This bug is for crash report bp-2f27792b-df70-4b05-a005-387730190305.

Top 10 frames of crashing thread:

0 nvdahelperremote.dll markNodeAsNonreusableIfInAncestor c:\projects\nvda\build\x86_64\vbufbase\backend.cpp:141
1 nvdahelperremote.dll VBufBackend_t::invalidateSubtree c:\projects\nvda\build\x86_64\vbufbase\backend.cpp:178
2 nvdahelperremote.dll GeckoVBufBackend_t::renderThread_winEventProcHook c:\projects\nvda\build\x86_64\vbufbackends\gecko_ia2\gecko_ia2.cpp:1091
3 nvdahelperremote.dll inproc_winEventCallback c:\projects\nvda\build\x86_64\remote\injection.cpp:74
4 user32.dll _ClientCallWinEventProc 
5 ntdll.dll KiUserCallbackDispatch 
6 user32.dll NtUserNotifyWinEvent 
7 user32.dll NotifyWinEvent 
8 xul.dll mozilla::a11y::ProxyTextChangeEvent accessible/windows/msaa/Platform.cpp:165
9 xul.dll mozilla::a11y::DocAccessibleParent::RecvTextChangeEvent accessible/ipc/DocAccessibleParent.cpp:308

Note I don't have the exact reproducible steps. Fx crashed while trying to watch Netflix videos with DRM disabled and NVDA enabled. I will try to find the exact reproducible steps asap.

Thanks for the report! This crashes in the injected NVDA DLL. And because it is in-process, it takes down Firefox with it.

Jamie, any ideas?

There are some cases where an accessible is moved from one subtree to another without re-creating the accessible. NVDA's buffer seems to choke on these in some cases. This was supposedly fixed, but there are still some instances; e.g.:
https://github.com/nvaccess/nvda/issues/9402
That bug crashes somewhere different, but I suspect the issue is similar.

I'm not sure why, though. I'll raise this with NV Access.

The priority flag is not set for this bug.
:marcia, could you have a look please?

For more information, please visit auto_nag documentation.

Updating 67 flag to show as affected. P3 based on volume.

The priority flag is not set for this bug.
:marcia, could you have a look please?

For more information, please visit auto_nag documentation.

Since the crash volume is low (less than 5 per week), the severity is downgraded to S3. Feel free to change it back if you think the bug is still critical.

For more information, please visit auto_nag documentation.

Closing because no crashes reported for 12 weeks.