadInitThunk@12() + 0x12 bytes
  ntdll.dll!___RtlUserThreadStart@8() + 0x27 bytes
  ntdll.dll!__RtlUserThreadStart@8() + 0x1b bytes


Here is the disassembled code for the crash.

    6CE528E8 mov ecx,dword ptr [eax]
    6CE528EA push eax
    6CE528EB call dword ptr [ecx+8]
    6CE528EE mov eax,dword ptr [esi+18h]
    6CE528F1 cmp eax,edi
    6CE528F3 je ComInvoker::~ComInvoker+5Ah (6CE528FEh)
    6CE528F5 mov ecx,dword ptr [eax]
    6CE528F7 push eax
--> 6CE528F8 call dword ptr [ecx+8]
    6CE528FB mov dword ptr [esi+18h],edi
    6CE528FE mov dword ptr [esi+28h],edi
    6CE52901 cmp dword ptr [esi+2Ch],edi
    6CE52904 je ComInvoker::~ComInvoker+69h (6CE5290Dh)
    6CE52906 mov ecx,esi
    6CE52908 call ComInvoker::CheckCoUninit (6CE5277Bh)
    6CE5290D mov eax,dword ptr [esi+1Ch]
    6CE52910 cmp eax,edi
    6CE52912 je ComInvoker::~ComInvoker+76h (6CE5291Ah)
    6CE52914 mov ecx,dword ptr [eax]
    6CE52916 push eax
    6CE52917 call dword ptr [ecx+8]
    6CE5291A mov eax,dword ptr [esi+18h]