Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-119167

Atspi.Table.get_row_column_extents_at_index can cause segfault in tree

    XMLWordPrintable

Details

    • Linux/X11
    • d91d53c95 (dev), 10b480f1d (6.7), 20b5a25ea (6.6), 64348e717 (tqtc/lts-5.15)

    Description

      Steps to reproduce:

      1. Run the Simple Tree Model example in Qt Creator
      2. Launch the Accerciser accessibility explorer.
      3. Select/highlight the accessible the "tree" role child of the app
      4. In Accerciser's iPython console type the following, substituting various indices for n (see output below for example)
         Atspi.Table.get_row_column_extents_at_index(acc, n) 

      Expected results: No crash.

      Actual results: Reliable crash for some indices (e.g. 11 might work; 12 might crash)

      iPython console output:

      In [3]: Atspi.Table.get_row_column_extents_at_index(acc, 11)
      Out[3]: (True, row=5, col=1, row_extents=1, col_extents=1, is_selected=False)
      In [4]: Atspi.Table.get_row_column_extents_at_index(acc, 12)
      ---------------------------------------------------------------------------
      Error                                     Traceback (most recent call last)
      Cell In[4], line 1
      ----> 1 Atspi.Table.get_row_column_extents_at_index(acc, 12)
      
      Error: atspi_error: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken. (1)
      
      

      Terminal output:

      $ ./simpletreemodel 
      QAccessibleTree::indexFromLogical: invalid index:  6 0  for  QTreeView(0x7ffca99b9790)
      Requested invalid tree cell: 6 0
      

      Associated stack trace:

      Thread 1 "simpletreemodel" received signal SIGSEGV, Segmentation fault.
      AtSpiAdaptor::tableInterface (this=this@entry=0x562bdf6a5380, interface=interface@entry=0x7f30d4003448, function=..., message=..., connection=...) at atspiadaptor.cpp:2443
      2443                QAccessibleTableCellInterface *cell = interface->tableInterface()->cellAt(row, col)->tableCellInterface();                                              
      (gdb) bt
      #0  AtSpiAdaptor::tableInterface (this=this@entry=0x562bdf6a5380, interface=interface@entry=0x7f30d4003448, function=..., message=..., connection=...)
          at atspiadaptor.cpp:2443
      #1  0x00007f30e238cbb5 in AtSpiAdaptor::handleMessage (this=this@entry=0x562bdf6a5380, message=..., connection=...) at atspiadaptor.cpp:1315
      #2  0x00007f30efa4f70a in QDBusConnectionPrivate::activateObject (this=0x7f30dc015980, node=..., msg=..., pathStartPos=27) at qdbusintegrator.cpp:1464
      #3  0x00007f30efa51e64 in QDBusActivateObjectEvent::placeMetaCall (this=0x562bdf65ff30) at qdbusintegrator.cpp:1623
      #4  0x00007f30f36df0cb in QObject::event (this=0x562bdf6a5380, e=0x562bdf65ff30) at kernel/qobject.cpp:1347
      #5  0x00007f30f3baeb75 in QApplicationPrivate::notify_helper (this=<optimized out>, receiver=0x562bdf6a5380, e=0x562bdf65ff30) at kernel/qapplication.cpp:3640
      #6  0x00007f30f36b4548 in QCoreApplication::notifyInternal2 (receiver=0x562bdf6a5380, event=0x562bdf65ff30) at kernel/qcoreapplication.cpp:1064
      #7  0x00007f30f36b4762 in QCoreApplication::sendEvent (receiver=<optimized out>, event=<optimized out>) at kernel/qcoreapplication.cpp:1462
      #8  0x00007f30f36b79f5 in QCoreApplicationPrivate::sendPostedEvents (receiver=0x0, event_type=0, data=0x562bdf334b60) at kernel/qcoreapplication.cpp:1821
      #9  0x00007f30f36b7cad in QCoreApplication::sendPostedEvents (receiver=<optimized out>, event_type=<optimized out>) at kernel/qcoreapplication.cpp:1680
      #10 0x00007f30f3706f9f in postEventSourceDispatch (s=0x562bdf4739c0) at kernel/qeventdispatcher_glib.cpp:277
      #11 0x00007f30f2112e5c in g_main_dispatch (context=0x7f30dc000ec0) at ../glib/gmain.c:3476
      #12 g_main_context_dispatch_unlocked (context=0x7f30dc000ec0) at ../glib/gmain.c:4284
      #13 0x00007f30f216ddd8 in g_main_context_iterate_unlocked.isra.0 (context=context@entry=0x7f30dc000ec0, block=block@entry=1, dispatch=dispatch@entry=1, 
          self=<optimized out>) at ../glib/gmain.c:4349
      #14 0x00007f30f2110ad3 in g_main_context_iteration (context=0x7f30dc000ec0, may_block=1) at ../glib/gmain.c:4414
      #15 0x00007f30f3706a89 in QEventDispatcherGlib::processEvents (this=0x562bdf4750f0, flags=...) at kernel/qeventdispatcher_glib.cpp:423
      #16 0x00007f30f36b2f0b in QEventLoop::exec (this=this@entry=0x7ffca99b96d0, flags=..., flags@entry=...) at ../../include/QtCore/../../src/corelib/global/qflags.h:69
      #17 0x00007f30f36bb19b in QCoreApplication::exec () at ../../include/QtCore/../../src/corelib/global/qflags.h:121
      #18 0x00007f30f2760edd in QGuiApplication::exec () at kernel/qguiapplication.cpp:1863
      #19 0x00007f30f3baeae9 in QApplication::exec () at kernel/qapplication.cpp:2832
      #20 0x0000562bdefe06a3 in main (argc=<optimized out>, argv=<optimized out>) at main.cpp:72
      

      Impact: I (Orca maintainer) have added a temporary check to not do this call on objects with the "tree" role because of this bug. Without that check apps commonly used by Orca users (e.g. Mumble) will crash.

      Attachments

        Issue Links

          No reviews matched the request. Check your Options in the drop-down menu of this sections header.

          Activity

            People

              qt.team.quick.subscriptions Qt Quick and Widgets Team
              joanmarie Joanmarie Diggs
              Votes:
              3 Vote for this issue
              Watchers:
              6 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Gerrit Reviews

                  There are no open Gerrit changes