Thread freezes while calling AccessibleChildren

Question

Every now and again my C++ application would walk MSAA tree ofmultiple applications using code based on MSDN example from this page: https://msdn.microsoft.com/en-us/library/windows/desktop/dd317975(v=vs.85).aspx

It worked perfectly, until few months ago when I started noticing that sometimes thread freezes on AccessibleChildren call.

Here is what I know of it:

• This does not occur too often
• It happens when walking trees of different applications.
• It is definitely not connected to amount of children of current node as I already debugged minidumps of where bottom call childCount equeal to 1.
• It happens on different PCs.
• Thread in such position will never wake up. Once freeze happens thread will stay in this state until app is restarted.
• Sometimes thread simply dies during such iterations and in such cases I am not able to catch stacktrace of it. The rest of the app keeps running then, but dumps shows that given thread does not work anymore although it's task is basically infinite loop with sleeps. I presume it is connected to freezes. somehow.

My question is: Can someone point out reasons of such freeze and how to prevent them? If not is there a way to move recursion to another thread, which could be safely "timed out" from another thread?

This is example stack trace of such events, where top is most nested call. I removed my recursion from here to shorten the reading a bit.

--> ntdll.dll!_NtWaitForMultipleObjects@20()    Unknown
    ntdll.dll!_NtWaitForMultipleObjects@20()    Unknown
    KERNELBASE.dll!_WaitForMultipleObjectsEx@20()   Unknown
    kernel32.dll!_WaitForMultipleObjectsExImplementation@20()   Unknown
    user32.dll!_RealMsgWaitForMultipleObjectsEx@20()    Unknown
    ole32.dll!CCliModalLoop::BlockFn(void * * ahEvent, unsigned long cEvents, unsigned long * lpdwSignaled) Line 1222   C++
    ole32.dll!ModalLoop(CMessageCall * pcall) Line 211  C++
    ole32.dll!ThreadSendReceive(CMessageCall * pCall) Line 4979 C++
    ole32.dll!CRpcChannelBuffer::SwitchAptAndDispatchCall(CMessageCall * * ppCall) Line 4454    C++
    ole32.dll!CRpcChannelBuffer::SendReceive2(tagRPCOLEMESSAGE * pMessage, unsigned long * pstatus) Line 4076   C++
    ole32.dll!CCliModalLoop::SendReceive(tagRPCOLEMESSAGE * pMsg, unsigned long * pulStatus, IInternalChannelBuffer * pChnl) Line 899   C++
    ole32.dll!CAptRpcChnl::SendReceive(tagRPCOLEMESSAGE * pMsg, unsigned long * pulStatus) Line 583 C++
    ole32.dll!CCtxComChnl::SendReceive(tagRPCOLEMESSAGE * pMessage, unsigned long * pulStatus) Line 659 C++
    ole32.dll!NdrExtpProxySendReceive(void * pThis, _MIDL_STUB_MESSAGE * pStubMsg) Line 1932    C++
    rpcrt4.dll!@NdrpProxySendReceive@4()    Unknown
    rpcrt4.dll!_NdrClientCall2()    Unknown
    ole32.dll!ObjectStublessClient(void * ParamAddress, long Method) Line 474   C++
    ole32.dll!_ObjectStubless@0() Line 154  Unknown
    ole32.dll!CStdMarshal::Begin_RemQIAndUnmarshal1(unsigned short cIIDs, _GUID * pIIDs, tagQICONTEXT * pQIC) Line 4551 C++
    ole32.dll!CStdMarshal::Begin_QueryRemoteInterfaces(unsigned short cIIDs, _GUID * pIIDs, tagQICONTEXT * pQIC)    C++
    ole32.dll!CStdMarshal::QueryRemoteInterfaces(unsigned short cIIDs, _GUID * pIIDs, tagSQIResult * pQIRes) Line 4284  C++
    ole32.dll!CStdIdentity::CInternalUnk::QueryMultipleInterfaces(unsigned long cMQIs, tagMULTI_QI * pMQIs) Line 596    C++
    ole32.dll!CStdIdentity::CInternalUnk::QueryInterface(const _GUID & riid, void * * ppv) Line 352 C++
    ole32.dll!IUnknown_QueryInterface_Proxy(IUnknown * This, const _GUID & riid, void * * ppv) Line 1723    C++
    ole32.dll!CoUnmarshalInterface(IStream * pStm, const _GUID & riid, void * * ppv) Line 996   C++
    oleacc.dll!UnmarshalInterface(unsigned char const *,unsigned long,struct _GUID const &,void * *)    Unknown
    oleacc.dll!FreeUpSlot(struct OutstandingObjectEntry *)  Unknown
    oleacc.dll!_ObjectFromLresult@16()  Unknown
    oleacc.dll!NativeIAccessibleFromWindow(struct HWND__ *,unsigned long,struct _GUID const &,void * *) Unknown
    oleacc.dll!_ORIGINAL_AccessibleObjectFromWindow@16()    Unknown
    oleacc.dll!_AccessibleObjectFromWindow@16() Unknown
    oleacc.dll!GetWindowObject(struct HWND__ *,struct tagVARIANT *) Unknown
    oleacc.dll!CClient::Next(unsigned long,struct tagVARIANT *,unsigned long *) Unknown
    oleacc.dll!AccWrap_Base::Next(unsigned long,struct tagVARIANT *,unsigned long *)    Unknown
    oleacc.dll!_AccessibleChildren@20() Unknown
    //my recursion ends here

Answer 1

I still don't know why all above is happening and how to protect my application against that from within my code. The only solution I've thought myself is to use separate process and wait for it with some timeout. Something like this Microsoft example, but with timeout set to constant value (like a half a second) rather than INFINITE.

If waiting ends because of process finished then I'd get it's stdout as response (some json with result or something like that). If process times out than I will simply terminate it to clean its resources.

Not a perfect solution, but it will give me some control over what is happening and I will be somehow protected against memory leaks etc.

Since this is only half measure I will happily accept any other ideas to solve my problems.