Bug 467091

I'm going to help Sandy out with this one.

For reference, with our stuff installed, the easiest way to disable the bridge while running MWF tests is like this:

MONO_UIA_BRIDGE=junk make run-test

I'm totally in the weeds on this issue.  Here's the latest stack trace I have from GDB:

#0  0xb4a28c87 in ORBit_c_stub_invoke (obj=0xb51a6588, methods=0xb4b08884, 
    method_index=0, ret=0x0, args=0xb5af9270, ctx=0x0, ev=0xb50ff224, 
    class_id=0, method_offset=4, 
    skel_impl=0xb4af0420 <_ORBIT_skel_small_Accessibility_EventListener_notifyEvent>) at poa.c:2562
#1  0xb4ae0874 in Accessibility_EventListener_notifyEvent (_obj=0xb51a6588, 
    e=0xb5af92a0, ev=0xb50ff224) at Accessibility-stubs.c:422
#2  0xb50fb09c in spi_atk_emit_eventv (gobject=0x87c0e78, detail1=0, detail2=0, 
    any=0xb5af9304, format=0xb50fcef4 "object:property-change:%s")
    at bridge.c:794
#3  0xb50fc344 in spi_atk_bridge_property_event_listener (
    signal_hint=0xb5af93fc, n_param_values=2, param_values=0x87c0ef0, 
    data=0xb51a32f0) at bridge.c:967
#4  0xb52e19f1 in signal_emit_unlocked_R (node=0xb518ee88, detail=502, 
    instance=0x87c0e78, emission_return=0x0, instance_and_params=0x87c0ef0)
    at gsignal.c:3210
#5  0xb52e34ec in IA__g_signal_emit_valist (instance=0x87c0e78, signal_id=109, 
    detail=502, var_args=0xb5af95a0 "") at gsignal.c:2977
#6  0xb52e3946 in IA__g_signal_emit (instance=0x87c0e78, signal_id=109, 
    detail=502) at gsignal.c:3034
#7  0xb54466ad in atk_object_notify (obj=0x87c0e78, pspec=0x86dc828)
    at atkobject.c:1344
#8  0xb52daaac in IA__g_cclosure_marshal_VOID__PARAM (closure=0xb5fcc7a8, 
    return_value=0x0, n_param_values=2, param_values=0x87c0f90, 
    invocation_hint=0xb5af97ac, marshal_data=0xb5446620) at gmarshal.c:531
#9  0xb52cc389 in g_type_class_meta_marshal (closure=0xb5fcc7a8, 
    return_value=0x0, n_param_values=2, param_values=0x87c0f90, 
    invocation_hint=0xb5af97ac, marshal_data=0x20) at gclosure.c:878
#10 0xb52cdc2b in IA__g_closure_invoke (closure=0xb5fcc7a8, return_value=0x0, 
    n_param_values=2, param_values=0x87c0f90, invocation_hint=0xb5af97ac)
    at gclosure.c:767
#11 0xb52e1836 in signal_emit_unlocked_R (node=0xb5fed9c0, detail=502, 
    instance=0x87c0e78, emission_return=0x0, instance_and_params=0x87c0f90)
    at gsignal.c:3174
#12 0xb52e34ec in IA__g_signal_emit_valist (instance=0x87c0e78, signal_id=10, 
    detail=502, var_args=0xb5af9950 "�_��") at gsignal.c:2977
#13 0xb52e3946 in IA__g_signal_emit (instance=0x87c0e78, signal_id=10, 
    detail=502) at gsignal.c:3034
#14 0xb52d21d1 in g_object_dispatch_properties_changed (object=0x87c0e78, 
    n_pspecs=1, pspecs=0xb5af99bc) at gobject.c:766
#15 0xb52ce98f in g_object_notify_dispatcher (object=0x87c0e78, n_pspecs=1, 
    pspecs=0xb5af99bc) at gobject.c:312
#16 0xb52d4b2d in IA__g_object_notify (object=0x87c0e78, 
    property_name=0xb544e5dd "accessible-parent") at gobjectnotifyqueue.c:125
#17 0xb5444f2f in atk_object_set_parent (accessible=0x87c0e78, parent=0x86dc518)
    at atkobject.c:901

The segfault is happening in ORBit/src/orb/poa/poa.c in get_c_method.  obj is not null, and appears to be a valid CORBA_Object, but pobj->base.interface doesn't have a property named adaptor_type, and is most likely uninitialized memory.

Still digging into it more.

I'm at a loss here.  I have one fix I can commit, but someone else fresher, more seasoned with gdb or more knowledgeable will have to look at the remainder of the issue.