Name and version of other software in use when reproducing the issue:
Firefox nightly 71.0a1 (2019-09-08) (64-bit)
Does the issue still occur after restarting your PC?
Have you tried any other versions of NVDA? If so, please report their behaviors.
I wrote this test case in attempting to distill an issue experienced on Gmail. The Gmail crash occurs in VBufStorage_buffer_t::deleteSubtree. While different, I'm guessing it's related; these are both to do with buffer corruption. I'm hoping a fix for the test case above will deal with the Gmail crash too. If not, I can file a separate bug for the Gmail crash.
Open the More menu inside the conversation view, and choose "Filter hese messages".
Accept whatever it presents you and choose the Create Filter link at the bottom.
On the next page, check the box that says Apply Label.
Tab once to the Choose Label dropdown, and choose a label by arrowing to it and pressing Enter.
Expected: Focus should return to the closed dropdown where the label has been chosen.
Actual: Either Firefox crashes, and NVDA keeps running, or Firefox and NVDA close down alltogether, and no crash reporter comes up. I had both happen to me, and one instance where only Firefox crashed, brought up the above crash report.
Note that this is specific to list boxes, which suggests it is triggered by an event on the selected list box option causing the parent to be re-rendered (requiresParentUpdate is set to true for the selected list box option). My guess is that we re-render the parent, which will render a moved child option, but that moved child option hasn't yet been moved from its old place in the buffer yet... or something.